Commit Graph

36888 Commits

Author SHA1 Message Date
Maxin B. John
72ea3c272c curl: security fix for CVE-2016-5420
Affected versions: libcurl 7.1 to and including 7.50.0

(From OE-Core rev: 6b732a392289a7bb50b0e3716c066c62fa32a14d)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:35 +01:00
Maxin B. John
0e0c04343d curl: security fix for CVE-2016-5419
Affected versions: libcurl 7.1 to and including 7.50.0

(From OE-Core rev: d1d6c93b491056b18b528216303047e353956e34)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:34 +01:00
Enrico Jorns
4037644690 perl-ptest.inc: fix tar call to prevent objcopy failure
With tar version 1.29, the tar call used to copy the ptest files will
not work anymore. While the call did not match the man page (but worked)
before, anyway, the latest update of tar seems to have a more strict argument
handling.

With the current version of the tar call, the copying of files still
works with latest tar version, but the excludes will not be handled
properly anymore.
This results in having binaries compiled with host GCC in the package.
When doing the strip_and_split files in do_package() with the target
objcopy, bitbake will fail with this error:

  ERROR: objcopy failed with exit code 256 (cmd was [...])
  [...]
  File format not recognized

Thus, the current argument issues and required changes are:

 * Options must be placed _before_ the pathnames.

 * --exclude must be followd by a '=' in order to work properly

 * 'f' options is for providing an archive file, which is unnecessary in
   this case

Note that this could also be a candidate for backporting.

(From OE-Core master rev: 2e498879098f7d84610aed7961d92433083d9a02)

(From OE-Core rev: a27b907dd3ad20fc60b7732c19012793aaaba2df)

Signed-off-by: Enrico Jorns <ejo@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Anuj Mittal
64b9c83b0c gcc: make sure header path is set correctly
We're setting the native header paths in do_configure_prepend,
and don't need to set them again here.

This results in gcc-target not being able to locate the headers
and not being able to detect glibc version, which in turn
results in SSP support not getting detected even though it's available
in libc.

(From OE-Core master rev: 85630aa894278e7818c867179dc19ca2fbd994fc)

(From OE-Core rev: f28840de3912c805acde8d11188f0c48617678ab)

Signed-off-by: Anuj Mittal <anujx.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
96456b15ea tzdata: update to 2016e
Changes affecting future time stamps

Africa/Cairo observes DST in 2016 from July 7 to the end of October.
Guess October 27 and 24:00 transitions. (Thanks to Steffen Thorsen.)
For future years, guess April's last Thursday to October's last
Thursday except for Ramadan.

Changes affecting past time stamps

Locations while uninhabited now use '-00', not 'zzz', as a
placeholder time zone abbreviation.  This is inspired by Internet
RFC 3339 and is more consistent with numeric time zone
abbreviations already used elsewhere.  The change affects several
arctic and antarctic locations, e.g., America/Cambridge_Bay before
1920 and Antarctica/Troll before 2005.

Asia/Baku's 1992-09-27 transition from +04 (DST) to +04 (non-DST) was
at 03:00, not 23:00 the previous day.  (Thanks to Michael Deckers.)

(From OE-Core master rev: ddcf128e76ed0678ce42416531f4ecb309c57439)

(From OE-Core rev: 225f3b4ea4c7c7439bba2b3a85f24ea94d2f47bc)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
d8b15a0384 tzcode: update to 2016e
V2: typo in title (jet lagged)
Changes to code

zic now outputs a dummy transition at time 2**31 - 1 in zones
whose POSIX-style TZ strings contain a '<'.  This mostly works
around Qt bug 53071 <https://bugreports.qt.io/browse/QTBUG-53071>.
(Thanks to Zhanibek Adilbekov for reporting the Qt bug.)

Changes affecting documentation and commentary

tz-link.htm says why governments should give plenty of notice for
time zone or DST changes, and refers to Matt Johnson's blog post.
tz-link.htm mentions Tzdata for Elixir.  (Thanks to Matt Johnson.)

(From OE-Core master rev: 5f3340e5c966f4233e0cd4ec468b20a1fd5a7346)

(From OE-Core rev: 6d9e6b6fb2c8c6c80a5981b0f91987b433b6ea24)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
George McCollister
9149baa38d wic: fix path parsing, use last occurrence
If the path contains 'scripts' more than once the first occurrence will be
incorrectly used. Use rfind instead of find to find the last occurrence.

(From OE-Core rev: fd544c3ef6ece1e2f9849ee87227efc6d0954e15)

Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Nicolas Dechesne
a01d3234f6 bluez5: move btmgmt to common READLINE section
Upstream in 5.33 btmgmt was moved from experimental to common READLINE section,
in commit e4f0c5582f1fe3451d5588243adba9de1ed68b80, but this was never updated
in the recipe.

This is a backport from master branch, commit
28777e593d3dd3a5d0ee2effcdca6a971e2887f9.

(From OE-Core rev: cbe0648e234e83b8ffc336118d3ee2967b4bb175)

Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
3b2c540986 libxml2: Security fix for CVE-2016-4448
Affects libxml2 < 2.9.4

(From OE-Core rev: d4343f428c89c6c238cc7cd4c4732448a00003e4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
ad7cab35ff libxml2: Security fix for CVE-2016-4447
Affects libxml2 < 2.9.4

(From OE-Core rev: b817c98017cb64f902cdae514fb162b3199a0a14)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
4e260c96f4 libxml2: Security fix for CVE-2016-3627
Affects libxml2 < 2.9.4

(From OE-Core rev: ceabe39237a035efda6a74c746848a9fbab30a08)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
1ecd2f56aa libxml2: Security fix for CVE-2016-1833
Affects libxml2 < 2.9.4

(From OE-Core rev: 990b5427fd3bf5c00ac7c5820d5f455378776b62)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
1081306623 libxml2: Security fix for CVE-2016-1835
Affects libxml2 < 2.9.4

(From OE-Core rev: d008b7023cb703a787c8fcac5cd87628b38a9ecd)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
f96cfb009d libxml2: Security fix for CVE-2016-1837
Affects libxml2 < 2.9.4

(From OE-Core rev: d0e3cc8c9234083a4ad6a0c1befe02b6076b084c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
94d9c374e9 libxml2: Security fix for CVE-2016-4449
Affects limbxml2 < 2.9.4

(From OE-Core rev: 6f6132dc3aeb0d660c9730f6f33e9194a6098226)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
0e8aae7bc8 libxml2: Security fix for CVE-2016-1836
Affects libxml2 < 2.9.4

(From OE-Core rev: 9229873f278f7c24fb01673ec3d9fd404762bc25)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
3e93d609c0 libxml2: Security fix for CVE-2016-1839
Affects libxml2 < 2.9.4

(From OE-Core rev: 689145fc5ae377eab088ee524c447223be29707f)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
970a077b83 libxml2: Security fix for CVE-2016-1838
Affects libxml2 < 2.9.4

(From OE-Core rev: d24b0ac044e02ec34f74e46ad599ac8bdb10432c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
4cdca0571a libxml2: Security fix for CVE-2016-1840
affects libxml2 < 2.9.4

(From OE-Core rev: 9d894179128771c4a2628c103f5c39e2e6ef13c5)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
17480a956d libxml2: Security fix for CVE-2016-4483.patch
affects libxml2 < 2.9.4

(From OE-Core rev: a28fea55f72284d3f4ed85f19f80b8475e726ee6)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
b3c799c831 libxml2: Security fix for CVE-2016-1834.patch
(From OE-Core rev: 233f3b29760c878a3acb3aa0e22b7c252f17e2b3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
f01272c3a5 libxml2: Security fix for CVE-2016-3705
(From OE-Core rev: aa8ad693a977e104797dd623d7efad705e298eb2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
f2688ed200 libxml2: Security fix for CVE-2016-1762
(From OE-Core rev: 8a59dc853d2870bc33ef3cc5af202e33b3d7c6c2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
c9e0efd1f7 glibc: Security fix for CVE-2016-4429
(From OE-Core rev: 32fd9fed93b896ee50006a95cc9d0209b85268cd)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
2596de9179 glibc: Security Fix for CVE-2016-3706
(From OE-Core rev: 0c82ab38064baaf25169d75ddccaa3926b62c7e3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Scott Rifenbark
118380bc5d documentation: Updated date in the manual revision tables.
Added "June 2016" for the date.

(From yocto-docs rev: 9d3327f06f1f798b1ca55b0fc8aeca281e4aca01)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:47 +01:00
Scott Rifenbark
7fde327c85 kernel-dev: Fix the locations of .config and source directory
The locations of the kernel .config file and source direcotry
moved a couple releases ago.  Updated the documentation
accordingly.

Also added a note explaining how to check the expansion of
variables, which servs a couple of purposes:

 * For curious readers, shows them how to understand where
   these variables come from and how they are used.

 * For suspicious readers, shows them how they can verify that
   the variables in the documentation are actually correct.

Author: Tom Zanussi <tom.zanussi@linux.intel.com>
(From yocto-docs rev: af3613b6178122b9e5452529a087143b3fe98495)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:47 +01:00
Scott Rifenbark
3863499572 profile-manual: Added cross-reference links to INHIBIT_PACKAGE_STRIP
I added some reference links to this variable in the ref-manual
glossary.

(From yocto-docs rev: b9ab3953080caf7ebd4b97f3fc2cb5dd1419326b)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:47 +01:00
Scott Rifenbark
c7947af728 ref-manual: Fixed *[doc] string for INHIBIT_PACKAGE_DEBUG_SPLIT
The string was a copy paste error.  It was using the string
for INHIBIT_PACKAGE_STRIP.

(From yocto-docs rev: 9e52affeb8af5e6e667259059224c0f55ed0d090)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:46 +01:00
Scott Rifenbark
a79b7d685b yocto-project-qs: Added note for Fedora23 users
Fedora23 distribution is not supported by the YP 2.0.x release.
I added a note to the required host packages section stating that
if the user is going to use this distribution, they must install
perl-bignum as a required package.

Fixes [YOCTO #9580]

(From yocto-docs rev: ceb707ada99c8f2b4fc096f1c5f0c357522a6984)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:46 +01:00
Scott Rifenbark
4f2dfdcd39 documentation: Prepped for a 2.0.2 release
* poky.ent variables updated for the new release
* <manual>.xml files added the 2.0.2 entry in the manual revision
  table.  Used "TBA 2016" for now.
* mega-manual.sed file updated to replace "2.0.1" with "2.0.2"

(From yocto-docs rev: 0c112723d6982f7ddb6f2908389b5610937ff48f)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:46 +01:00
Elliot Smith
ddbc13155f toasterconf.json: exclude releases Toaster can't build
Due to changes in master to support Python 3, Toaster is no
longer able to build from master.

Remove references to master and set default release to jethro.

The dizzy release should also be removed, as Toaster jethro
is unable to build using this release.

(From OE-Core rev: 1f4bfa33073584c25396d74f3929f263f3df188b)

Signed-off-by: Elliot Smith <elliot.smith@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-03 15:02:25 +01:00
Matt Madison
32728d0946 wic: insert local Python paths at front
This follows how bitbake performs path insertion, and fixes a
failure to start wic on Ubuntu 15.10 with the distribution's
version of python-ply installed.

(From OE-Core rev: b3a3935c69b6e74e19cd0cb69d47350b9ea9c58e)

Signed-off-by: Matt Madison <matt@madison.systems>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-24 13:21:54 +01:00
Richard Purdie
dade0e68c6 build-appliance-image: Update to jethro head revision
(From OE-Core rev: 8979a4546841f47677ba74989aa32f0cb3e2ff12)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
jethro-14.0.2 yocto-2.0.2
2016-05-23 17:35:09 +01:00
Richard Purdie
a325db9bc8 poky.conf: Bump version for 2.0.2 jethro release
(From meta-yocto rev: a9b5cf91fa0ee913381ffec88503e2a40a2e04d4)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23 17:34:56 +01:00
Richard Purdie
c940dd928f build-appliance-image: Update to jethro head revision
(From OE-Core rev: 1ef5883b78f35679c4ff20468826d63a98be1539)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23 17:25:14 +01:00
Saul Wold
65306b0bfc gdb: Backport patch to changes with AVX and MPX
The current MPX target descriptions assume that MPX is always combined
with AVX, however that's not correct.  We can have machines with MPX
and without AVX; or machines with AVX and without MPX.

This patch adds new target descriptions for machines that support
both MPX and AVX, as duplicates of the existing MPX descriptions.

The following commit will remove AVX from the MPX-only descriptions.

This commit is backported from 7.12

(From OE-Core rev: 059d459d48bd42a282005698c4dc4a3ecbd2d88f)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-22 08:42:55 +01:00
Armin Kuster
f117786f24 gcc: Security Fix CVE-2016-4490
(From OE-Core rev: 69b1e25a53255433262178b91ab3e328768ad725)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
6f8a7089b3 gcc: Security fix CVE-2016-2226
(From OE-Core rev: 8fc7db068cf6e2a527e10e8333585a16ce628e22)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
1945133a22 gcc: Security fix CVE-2016-4489
(From OE-Core rev: 7bf396e7bdb3faaf900f99f72446f19df1cffe88)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
e3bf77e381 gcc: Security fix CVE-2016-4488
(From OE-Core rev: 07820907d25970f2c22497415aa6ff95fe43dc40)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Humberto Ibarra
44585dd62a yocto-bsp: Set correct default branches and branches base for i386, qemu and x86_64 archs
Kernel recipes for linux-yocto_4.1 have outdated branches as default, making it
impossible to find the right branch if the user picks the default value.
The branches_base property uses these outdated branches also.

This updates standard/common-pc and standard/common-pc-64 branches to standard/base

The fix was tested using 'yocto-bsp create' with each one of the following archs:

-i386
-x86_64
-qemu (i386 and x86_64)

After the layer was created, it was added to local.conf and the MACHINE was set
accordingly.

'bitbake linux-yocto' ran successfully with each configuration tested.

[YOCTO #9160]

(From meta-yocto rev: 32e3c2d3910c42f12957c874902a01da94a7971a)

Signed-off-by: Humberto Ibarra <humberto.ibarra.lopez@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Humberto Ibarra
a4ee99f27a yocto-bsp: fix default kernel for x86_64 arch
When using x86_64 arch in yocto-bsp the script suggests
4.1 as the default kernel version; however, as soon as the
default is picked the script continues processing with
3.19 kernel.

This changes the default kernel version to 4.1, which is the
right value and matches the script's message.

[Yocto #9353]

(From meta-yocto rev: 932184bef928d83249c4b4e5dcd36c68d4264cd6)

Signed-off-by: Humberto Ibarra <humberto.ibarra.lopez@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Ross Burton
16d64def97 conf/distro/poky.conf: use example.com for connectivity check
Instead of pinging both the Yocto Project download and bugzilla sites, use
https://www.example.com/.  This is a reserved domain name and hosted by IANA, so
is a key part of the Internet and should be available everywhere (whereas for
example google.com is generally blocked by the Great Firewall of China).  Also
using a https: site verifies that any local proxies are configured for HTTPS as
well as HTTP.

In my testing this reduces the time taken for connectivity checks from 3 seconds
to 1 second.

(From meta-yocto rev: b253c6073be44090a19d1743deb58ef566853056)

(From meta-yocto rev: c27b1d6ccac67ff3ed16079fcbe0f9a8644499ed)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Joshua Lock
a31931e290 openssl: prevent ABI break from earlier jethro releases
The backported upgrade to 1.0.2h included an updated GNU LD
version-script which results in an ABI change. In order to try and
respect ABI for existing binaries built against fido this commit
partially reverts the version-script to maintain the existing ABI
and instead only add the new symbols required by 1.0.2h.

Suggested-by: Martin Jansa <martin.jansa@gmail.com>
(From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f)

(From OE-Core rev: 528541845df34843c14be5de62e9f53004d292ac)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Armin Kuster
da75750122 openssh: Security Fix CVE-2016-3115
opehssh <= 7.2

(From OE-Core rev: e0df10f586361a18f2858230a5e94ccf9c3cc2f3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Armin Kuster
ae691815c8 busybox: Security fix CVE-2016-2147
busybox <= 1.24.2

(From OE-Core rev: 0a977091a4a5ee925b44c60bc4b13557696afadb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Armin Kuster
ba15486e27 busybox: Security Fix CVE-2016-2148
busybox <= 1.24.2

(From OE-Core rev: 1d7ad5f32ae39f84626bb71ded75439062dd717c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Armin Kuster
2ef5feeb3d libtiff: Security fix CVE-2015-8664 and 8683
CVE-2015-8665
CVE-2015-8683

(From OE-Core rev: 49008750ece710201701a6f413537c857190798a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Robert Yang
a201edefae openssl: 1.0.2d -> 1.0.2h (mainly for CVEs)
* CVEs:
  - CVE-2016-0705
  - CVE-2016-0798
  - CVE-2016-0797
  - CVE-2016-0799
  - CVE-2016-0702
  - CVE-2016-0703
  - CVE-2016-0704
  - CVE-2016-2105
  - CVE-2016-2106
  - CVE-2016-2109
  - CVE-2016-2176

* The LICENSE's checksum is changed because of date changes (2011 ->
  2016), the contents are the same.

* Remove backport patches
  - 0001-Add-test-for-CVE-2015-3194.patch
  - CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch
  - CVE-2015-3194-1-Add-PSS-parameter-check.patch
  - CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch
  - CVE-2015-3197.patch
  - CVE-2016-0701_1.patch
  - CVE-2016-0701_2.patch
  - CVE-2016-0800.patch
  - CVE-2016-0800_2.patch
  - CVE-2016-0800_3.patch

* Update crypto_use_bigint_in_x86-64_perl.patch

* Add version-script.patch and update block_diginotar.patch (From master branch)

* Update openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch
  (From Armin)

(From OE-Core rev: bca156013af0a98cb18d8156626b9acc8f9883e3)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00