Commit Graph

25491 Commits

Author SHA1 Message Date
Ross Burton
1a51bb69b7 base: check for existing prefix when expanding names in PACKAGECONFIG
When the DEPENDS are added as part of the PACKAGECONFIG logic the list of
packages are expanded so that any required nativesdk-/-native/multilib prefixes
and suffixes are added.

However the special handling of virtual/foo names doesn't check that the prefix
already exists, which breaks under nativesdk as in that situation there's an
explicit nativesdk- prefix *and* MLPREFIX is set to nativesdk-.  This results in
the same prefix being applied twice, and virtual packages such as virtual/libx11
ending up as virtual/nativesdk-nativesdk-libx11.

(From OE-Core rev: 9e7d207e207bf0319b09d403d87d37f24e3dfbee)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11 23:15:01 +00:00
Craig McQueen
6e32be7c7b os-release: put double-quotes around variable contents
This makes the resulting /etc/os-release file have valid shell
assignment syntax. This makes it loadable by a shell script, using the
'source' command:

    source /etc/os-release

(From OE-Core rev: bab590d738e218fb2da2b3bf27933fe4562de870)

Signed-off-by: Ross Burton <ross.burton@intel.com>

(From OE-Core master rev: f6e0ea000fa3b9a726ab56500f643f9902371618)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11 10:57:03 +00:00
Arnold Csorvasi
d6fed74776 image_types_uboot: add cpio.gz.uboot to supported IMAGE_TYPES
U-Boot needs the U-Boot header in a ramdisk image to boot it.
Add this header to the cpio.gz image, so that it can be booted
with U-Boot.

(From OE-Core rev: 240ecb6ac624cd6e5d813d8144c7a7f2d7adb31f)

Signed-off-by: Arnold Csorvasi <arnold.csorvasi@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

(From OE-Core master rev: 8376fa3d4ef6175b83ab7f1ec8e4e20ec14964f4)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11 10:57:03 +00:00
Ross Burton
6e8edf0e0f libsdl: expand PACKAGECONFIG and enable native builds
Use PACKAGECONFIG instead of using logic in DEPENDS and EXTRA_OECONF, adding new
options for PulseAudio, tslib, DirectFB, OpenGL and X11.  Pass
--disable-x11-shared so that it links to the X libraries instead of using
dlopen().

Disable tslib by default as the kernel event input subsystem is generally used.

SDL's OpenGL support requires X11 so check for both x11 and opengl, and merge
the dependencies.

Finally enable native builds, with a minimal PACKAGECONFIG that will build from
oe-core for native and nativesdk.

(From OE-Core rev: 66205c6096ce9d8bc828bf9b61d927cb495f69b1)

Signed-off-by: Ross Burton <ross.burton@intel.com>

(From OE-Core master rev: 3d6c31c3a4ff34376e17005a981bb55fc6f7a38f)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11 10:57:03 +00:00
Mariano Lopez
87ba508688 image_types.bbclass: Rebuild when WICVARS change
The procces to do a wic image is to save a file with
variables required by wic and then call wic using this
file. Because this is external to bitbake if the vars
change, the image won't be rebuild; an example of such
is IMAGE_BOOT_FILES.

This patch adds these variables to vardeps of do_rootfs
when a wic image is build. This will rebuild the image
if a variable needed by wic changes.

[YOCTO #8693]

(From OE-Core rev: 91d4706d356659e46923a8314f1a2aa259ead4fe)

Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

(From OE-Core master rev: 12c54d50ed4c321dc272beb3c6cb770965c979f1)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11 10:57:03 +00:00
Christopher Larson
9991263ffe image_types: improve wks path specification
Hardcoding a full input path with zero flexibility goes against everything the
Yocto Project is about. Rework it to let the user specify the wks base
filename with WKS_FILE and it'll search the layers for the wks file and use
it.

(From OE-Core rev: cb5c5d950a83b85881eeadc0362230fa2720962f)

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

(From OE-Core master rev: 8cc7f5229f5447c2183ac319dd52c7ed737ec89b)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-11 10:57:03 +00:00
Armin Kuster
05c31507da openssl: Security fix CVE-2016-0800
CVE-2016-0800 SSL/TLS: Cross-protocol attack on TLS using SSLv2 (DROWN)

https://www.openssl.org/news/secadv/20160301.txt

(From OE-Core rev: c99ed6b73f397906475c09323b03b53deb83de55)

Signed-off-by: Armin Kuster <akuster@mvista.com>

Not required for master, an update to 1.0.2g has been submitted.
Backport to fido is required.
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-03 10:38:46 +00:00
Hongxu Jia
6945a4fdde wpa-supplicant: Fix CVE-2015-8041
Backport patch from http://w1.fi/security/2015-5/
and rebase for wpa-supplicant 2.4

(From OE-Core rev: 4d0ebfd77c07475494665dde962137934dd2194a)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>

Not needed in master since the upgrade to 2.5
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-03-03 10:38:46 +00:00
Richard Purdie
b1f23d1254 build-appliance-image: Update to jethro head revision
(From OE-Core rev: 0c702756dd0009c4112028fbf2479a346867b32c)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-24 09:04:22 +00:00
Armin Kuster
7fe17a2942 qemu: Security fix CVE-2016-2198
CVE-2016-2198 Qemu: usb: ehci null pointer dereference in ehci_caps_write

(From OE-Core rev: 646a8cfa5398a22062541ba9c98539180ba85d58)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-21 09:37:33 +00:00
Armin Kuster
50700a7da6 qemu: Security fix CVE-2016-2197
CVE-2016-2197 Qemu: ide: ahci null pointer dereference when using FIS CLB engines

(From OE-Core rev: ca7cbcf22558349f0b43ed7dc84ad38d7c178c55)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-21 09:37:33 +00:00
Armin Kuster
1f0e615bec libgcrypt: Security fix CVE-2015-7511
CVE-2015-7511 libgcrypt: side-channel attack on ECDH with Weierstrass curves

affects libgcrypt < 1.6.5

Patch 1 is a dependancy patch. simple macro name change.
Patch 2 is the cve fix.

(From OE-Core rev: c691ce99bd2d249d6fdc4ad58300719488fea12c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-21 09:37:33 +00:00
Armin Kuster
dc5f155e15 uclibc: Security fix CVE-2016-2225
CVE-2016-2225 Make sure to always terminate decoded string

This change is being provide to comply to Yocto compatiblility.

(From OE-Core rev: 093d76f3f4a385aae46304bd572ce1545c6bcf33)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-21 09:37:33 +00:00
Armin Kuster
ef135112fd uclibc: Security fix CVE-2016-2224
CVE-2016-2224 Do not follow compressed items forever.

This change is being provide to comply to Yocto compatiblity.

(From OE-Core rev: 4fe0654253d7444f2c445a30b06623cef036b2bb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-21 09:37:32 +00:00
Armin Kuster
ae57ea03c6 libbsd: Security fix CVE-2016-2090
CVE-2016-2090 Heap buffer overflow in fgetwln function of libbsd

affects libbsd <= 0.8.1 (and therefore not needed in master)

(From OE-Core rev: e56aba3a822f072f8ed2062a691762a4a970a3f0)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18 10:57:11 +00:00
Armin Kuster
eb9666a3e2 glibc: Security fix CVE-2015-7547
CVE-2015-7547: getaddrinfo() stack-based buffer overflow

(From OE-Core rev: cf754c5c806307d6eb522d4272b3cd7485f82420)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18 07:42:07 +00:00
Richard Purdie
5b12268f6e build-appliance-image: Update to jethro head revision
(From OE-Core rev: 05e551d821594b0f4c06328386b6a82e0801ac2a)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:57:07 +00:00
Armin Kuster
a3a374a639 curl: Secuirty fix CVE-2016-0755
CVE-2016-0755 curl: NTLM credentials not-checked for proxy connection re-use

(From OE-Core rev: 8322814c7f657f572d5c986652e708d6bd774378)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
f4341a9b6f curl: Security fix CVE-2016-0754
CVE-2016-0754 curl: remote file name path traversal in curl tool for Windows

(From OE-Core rev: b2c9b48dea2fd968c307a809ff95f2e686435222)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
35f4306ed4 nettle: Security fix CVE-2015-8804
(From OE-Core rev: 7474c7dbf98c1a068bfd9b14627b604da5d79b67)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
3e8a07b901 nettle: Security fix CVE-2015-8803 and CVE-2015-8805
(From OE-Core rev: f62eb452244c3124cc88ef01c14116dac43f377a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
5ffc3267e7 socat: Security fix CVE-2016-2217
this address both
Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL"
and Socat security advisory 8: "Stack overflow in arguments parser

[Yocto # 9024]

(From OE-Core rev: 0218ce89d3b5125cf7c9a8a91f4a70eb31c04c52)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
5cc5f99bba libpng: Security fix CVE-2015-8472
libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

this patch fixes an incomplete patch in CVE-2015-8126

(From OE-Core rev: f4a805702df691cbd2b80aa5f75d6adfb0f145eb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
21a816c73a libpng: Security fix CVE-2015-8126
libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

(From OE-Core rev: d0a8313a03711ff881ad89b6cfc545f66a0bc018)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
6a0fbfaeb5 foomatic-filters: Security fixes CVE-2015-8327
CVE-2015-8327 cups-filters: foomatic-rip did not consider the back tick as an illegal shell escape character

this time with the recipe changes.

(From OE-Core rev: 62d6876033476592a8ca35f4e563c996120a687b)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:24 +00:00
Armin Kuster
d57aaf7a39 foomatic-filters: Security fix CVE-2015-8560
CVE-2015-8560 cups-filters: foomatic-rip did not consider semicolon as illegal shell escape character

(From OE-Core rev: 307056ce062bf4063f6effeb4c891c82c949c053)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 22:55:23 +00:00
Richard Purdie
941874ae29 build-appliance-image: Update to jethro head revision
(From OE-Core rev: a2b1d9a6f0f29a2d21c80e549b10f3522df20c11)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 17:23:54 +00:00
Jens Rehsack
d74a3cb765 cross-localedef-native: add ABI breaking glibc patch
Add patch from commit 96b1b5c127 to cross-localedef-native
to avoid broken images built with ENABLE_BINARY_LOCALE_GENERATION set to 1:

    $ sh -c "export LANG=de_DE; ls -la"
    sh: loadlocale.c:130: _nl_intern_locale_data: Assertion `cnt < (sizeof (_nl_value_type_LC_COLLATE) / sizeof (_nl_value_type_LC_COLLATE[0]))' failed.
    Aborted

(From OE-Core rev: 2ddfcfaa996d8c675b5c161acb605dc5573eba67)

Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-07 17:23:01 +00:00
Richard Purdie
12fae23964 build-appliance-image: Update to jethro head revision
(From OE-Core rev: 113812945c3cddfec75d67d781c0fa2d7ee02762)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-05 11:17:08 +00:00
Richard Purdie
67ac9d6254 e2fsprogs: Ensure we use the right mke2fs.conf when restoring from sstate
If we don't do this, we can use an mke2fs.conf from a different path which
may contain incompatible flags and lead to obtuse build failures such as:

Invalid filesystem option set: has_journal,extent,huge_file,flex_bg,metadata_csum,64bit,dir_nlink,extra_isize

To fix this, wrap the mke2fs binary and its hardlinks and point at the
correct configuration file.

In particular this fixes conflicts between master and jethro builds
affecting the main autobuilder.

(From OE-Core rev: 0ef6277463517fb0e52b4bd65ca5f6ab42315773)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-05 11:16:46 +00:00
Richard Purdie
5812fc9e20 build-appliance-image: Update to jethro head revision
(From OE-Core rev: f3831307d7c849e60c4141f7bfe4067ec5ff224a)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:23:31 +00:00
Ross Burton
4c075e7114 piglit: don't use /tmp to write generated sources to
If there are multiple builds on the same machine then piglit writing it's
generated sources to /tmp will race.  Instead, export TEMP to tell the tempfile
module to use a temporary directory under ${B}.

(From OE-Core rev: 226a26e51eb0789686509d3e22a3766e2e3e8666)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:18 +00:00
Alejandro Hernandez
e9f95df962 linux-yocto: Update SRCREV for qemux86* for 4.1, fixes CVE-2016-0728
This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring(), and upgrades to LINUX_VERSION 4.1.17

(From OE-Core rev: f070d5fee56a4589a6abf422e6872373c5557c6d)

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Alejandro Hernandez
e63bab1a09 linux-yocto: Update SRCREV for qemux86* for 3.19, fixes CVE-2016-0728
This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring()

(From OE-Core rev: 8cb97ea8ed59ee77c0542b50d1af65bf9a3c3fef)

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Alejandro Hernandez
64a492097f linux-yocto: Update SRCREV for qemux86* for 3.14, fixes CVE-2016-0728
This addresses CVE-2016-0728: KEYS: Fix keyring ref leak in join_session_keyring(), and upgrades to LINUX_VERSION 3.14.39

(From OE-Core rev: ce53ebc001af87d169a2e0e98ca3d7d4729fdec4)

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Maxin B. John
5b043dafa3 libpng12: update URL that no longer exists
Fix the following warning:

WARNING: Failed to fetch URL http://downloads.sourceforge.net/project/
libpng/libpng12/1.2.53/libpng-1.2.53.tar.xz, attempting MIRRORS if
available.

[YOCTO #8739]

(From OE-Core rev: 02363e50b4a3d124fa71edb2870deb820567482b)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Maxin B. John
655c8a5c9d libpng: update URL that no longer exists
Fix the following warning:

WARNING: Failed to fetch URL http://downloads.sourceforge.net/
project/libpng/libpng16/1.6.17/libpng-1.6.17.tar.xz, attempting
MIRRORS if available

[YOCTO #8739]

(From OE-Core rev: dbde0550ce0cc112947367eb89b914be5b3359a7)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Ross Burton
96fda8c8f6 busybox: fix build of last applet
If CONFIG_FEATURE_LAST_SMALL is enabled the build fails because of a broken
__UT_NAMESIZE test.

[ YOCTO #8869 ]

(From OE-Core rev: 6348b2e8e0510b45f4afd2018e90796714863fc1)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Joe Slater
ae037d974e ghostscript: add dependency for pnglibconf.h
When using parallel make jobs, we need to be sure that
pnglibconf.h is created before we try to reference it,
so add a rule to png.mak.

(From OE-Core rev: 4b7bda9d1ac836de0c657cca28044b822e444bea)

Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit fad19750d23aad2d14a1726c4e3c2c0d05f6e13d)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Jussi Kukkonen
26eb877e18 gcr: Require x11 DISTRO_FEATURE
This enables a world build without x11. GTK3DISTROFEATURES is not
enough because gtk+-x11.pc is still required.

Fixes [YOCTO #8611].

(From OE-Core rev: b1175339287395a7ad4fe4639a73f3a1dda74358)

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit dbdcd87144cc1cd6c5d50c800c7f266aaf25ca17)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Bogdan-Alexandru Voiculescu
e632cdb031 uClibc: enable utmp for shadow compatibility
with the enabling of utmpx in busybox and uClibc it was noted that shadow
support for utmpx also needs utmp explicitly enabled in uclibc. this is
a workaround that might be removed once shadow properly supports
--enable-utmpx to check for utmpx configuration instead of utmp like
it does now

[YOCTO #8243]
[YOCTO #8971]

(From OE-Core rev: 05cab660ea956aabf6e6f971bdc5c9e2d94b9f2d)

Signed-off-by: Bogdan-Alexandru Voiculescu <bogdanx.a.voiculescu@intel.com>
Signed-off-by: Benjamin Esquivel <benjamin.esquivel@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 969158d63ba2c8e2e11af41c2a6d4f1aa5b0099f)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Armin Kuster
e8c96131d9 git: Security fix CVE-2015-7545
CVE-2015-7545 git: arbitrary code execution via crafted URLs

(From OE-Core rev: 1e0780427bad448c5b3644134b581ecf1d53af84)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:17 +00:00
Armin Kuster
108ea6d05f glibc-locale: fix QA warning
WARNING: QA Issue: glibc-locale: /glibc-binary-localedata-sd-in/usr/lib/locale/sd_IN/LC_CTYPE is owned by uid 1000, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated]

fix type
(From OE-Core rev: 9d5cd7a353ec257c88d54dd9af2327b0d86d5662)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00
Armin Kuster
9a88c1d255 grub: Security fix CVE-2015-8370
CVE-2015-8370 grub2: buffer overflow when checking password entered during bootup

(From OE-Core rev: b63e3b57b47e95003a1fb014f90333c327681d5b)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00
Armin Kuster
443b09a61d gdk-pixbuf: Security fix CVE-2015-7674
CVE-2015-7674 Heap overflow with a gif file in gdk-pixbuf < 2.32.1

(From OE-Core rev: f2b16d0f9c3ad67fdf63e9e41f42a6d54f1043e4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00
Armin Kuster
6c910685ec librsvg: Security fix CVE-2015-7558
CVE-2015-7558 librsvg2: Stack exhaustion causing DoS

including two supporting patches.

(From OE-Core rev: 4945643bab1ee6b844115cc747e5c67d874d5fe6)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00
Armin Kuster
9fd2349842 bind: Security fix CVE-2015-8461
CVE-2015-8461 bind: race condition when handling socket errors can lead to an assertion failure in resolver.c\

(From OE-Core rev: 1656eaa722952861ec73362776bd0c4826aec3da)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00
Armin Kuster
5a40d9fb69 bind: Security fix CVE-2015-8000
CVE-2015-8000 bind: responses with a malformed class attribute can trigger an assertion failure in db.c

(From OE-Core rev: a159f9dcf3806f2c3677775d6fb131dab17a5a17)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00
Armin Kuster
1bbf18385b libxml2: Security fix CVE-2015-8710
CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

(From OE-Core rev: 03d481070ebc6f9af799aec5d038871f9c73901c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00
Armin Kuster
2ec6d1dcbc libxml2: Security fix CVE-2015-8241
CVE-2015-8241 libxml2: Buffer overread with XML parser in xmlNextChar

(From OE-Core rev: f3c19a39cdec435f26a7f46a3432231ba4daa19c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-04 23:20:16 +00:00