Commit Graph

11 Commits

Author SHA1 Message Date
Yue Tao
09f471bfd0 subversion: fix for Security Advisory CVE-2013-4277
Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through
1.8.1 allows local users to overwrite arbitrary files or kill arbitrary
processes via a symlink attack on the file specified by the --pid-file
option.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4277

(From OE-Core rev: e0e483c5b2f481240e590ebb7d6189a211450a7e)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21 09:09:00 +01:00
Yue Tao
ab6c3223a6 subversion: fix for Security Advisory CVE-2013-1847 and CVE-2013-1846
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21
and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of
service (NULL pointer dereference and crash) via a LOCK on an activity URL.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1846

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20
and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service
(NULL pointer dereference and crash) via an anonymous LOCK for a URL that does
not exist.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1847

(From OE-Core rev: 3962b76185194fa56be7f1689204a1188ea44737)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21 09:09:00 +01:00
Yue Tao
128adcb714 subversion: fix for Security Advisory CVE-2013-1845
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before
1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to
cause a denial of service (memory consumption) by (1) setting or (2)
deleting a large number of properties for a file or directory.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1845

(From OE-Core rev: 432666b84b80f8b0d13672aa94855369f577c56d)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21 09:09:00 +01:00
Yue Tao
e8d6c874a7 subversion: fix for Security Advisory CVE-2013-4505
The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0
through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass
intended access restrictions and possibly cause a denial of service
(resource consumption) via a relative URL in a REPORT request.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4505

(From OE-Core rev: 02314673619f44e5838ddb65bbe22f9342ee6167)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21 09:09:00 +01:00
Yue Tao
4fc1cff43b subversion: fix for Security Advisory CVE-2013-1849
Reject operations on getcontentlength and getcontenttype properties
if the resource is an activity.

(From OE-Core rev: 94e8b503e8a5ae476037d4aa86f8e27d4a8c23ea)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21 09:08:59 +01:00
Robert Yang
5142a1e95e subversion: do_install failed (parallel issue)
install-neon-lib needs libsvn_delta-1.la which will be regenerated
during libsvn_delta-1.la's installation, if libsvn_delta-1.la is
in regenerating and at the same time install-neon-lib links it, the
error willl happen.

The error message is:
/bin/ld: cannot find -lsvn_delta-1
collect2: error: ld returned 1 exit status

This is a parallel issue, so it doesn't happen often.

Note:
The autoreconf doesn't generate build-outputs.mk, it would be generated
by autogen.sh (use build.conf as the input), but autogen.sh isn't
suitable for cross compiling, so both modified build-outputs.mk and
build.conf.

[YOCTO #2727]

(From OE-Core rev: ce37c45abb4cf43e5009867f695982de2eb33450)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2012-07-10 20:35:11 +01:00
Martin Jansa
e6706bf559 subversion: remove neon-detection.patch and --with-neon option
* upstream detection seems to be doing its job right now
* I don't see how this is supposed to work
  --      neon_config="$withval/bin/neon-config"
  -+      neon_config="env env PKG_CONFIG_PATH=${withval}:${PKG_CONFIG_PATH} pkg-config neon"
  when neon_config should be sysroots/nokia900/usr/bin/crossscripts/neon-config
"

(From OE-Core rev: 6466de31048260089b8988280f77efdb14ac2f21)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-09-16 13:30:23 +01:00
Nitin A Kamble
2e4518bf18 recipes: Fix the Upstream-Status format
(From OE-Core rev: d7237140554ad076be12edf915d6d15206c9b8c7)

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-05-11 17:14:26 +01:00
Nitin A Kamble
22d6a13849 subversion: update upstream status for patches
(From OE-Core rev: 634649e150af01e303553295d0fbdab48efecae7)

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-05-09 14:09:04 +01:00
Nitin A Kamble
32121906e7 subversion: upgrade from 1.6.13 to 1.6 15
Rebased this patch to the newer code
	modified:   subversion/disable-revision-install.patch

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
2011-02-02 17:55:01 +00:00
Nitin A Kamble
bc02b535ed subversion: upgrade from 1.5.5 to 1.6.13
And update recipe checksums

rebased neon-detection.patch:
upstream code has some of the changes similar to the changes in the
patch. Removing the duplicate changes from the patch file.

subversion: update LIC_CHKSUM_FILES field

Noticed this change in the COPYING file:

$ diff -u COPYING /tmp/COPYING
--- COPYING	2006-05-28 07:41:18.000000000 -0700
+++ /tmp/COPYING	2010-12-03 11:16:15.000000000 -0800
@@ -10,7 +10,7 @@
 on), you may use a newer version instead, at your option.

 ================================================================
-Copyright (c) 2000-2006 CollabNet.  All rights reserved.
+Copyright (c) 2000-2009 CollabNet.  All rights reserved.

 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
2010-12-06 22:02:26 +00:00