Commit Graph

18 Commits

Author SHA1 Message Date
Alexander Kanavin
b3ac015389 patches: correct whitespace/spelling for Upstream-Status tags
(From OE-Core rev: c613ca14c35a5d1782c79a25b83875cbfa2b952b)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-11-21 11:05:02 +00:00
Scott Murray
897a7d5679 patch: fix CVE-2019-20633
* CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2019-20633

* upstream tracking: https://savannah.gnu.org/bugs/index.php?56683

* Fixes potential for double free after incomplete fix for CVE-2018-6952
  - src/pch.c (another_hunk): Avoid invalid memory access in context format
    diffs.

(From OE-Core rev: be71dd2cc16a4c0d244a76a748f08ca0d9bfeba0)

Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-01-01 23:15:13 +00:00
Ross Burton
d8fad5a810 patch: the CVE-2019-13638 fix also handles CVE-2018-20969
(From OE-Core rev: 10c3af7ad8b7bb369c84c60a717bcd1358861187)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-05 10:37:11 +00:00
Ross Burton
6dd03197a5 patch: add CVE tags to patches
These patches improve CVE fixes but trip up patch status sanity checks, so add
CVE tags to them.

(From OE-Core rev: b30e060639d99849e27e5136c33c52d27e3288dc)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-06 14:58:09 +01:00
Anuj Mittal
f326d31c4e patch: backport fixes
The original fix for CVE-2018-1000156 was incomplete. Backport more
fixes done later for a complete fix.

Also see:
https://savannah.gnu.org/bugs/index.php?53820

(From OE-Core rev: 9ea833b7d1655e042a513ea2225468c84f1c8bfb)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-22 22:48:26 +01:00
Trevor Gamblin
6e5636d56b patch: fix CVE-2019-13638
(From OE-Core rev: b59b1222b3f73f982286222a583de09c661dc781)

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-13 09:37:37 +01:00
Anuj Mittal
df9d8dbe75 patch: fix CVE-2019-13636
(From OE-Core rev: f201b9db5d148cb9fe03b78ca085493a27f7e24c)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-31 23:03:01 +01:00
Hongxu Jia
a11008a90d patch: fix CVE-2018-6952
(From OE-Core rev: 1314a6953aa647706107557faaba8574e307d2bd)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Jackie Huang
16174d9342 patch: fix CVE-2018-1000156
* CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2018-1000156

* upstream tracking: https://savannah.gnu.org/bugs/index.php?53566

* Fix arbitrary command execution in ed-style patches:
  - src/pch.c (do_ed_script): Write ed script to a temporary file instead
    of piping it to ed: this will cause ed to abort on invalid commands
    instead of rejecting them and carrying on.
  - tests/ed-style: New test case.
  - tests/Makefile.am (TESTS): Add test case.

(From OE-Core rev: 6b6ae212837a07aaefd2b675b5b527fbce2a4270)

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Jackie Huang
31714674e4 patch: fix CVE-2018-6951
* CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2018-6951

* upstream tracking: http://savannah.gnu.org/bugs/?53132

* Fix segfault with mangled rename patch
  - src/pch.c (intuit_diff_type): Ensure that two filenames are specified
    for renames and copies (fix the existing check).

(From OE-Core rev: cdf74e1c67698b2d44a7460ff7d365d6da7b7b96)

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-13 16:58:07 +01:00
Richard Purdie
2345af9b48 recipes: Move out stale GPLv2 versions to a seperate layer
These are recipes where the upstream has moved to GPLv3 and these old
versions are the last ones under the GPLv2 license.

There are several reasons for making this move. There is a different
quality of service with these recipes in that they don't get security
fixes and upstream no longer care about them, in fact they're actively
hostile against people using old versions. The recipes tend to need a
different kind of maintenance to work with changes in the wider ecosystem
and there needs to be isolation between changes made in the v3 versions
and those in the v2 versions.

There are probably better ways to handle a "non-GPLv3" system but right
now having these in OE-Core makes them look like a first class citizen
when I believe they have potential for a variety of undesireable issues.

Moving them into a separate layer makes their different needs clearer, it
also makes it clear how many of these there are. Some are probably not
needed (e.g. mc), I also wonder whether some are useful (e.g. gmp)
since most things that use them are GPLv3 only already. Someone could
now more clearly see how to streamline the list of recipes here.

I'm proposing we mmove to this separate layer for 2.3 with its future
maintinership and testing to be determined in 2.4 and beyond.

(From OE-Core rev: 19b7e950346fb1dde6505c45236eba6cd9b33b4b)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-03-07 20:05:31 +00:00
Ross Burton
1c914a844b meta: Fix Upstream-Status statements
Fix a variety of problems such as typos, bad punctuations, or incorrect
Upstream-Status values.

(From OE-Core rev: bd220fe6ce8c3a0805f13a14706d3130ea872604)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-09-12 23:01:53 +01:00
Khem Raj
7283022619 recipes: Fix charset.alias for musl
This is same gnulib fix replicated across needed recipes

Change-Id: I756713407111a726eae98e26c9c1ff64981371c0
(From OE-Core rev: fbe6d2c12aa9f7956bc87efeb68cb64b26b60c7a)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-21 07:20:25 +01:00
Robert Yang
2402fe82b6 patch: 2.7.1 -> 2.7.5
* Removed backport patch patch-CVE-2015-1196.patch
* Add HOMEPAGE

(From OE-Core rev: c35135d5b99e852bc3ae718281c33925630a4cfb)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-08 10:53:24 +01:00
Robert Yang
c35aba339a patch: fix CVE-2015-1196
A directory traversal flaw was reported in patch:

References:
http://www.openwall.com/lists/oss-security/2015/01/18/6
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227
https://bugzilla.redhat.com/show_bug.cgi?id=1182154

[YOCTO #7182]

(From OE-Core rev: 4c389880dc9c6221344f7aed221fe8356e8c2056)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-31 22:23:11 +01:00
Nitin A Kamble
2e4518bf18 recipes: Fix the Upstream-Status format
(From OE-Core rev: d7237140554ad076be12edf915d6d15206c9b8c7)

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-05-11 17:14:26 +01:00
Nitin A Kamble
a5cd66b70a patch: update upstream status for patches
(From OE-Core rev: 66599b6cc6272f25840807b4e1164f4fe5af75ee)

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-05-09 14:09:02 +01:00
Nitin A Kamble
f528a1530e patch_2.5.9: clean up the recipe
Earlier the recipe was using 2.5.4 tar ball and a patch for upgrading to
2.5.9. Replaces these with pointer to 2.5.9 tarball.

Also noted that both 2.5.4 & 2.5.9 are GPLv2 sources.

Updated checksums and license of the recipe

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
2010-12-16 15:53:09 +00:00