ISC DHCP allows remote attackers to cause a denial of
service (application crash) via an invalid length field
in a UDP IPv4 packet.
(From OE-Core rev: 43f2cfdf63fb70e3c2da0224221dae63b05477df)
Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2015-8704 bind: specific APL data could trigger an INSIST in apl_42.c
(From OE-Core rev: 600c1d2beb64e23123e478051537b917f5d4a8a7)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
this address two CVE's.
CVE-2016-0777 and CVE-2016-0778
(From OE-Core rev: 1c05115a906499989d2159683195ed6d2cda75ba)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Corrects the URI of the openssl's recipe from fido. The sources were moved
to a new subdirectory.
(From OE-Core rev: 685e861f085736a4b0bae09bab86c3d456ec84ae)
Signed-off-by: Thomas Perrot <thomas.perrot@tupi.fr>
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
three security fixes.
CVE-2015-6563 (Low) openssh: Privilege separation weakness related to PAM support
CVE-2015-6564 (medium) openssh: Use-after-free bug related to PAM support
CVE-2015-6565 (High) openssh: Incorrectly set TTYs to be world-writable
(From OE-Core rev: 259df232b513367a0a18b17e3e377260a770288f)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fix was included in the master branch with the upgrade
to 2.4, backport it to fido as the vulnerability was already
present in 2.3.
(From OE-Core rev: 12fc04731d26597bfb9d9f1713c96b11c8186c43)
Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Modify the dhcp.inc with using the variable ${PN} instead of direct
packagename, so that the content will not be override after expanding
while we build the lib32-dhcp package with FILES_${PN}-xxxx_append.
(From OE-Core rev: c758dcc3109a5b491d13373073214bf526943497)
(From OE-Core rev: 7436d12c9b40502a5e1ec670d76cc9ab755cbaba)
Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* add leading space so that it works even with some .bbappend adding
additional files to SRC_URI without trailing space
(From OE-Core rev: 0f282f1d4946ac6e81959c66172c115405632a26)
(From OE-Core rev: a8dd5d64c2ff2fe8bb4d39260ed82f6bf0d0277f)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add /etc/modules-load.d/nfsd.conf so that the system loads nfsd at start-up.
Add proc-fs-nfsd.mount systemd unit file because it's needed for nfs server
to start correctly.
After this change, in a systemd based image, we can use `systemctl start
nfs-server' to start the nfs server and things would work correctly.
(From OE-Core rev: 3d4380bb36eb108dc75fee7215b615f7800b0990)
(From OE-Core rev: 27633405aa3509c207d986b434d430f2cd380541)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The cherry-pick from the master branch added the patch file but didn't apply
it in the recipe.
(From OE-Core rev: 375674fa5f2534198036be60972d39e1e6793d3a)
Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This upgrade fixes CVE-2015-1793
Removed openssl-fix-link.patch. The linking issue has been fixed in openssl.
(From OE-Core master rev: 631632addbc81b06b7accfca8f8a9871d6b09111)
(From OE-Core rev: 7b151426fb8a69cfdd25b7f1de2b506cbcffcac6)
Signed-off-by: Jan Wetter <jan.wetter@mikrom.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
upgrade to fix the CVE: CVE-2015-1788..CVE-2015-1792 and CVE-2014-8176
remove a backport patch
update the c_rehash-compat.patch
(From OE-Core master rev: 5a70e45b8c6cb0fa7ea4fe1b326ad604508d00cb)
(From OE-Core rev: 7bc77f508a6ba6a409568be818a1795770261dc6)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Joshua Lock <joshua.lock@collabora.co.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3310
Buffer overflow in the rc_mksid function in plugins/radius/util.c in
Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is
greater than 65535, allows remote attackers to cause a denial of
service (crash) via a start accounting message to the RADIUS server.
oe-core is using ppp 2.4.7, and this CVE say ppp 2.4.7 was not
effected, but I found this buggy codes are same between 2.4.6 and
2.4.7, and 2.4.7 should have this issue.
(From OE-Core rev: 5b549c6d73e91fdbd0b618a752d618deb1449ef9)
(From OE-Core rev: 5450caccd45a2ee35ee227cdd64e66a304909a0e)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
padlock_conf.patch will enable the padlock engine by default,
but this engine does not work on some 32bit machine, and lead
to openssl unable to work
(From OE-Core rev: f7d186abca6ed9b48ae7393b8f244e1bfb46cb41)
(From OE-Core rev: bbc41bc086009726f307edeedbd380c68b1be6a7)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
They are backport patches, and verified that the patches are in the
source.
(From OE-Core rev: 6e4a10ab030c192e2437592538e4713b1ee2032b)
(From OE-Core rev: fd5115556a12c8c2d95c02f077dc38ea4c9253f5)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Removed:
- openssl-avoid-NULL-pointer-dereference-in-dh_pub_encode.patch
- upgate-vegsion-script-for-1.0.2.patch
Since they are already in the source.
- make-targets.patch
It removed test dir from DIRS, which is not needed any more since we
need build it.
(From OE-Core rev: 5fa533c69f92f2dd46c795509b0830b36413b814)
(From OE-Core rev: 2635d1dbe0ef0b43c7505d9c43494eac0f2e6760)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
on some hosts openssl fails to build with this error:
ghash-x86_64.s: Assembler messages:
ghash-x86_64.s:890: Error: junk '.15473355479995e+19' after expression
backported fix from community.
(From OE-Core master rev: 8230f873921d5c16106e3ebf57053a646bc6ad78)
(From OE-Core rev: b981717484c70c6c9bcd6dacb736c2844fa863ed)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Just run configure, the configure script is not really
a autoconf generated script so just run it
Include path is needed to be there since
the headers from it are used during build in subcomponents
Change-Id: Ib1f24fd18bc8564e3c74ab834b7cf0fdf955d0e1
(From OE-Core master rev: c64c9f7ffc88018404afdde373dfd7ef2bdf7ae8)
(From OE-Core rev: a11ebe122bc31127bae59a65dbabe9ce5c3f568c)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ConnMan commit ac332c5d01b0737c18cb58c8ccc67cf6b0427e1d changes
how the connman.service file is created from .in file. After
that commit, the file is created by Makefile instead of configure.
This means that we need to tweak the service file in compile
time instead of configure time because the generated file will not
be there after the configuration.
This commit can be used even with older ConnMan version as the
connman.service file is there when the compilation happens.
(From OE-Core master rev: 32839103727d92a6580f916b6dd8e4439b2347c8)
(From OE-Core rev: 66d8cec7225cae7269c539d9372a1364c9cefc0d)
Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There's no libnl1 recipe in oe-core (or any other layer in the layer
index).
Keeping the libnl1 PACKAGECONFIG is likely to cause problems for the
libnl PACKAGECONFIG since libnl and libnl1 both use --with-libnl and
--without-libnl.
(From OE-Core master rev: 4c820481147e9c11160b00f7df7ca8c329b23eac)
(From OE-Core rev: c914254e9ec218d590fc77b921dbddf31b2d41c7)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The SystemD D-Bus configuration should only to be installed when
SystemD support is enabled.
(From OE-Core rev: e658ee16dc026b96f67a4c9666d3eb7bf7027de3)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The neard make scripts will place the daemon executable
in /usr/lib/neard/nfc/neard. Change the path accordingly
in init scripts.
Fixes [YOCTO #7390].
(From OE-Core rev: bd277f3a46e7fc764cc55c5354d2136fcfddc3c1)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some package formats explicitly track which files are configuration files
so that they are not overwritten on updates. We must use an explicit list
instead of a wildcard as nfs-utils-client provides files under
${localstatedir}/lib/nfs that are not configuration files.
Signed-off by: Rob Woolley <rob.woolley@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The file nfsmount.conf is present in nfs-utils but not installed to the
filesystem. It has been added to nfs-utils-client as it seemed to be
missing accidentally rather than being removed intentionally. The binary
files in nfs-utils-client have a hard-coded reference to it and we
already provide the manpage for it in nfs-utils-doc.
Signed-off by: Rob Woolley <rob.woolley@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed:
WARNING: Failed to fetch URL ftp://ftp.debian.org/debian/pool/main/r/resolvconf/resolvconf_1.76.tar.xz, attempting MIRRORS if available
(From OE-Core rev: f4db91f5228129d5e8cf65f9c4919b4fdfc5306b)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rebased numerous patches
removed aarch64 initial work since it's part of upstream now
Imported a few additional patches from Debian to support the version-script
and blacklist additional bad certificates.
(From OE-Core rev: 10b689033551c37d6cafa284d82bdccd43f6113e)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libpcap was not previously installing a pkg-config file. Add a basic one
that will allow using 'pkg-config --libs libpcap', for example, in recipes
rather than 'pcap-config', which frequently returns incorrect information.
(From OE-Core rev: 0f51c1260ac53aa4843e29b00cd600eb64074260)
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This reverts commit b003df0335.
We keep seeing parallel make failures on the autobuilder
(From OE-Core rev: af46b9f5dd5436b3d48f2fcd7a69f32343b62442)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This reverts commit 7502fa5feb.
We keep seeing parallel make failures in openssl :(
(From OE-Core rev: 9afc85a7be203c5a0eac1977e777a24504cb3088)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed:
unix/os.o: file not recognized: File truncated
collect2: error: ld returned 1 exit status
This is because os.o was built twice:
* The implicity rule (depends on unix/os.o)
* The "make all" in unix subdir (depends on unix/os.o)
Depend on subdirs which is unix only rather than unix/os.o will fix the
problem.
(From OE-Core rev: 1af699e1af2552659b90a1fadd8de73d780226ba)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Because of the SSLv3 POODLE vulnerability, it's preferred to simply disable
SSLv3 even if patched with the TLS_FALLBACK_SCSV
(From OE-Core rev: 4e691d06ffdb4d1fd940996f419308fe53454df7)
Signed-off-by: Brendan Le Foll <brendan.le.foll@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
connman currently supports both bluez4 and bluez5 without distinguishing
them at configuration time.
(From OE-Core rev: 420ab90167e434d6972702c44271104881f08fc9)
Signed-off-by: Peter A. Bigot <pab@pabigot.com>
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
