Commit Graph

25575 Commits

Author SHA1 Message Date
Armin Kuster
ddb1db9ef7 openssh: Security fix CVE-2016-6210
affects openssh < 7.3

(From OE-Core rev: 7d07de3841c0a736262088c95a938deff194d9e2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
fc1ba0b67f git: Security fix CVE-2016-2315 CVE-2016-2324
git versions < 2.5.5 & 2.7.4

(From OE-Core rev: 64ff6226d0c927c05fc42fd9ca8b31bac129b16d)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
9657825ef3 bind: Security fix CVE-2016-2088
(From OE-Core rev: 91e05c25eb221ff1dc2bde5cfaa0bea88345b1e4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Yi Zhao
9f1dc20619 tiff: Security fix CVE-2016-5323
CVE-2016-5323 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5323
http://bugzilla.maptools.org/show_bug.cgi?id=2559

Patch from:
2f79856097

(From OE-Core rev: 4e2f4484d6e1418c34f65de954809d06df41cc38)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4ad1220e0a7f9ca9096860f4f9ae7017b36e29e4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Yi Zhao
c95d42a7d1 tiff: Security fix CVE-2016-5321
CVE-2016-5321 libtiff: a maliciously crafted TIFF file could cause the
application to crash when using tiffcrop command

External References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5321
http://bugzilla.maptools.org/show_bug.cgi?id=2558

Patch from:
d9783e4a14

(From OE-Core rev: 35a7cb62be554e28f64b7583d46d693ea184491f)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 4a167cfb6ad79bbe2a2ff7f7b43c4a162ca42a4d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Yi Zhao
7d403a2ecd tiff: Security fix CVE-2016-3186
CVE-2016-3186 libtiff: buffer overflow in the readextension function in
gif2tiff.c allows remote attackers to cause a denial of service via a
crafted GIF file

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186
https://bugzilla.redhat.com/show_bug.cgi?id=1319503

Patch from:
https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff

(From OE-Core rev: b4471e7264538b3577808fae5e78f42c0d31e195)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 3d818fc862b1d85252443fefa2222262542a10ae)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Ismo Puustinen
75e6b3b57b libpcre: Fix CVE-2016-3191
Fix workspace overflow for (*ACCEPT) with deeply nested parentheses.

The patch is from libpcre version control at
http://vcs.pcre.org/pcre?view=revision&revision=1631 with the ChangeLog
part removed. Original author is Philip Hazel.

(From OE-Core rev: 249cc163e7a16f307e8b94a7b449cd3e93cc6b15)

Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 386534f968f4da376ba7778b5d436bad4ce8355b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
cb5dd8d314 openssl: Security fix CVE-2016-2178
affects  openssl <=  1.0.2h
CVSS v2 Base Score: 2.1 LOW

(From OE-Core rev: 82fe0e8c98244794531f0e24ceb93953fe68dda5)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 5b3df0c5e8885ea34f66b41fcf209a9960fbbf5e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Armin Kuster
1fedf13e63 openssl: Security fix CVE-2016-2177
Affects openssl <= 1.0.2h
CVSS v2 Base Score: 7.5 HIGH

(From OE-Core rev: 5781eb9a6e6bf8984b090a488d2a326bf9fafcf8)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry picked from commit 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Ross Burton
e1b940b4d1 openssl: add a patch to fix parallel builds
Apply a patch taken from Gentoo to hopefully fix the remaining parallel make
races.

(From OE-Core rev: 7ab2f49107cf491d602880205a3ea1222cb5e616)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3d806d59a4c5e8ff35c7e7c5a3a6ef85e2b4b259)

Minor fixup to get patch to apply to jethro
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 23:22:03 +01:00
Maxin B. John
37eb21b2b1 curl: security fix for CVE-2016-5421
Affected versions: libcurl 7.32.0 to and including 7.50.0

(From OE-Core rev: f6999fa952c7db980cfc97f6e5a971e4f34cc0a3)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:35 +01:00
Maxin B. John
72ea3c272c curl: security fix for CVE-2016-5420
Affected versions: libcurl 7.1 to and including 7.50.0

(From OE-Core rev: 6b732a392289a7bb50b0e3716c066c62fa32a14d)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:35 +01:00
Maxin B. John
0e0c04343d curl: security fix for CVE-2016-5419
Affected versions: libcurl 7.1 to and including 7.50.0

(From OE-Core rev: d1d6c93b491056b18b528216303047e353956e34)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-02 08:48:34 +01:00
Enrico Jorns
4037644690 perl-ptest.inc: fix tar call to prevent objcopy failure
With tar version 1.29, the tar call used to copy the ptest files will
not work anymore. While the call did not match the man page (but worked)
before, anyway, the latest update of tar seems to have a more strict argument
handling.

With the current version of the tar call, the copying of files still
works with latest tar version, but the excludes will not be handled
properly anymore.
This results in having binaries compiled with host GCC in the package.
When doing the strip_and_split files in do_package() with the target
objcopy, bitbake will fail with this error:

  ERROR: objcopy failed with exit code 256 (cmd was [...])
  [...]
  File format not recognized

Thus, the current argument issues and required changes are:

 * Options must be placed _before_ the pathnames.

 * --exclude must be followd by a '=' in order to work properly

 * 'f' options is for providing an archive file, which is unnecessary in
   this case

Note that this could also be a candidate for backporting.

(From OE-Core master rev: 2e498879098f7d84610aed7961d92433083d9a02)

(From OE-Core rev: a27b907dd3ad20fc60b7732c19012793aaaba2df)

Signed-off-by: Enrico Jorns <ejo@pengutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Anuj Mittal
64b9c83b0c gcc: make sure header path is set correctly
We're setting the native header paths in do_configure_prepend,
and don't need to set them again here.

This results in gcc-target not being able to locate the headers
and not being able to detect glibc version, which in turn
results in SSP support not getting detected even though it's available
in libc.

(From OE-Core master rev: 85630aa894278e7818c867179dc19ca2fbd994fc)

(From OE-Core rev: f28840de3912c805acde8d11188f0c48617678ab)

Signed-off-by: Anuj Mittal <anujx.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
96456b15ea tzdata: update to 2016e
Changes affecting future time stamps

Africa/Cairo observes DST in 2016 from July 7 to the end of October.
Guess October 27 and 24:00 transitions. (Thanks to Steffen Thorsen.)
For future years, guess April's last Thursday to October's last
Thursday except for Ramadan.

Changes affecting past time stamps

Locations while uninhabited now use '-00', not 'zzz', as a
placeholder time zone abbreviation.  This is inspired by Internet
RFC 3339 and is more consistent with numeric time zone
abbreviations already used elsewhere.  The change affects several
arctic and antarctic locations, e.g., America/Cambridge_Bay before
1920 and Antarctica/Troll before 2005.

Asia/Baku's 1992-09-27 transition from +04 (DST) to +04 (non-DST) was
at 03:00, not 23:00 the previous day.  (Thanks to Michael Deckers.)

(From OE-Core master rev: ddcf128e76ed0678ce42416531f4ecb309c57439)

(From OE-Core rev: 225f3b4ea4c7c7439bba2b3a85f24ea94d2f47bc)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
d8b15a0384 tzcode: update to 2016e
V2: typo in title (jet lagged)
Changes to code

zic now outputs a dummy transition at time 2**31 - 1 in zones
whose POSIX-style TZ strings contain a '<'.  This mostly works
around Qt bug 53071 <https://bugreports.qt.io/browse/QTBUG-53071>.
(Thanks to Zhanibek Adilbekov for reporting the Qt bug.)

Changes affecting documentation and commentary

tz-link.htm says why governments should give plenty of notice for
time zone or DST changes, and refers to Matt Johnson's blog post.
tz-link.htm mentions Tzdata for Elixir.  (Thanks to Matt Johnson.)

(From OE-Core master rev: 5f3340e5c966f4233e0cd4ec468b20a1fd5a7346)

(From OE-Core rev: 6d9e6b6fb2c8c6c80a5981b0f91987b433b6ea24)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Nicolas Dechesne
a01d3234f6 bluez5: move btmgmt to common READLINE section
Upstream in 5.33 btmgmt was moved from experimental to common READLINE section,
in commit e4f0c5582f1fe3451d5588243adba9de1ed68b80, but this was never updated
in the recipe.

This is a backport from master branch, commit
28777e593d3dd3a5d0ee2effcdca6a971e2887f9.

(From OE-Core rev: cbe0648e234e83b8ffc336118d3ee2967b4bb175)

Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 09:00:53 +01:00
Armin Kuster
3b2c540986 libxml2: Security fix for CVE-2016-4448
Affects libxml2 < 2.9.4

(From OE-Core rev: d4343f428c89c6c238cc7cd4c4732448a00003e4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
ad7cab35ff libxml2: Security fix for CVE-2016-4447
Affects libxml2 < 2.9.4

(From OE-Core rev: b817c98017cb64f902cdae514fb162b3199a0a14)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
4e260c96f4 libxml2: Security fix for CVE-2016-3627
Affects libxml2 < 2.9.4

(From OE-Core rev: ceabe39237a035efda6a74c746848a9fbab30a08)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
1ecd2f56aa libxml2: Security fix for CVE-2016-1833
Affects libxml2 < 2.9.4

(From OE-Core rev: 990b5427fd3bf5c00ac7c5820d5f455378776b62)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
1081306623 libxml2: Security fix for CVE-2016-1835
Affects libxml2 < 2.9.4

(From OE-Core rev: d008b7023cb703a787c8fcac5cd87628b38a9ecd)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
f96cfb009d libxml2: Security fix for CVE-2016-1837
Affects libxml2 < 2.9.4

(From OE-Core rev: d0e3cc8c9234083a4ad6a0c1befe02b6076b084c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
94d9c374e9 libxml2: Security fix for CVE-2016-4449
Affects limbxml2 < 2.9.4

(From OE-Core rev: 6f6132dc3aeb0d660c9730f6f33e9194a6098226)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
0e8aae7bc8 libxml2: Security fix for CVE-2016-1836
Affects libxml2 < 2.9.4

(From OE-Core rev: 9229873f278f7c24fb01673ec3d9fd404762bc25)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
3e93d609c0 libxml2: Security fix for CVE-2016-1839
Affects libxml2 < 2.9.4

(From OE-Core rev: 689145fc5ae377eab088ee524c447223be29707f)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
970a077b83 libxml2: Security fix for CVE-2016-1838
Affects libxml2 < 2.9.4

(From OE-Core rev: d24b0ac044e02ec34f74e46ad599ac8bdb10432c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
4cdca0571a libxml2: Security fix for CVE-2016-1840
affects libxml2 < 2.9.4

(From OE-Core rev: 9d894179128771c4a2628c103f5c39e2e6ef13c5)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
17480a956d libxml2: Security fix for CVE-2016-4483.patch
affects libxml2 < 2.9.4

(From OE-Core rev: a28fea55f72284d3f4ed85f19f80b8475e726ee6)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
b3c799c831 libxml2: Security fix for CVE-2016-1834.patch
(From OE-Core rev: 233f3b29760c878a3acb3aa0e22b7c252f17e2b3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
f01272c3a5 libxml2: Security fix for CVE-2016-3705
(From OE-Core rev: aa8ad693a977e104797dd623d7efad705e298eb2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
f2688ed200 libxml2: Security fix for CVE-2016-1762
(From OE-Core rev: 8a59dc853d2870bc33ef3cc5af202e33b3d7c6c2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
c9e0efd1f7 glibc: Security fix for CVE-2016-4429
(From OE-Core rev: 32fd9fed93b896ee50006a95cc9d0209b85268cd)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
2596de9179 glibc: Security Fix for CVE-2016-3706
(From OE-Core rev: 0c82ab38064baaf25169d75ddccaa3926b62c7e3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Elliot Smith
ddbc13155f toasterconf.json: exclude releases Toaster can't build
Due to changes in master to support Python 3, Toaster is no
longer able to build from master.

Remove references to master and set default release to jethro.

The dizzy release should also be removed, as Toaster jethro
is unable to build using this release.

(From OE-Core rev: 1f4bfa33073584c25396d74f3929f263f3df188b)

Signed-off-by: Elliot Smith <elliot.smith@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-03 15:02:25 +01:00
Richard Purdie
dade0e68c6 build-appliance-image: Update to jethro head revision
(From OE-Core rev: 8979a4546841f47677ba74989aa32f0cb3e2ff12)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23 17:35:09 +01:00
Richard Purdie
c940dd928f build-appliance-image: Update to jethro head revision
(From OE-Core rev: 1ef5883b78f35679c4ff20468826d63a98be1539)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23 17:25:14 +01:00
Saul Wold
65306b0bfc gdb: Backport patch to changes with AVX and MPX
The current MPX target descriptions assume that MPX is always combined
with AVX, however that's not correct.  We can have machines with MPX
and without AVX; or machines with AVX and without MPX.

This patch adds new target descriptions for machines that support
both MPX and AVX, as duplicates of the existing MPX descriptions.

The following commit will remove AVX from the MPX-only descriptions.

This commit is backported from 7.12

(From OE-Core rev: 059d459d48bd42a282005698c4dc4a3ecbd2d88f)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-22 08:42:55 +01:00
Armin Kuster
f117786f24 gcc: Security Fix CVE-2016-4490
(From OE-Core rev: 69b1e25a53255433262178b91ab3e328768ad725)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
6f8a7089b3 gcc: Security fix CVE-2016-2226
(From OE-Core rev: 8fc7db068cf6e2a527e10e8333585a16ce628e22)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
1945133a22 gcc: Security fix CVE-2016-4489
(From OE-Core rev: 7bf396e7bdb3faaf900f99f72446f19df1cffe88)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
e3bf77e381 gcc: Security fix CVE-2016-4488
(From OE-Core rev: 07820907d25970f2c22497415aa6ff95fe43dc40)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Joshua Lock
a31931e290 openssl: prevent ABI break from earlier jethro releases
The backported upgrade to 1.0.2h included an updated GNU LD
version-script which results in an ABI change. In order to try and
respect ABI for existing binaries built against fido this commit
partially reverts the version-script to maintain the existing ABI
and instead only add the new symbols required by 1.0.2h.

Suggested-by: Martin Jansa <martin.jansa@gmail.com>
(From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f)

(From OE-Core rev: 528541845df34843c14be5de62e9f53004d292ac)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Armin Kuster
da75750122 openssh: Security Fix CVE-2016-3115
opehssh <= 7.2

(From OE-Core rev: e0df10f586361a18f2858230a5e94ccf9c3cc2f3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Armin Kuster
ae691815c8 busybox: Security fix CVE-2016-2147
busybox <= 1.24.2

(From OE-Core rev: 0a977091a4a5ee925b44c60bc4b13557696afadb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Armin Kuster
ba15486e27 busybox: Security Fix CVE-2016-2148
busybox <= 1.24.2

(From OE-Core rev: 1d7ad5f32ae39f84626bb71ded75439062dd717c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Armin Kuster
2ef5feeb3d libtiff: Security fix CVE-2015-8664 and 8683
CVE-2015-8665
CVE-2015-8683

(From OE-Core rev: 49008750ece710201701a6f413537c857190798a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Robert Yang
a201edefae openssl: 1.0.2d -> 1.0.2h (mainly for CVEs)
* CVEs:
  - CVE-2016-0705
  - CVE-2016-0798
  - CVE-2016-0797
  - CVE-2016-0799
  - CVE-2016-0702
  - CVE-2016-0703
  - CVE-2016-0704
  - CVE-2016-2105
  - CVE-2016-2106
  - CVE-2016-2109
  - CVE-2016-2176

* The LICENSE's checksum is changed because of date changes (2011 ->
  2016), the contents are the same.

* Remove backport patches
  - 0001-Add-test-for-CVE-2015-3194.patch
  - CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch
  - CVE-2015-3194-1-Add-PSS-parameter-check.patch
  - CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch
  - CVE-2015-3197.patch
  - CVE-2016-0701_1.patch
  - CVE-2016-0701_2.patch
  - CVE-2016-0800.patch
  - CVE-2016-0800_2.patch
  - CVE-2016-0800_3.patch

* Update crypto_use_bigint_in_x86-64_perl.patch

* Add version-script.patch and update block_diginotar.patch (From master branch)

* Update openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch
  (From Armin)

(From OE-Core rev: bca156013af0a98cb18d8156626b9acc8f9883e3)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00
Tom Zanussi
00b016b010 Revert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kernel ARCH"
This reverts commit a6f52930a6.

In addition to also causing the problem in [YOCTO #9579], this commit
was reverted in krogoth and master but wasn't reverted in jethro but
should be.  The original revert message was:

This reverts commit 8d310b24927d0f348fb431895f0583733db2aad0.

That commit completely breaks KBUILD_DEFCONFIG because it relies on
$ARCH to match between the target OE arch and the kernel subdirectory
containing the defconfigs. In the kernel all defconfigs for everything
x86-based (including x86_64) is stored in dir arch/x86/configs/

kernel-yocto.bbclass correctly searches for all the defconfigs inside
${S}/arch/${ARCH}/configs/${KBUILD_DEFCONFIG}

Commit 8d310b249 makes it search in wrong places and _only_ if you
define TARGET_ARCH = "athlon" will it search x86 which is nonsensical.

The commit further adds an if clause to hack the mungled kernel arches
back to their original values (ugh) in do_shared_workdir which is run
after do compile, but of course the build breaks before that in
do_kernel_metadata because of the KBUILD_DEFCONFIG mentioned above (so
that hack is useless).

Please fix that corner case bug in another way which does not completely
screw up the kernel arch mapping & defconfig logic. If 64bit configs are
generated in the kernel for 32bit machines because the host is asked,
then it it a bug in the kernel, it is of no use to hack around it in OE.

(From OE-Core rev: bc02a478a5d4a5de7b3943ed809d5c22711f5b1f)

(From OE-Core rev: 88e0032f13f635c868c426e963db4d8a6fc42e9d)

Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00