Commit Graph

36880 Commits

Author SHA1 Message Date
Armin Kuster
3b2c540986 libxml2: Security fix for CVE-2016-4448
Affects libxml2 < 2.9.4

(From OE-Core rev: d4343f428c89c6c238cc7cd4c4732448a00003e4)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
ad7cab35ff libxml2: Security fix for CVE-2016-4447
Affects libxml2 < 2.9.4

(From OE-Core rev: b817c98017cb64f902cdae514fb162b3199a0a14)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
4e260c96f4 libxml2: Security fix for CVE-2016-3627
Affects libxml2 < 2.9.4

(From OE-Core rev: ceabe39237a035efda6a74c746848a9fbab30a08)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
1ecd2f56aa libxml2: Security fix for CVE-2016-1833
Affects libxml2 < 2.9.4

(From OE-Core rev: 990b5427fd3bf5c00ac7c5820d5f455378776b62)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
1081306623 libxml2: Security fix for CVE-2016-1835
Affects libxml2 < 2.9.4

(From OE-Core rev: d008b7023cb703a787c8fcac5cd87628b38a9ecd)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
f96cfb009d libxml2: Security fix for CVE-2016-1837
Affects libxml2 < 2.9.4

(From OE-Core rev: d0e3cc8c9234083a4ad6a0c1befe02b6076b084c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
94d9c374e9 libxml2: Security fix for CVE-2016-4449
Affects limbxml2 < 2.9.4

(From OE-Core rev: 6f6132dc3aeb0d660c9730f6f33e9194a6098226)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
0e8aae7bc8 libxml2: Security fix for CVE-2016-1836
Affects libxml2 < 2.9.4

(From OE-Core rev: 9229873f278f7c24fb01673ec3d9fd404762bc25)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:59 +01:00
Armin Kuster
3e93d609c0 libxml2: Security fix for CVE-2016-1839
Affects libxml2 < 2.9.4

(From OE-Core rev: 689145fc5ae377eab088ee524c447223be29707f)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
970a077b83 libxml2: Security fix for CVE-2016-1838
Affects libxml2 < 2.9.4

(From OE-Core rev: d24b0ac044e02ec34f74e46ad599ac8bdb10432c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
4cdca0571a libxml2: Security fix for CVE-2016-1840
affects libxml2 < 2.9.4

(From OE-Core rev: 9d894179128771c4a2628c103f5c39e2e6ef13c5)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
17480a956d libxml2: Security fix for CVE-2016-4483.patch
affects libxml2 < 2.9.4

(From OE-Core rev: a28fea55f72284d3f4ed85f19f80b8475e726ee6)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
b3c799c831 libxml2: Security fix for CVE-2016-1834.patch
(From OE-Core rev: 233f3b29760c878a3acb3aa0e22b7c252f17e2b3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
f01272c3a5 libxml2: Security fix for CVE-2016-3705
(From OE-Core rev: aa8ad693a977e104797dd623d7efad705e298eb2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
f2688ed200 libxml2: Security fix for CVE-2016-1762
(From OE-Core rev: 8a59dc853d2870bc33ef3cc5af202e33b3d7c6c2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
c9e0efd1f7 glibc: Security fix for CVE-2016-4429
(From OE-Core rev: 32fd9fed93b896ee50006a95cc9d0209b85268cd)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Armin Kuster
2596de9179 glibc: Security Fix for CVE-2016-3706
(From OE-Core rev: 0c82ab38064baaf25169d75ddccaa3926b62c7e3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-27 08:29:58 +01:00
Scott Rifenbark
118380bc5d documentation: Updated date in the manual revision tables.
Added "June 2016" for the date.

(From yocto-docs rev: 9d3327f06f1f798b1ca55b0fc8aeca281e4aca01)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:47 +01:00
Scott Rifenbark
7fde327c85 kernel-dev: Fix the locations of .config and source directory
The locations of the kernel .config file and source direcotry
moved a couple releases ago.  Updated the documentation
accordingly.

Also added a note explaining how to check the expansion of
variables, which servs a couple of purposes:

 * For curious readers, shows them how to understand where
   these variables come from and how they are used.

 * For suspicious readers, shows them how they can verify that
   the variables in the documentation are actually correct.

Author: Tom Zanussi <tom.zanussi@linux.intel.com>
(From yocto-docs rev: af3613b6178122b9e5452529a087143b3fe98495)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:47 +01:00
Scott Rifenbark
3863499572 profile-manual: Added cross-reference links to INHIBIT_PACKAGE_STRIP
I added some reference links to this variable in the ref-manual
glossary.

(From yocto-docs rev: b9ab3953080caf7ebd4b97f3fc2cb5dd1419326b)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:47 +01:00
Scott Rifenbark
c7947af728 ref-manual: Fixed *[doc] string for INHIBIT_PACKAGE_DEBUG_SPLIT
The string was a copy paste error.  It was using the string
for INHIBIT_PACKAGE_STRIP.

(From yocto-docs rev: 9e52affeb8af5e6e667259059224c0f55ed0d090)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:46 +01:00
Scott Rifenbark
a79b7d685b yocto-project-qs: Added note for Fedora23 users
Fedora23 distribution is not supported by the YP 2.0.x release.
I added a note to the required host packages section stating that
if the user is going to use this distribution, they must install
perl-bignum as a required package.

Fixes [YOCTO #9580]

(From yocto-docs rev: ceb707ada99c8f2b4fc096f1c5f0c357522a6984)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:46 +01:00
Scott Rifenbark
4f2dfdcd39 documentation: Prepped for a 2.0.2 release
* poky.ent variables updated for the new release
* <manual>.xml files added the 2.0.2 entry in the manual revision
  table.  Used "TBA 2016" for now.
* mega-manual.sed file updated to replace "2.0.1" with "2.0.2"

(From yocto-docs rev: 0c112723d6982f7ddb6f2908389b5610937ff48f)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-21 12:59:46 +01:00
Elliot Smith
ddbc13155f toasterconf.json: exclude releases Toaster can't build
Due to changes in master to support Python 3, Toaster is no
longer able to build from master.

Remove references to master and set default release to jethro.

The dizzy release should also be removed, as Toaster jethro
is unable to build using this release.

(From OE-Core rev: 1f4bfa33073584c25396d74f3929f263f3df188b)

Signed-off-by: Elliot Smith <elliot.smith@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-03 15:02:25 +01:00
Matt Madison
32728d0946 wic: insert local Python paths at front
This follows how bitbake performs path insertion, and fixes a
failure to start wic on Ubuntu 15.10 with the distribution's
version of python-ply installed.

(From OE-Core rev: b3a3935c69b6e74e19cd0cb69d47350b9ea9c58e)

Signed-off-by: Matt Madison <matt@madison.systems>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-24 13:21:54 +01:00
Richard Purdie
dade0e68c6 build-appliance-image: Update to jethro head revision
(From OE-Core rev: 8979a4546841f47677ba74989aa32f0cb3e2ff12)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23 17:35:09 +01:00
Richard Purdie
a325db9bc8 poky.conf: Bump version for 2.0.2 jethro release
(From meta-yocto rev: a9b5cf91fa0ee913381ffec88503e2a40a2e04d4)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23 17:34:56 +01:00
Richard Purdie
c940dd928f build-appliance-image: Update to jethro head revision
(From OE-Core rev: 1ef5883b78f35679c4ff20468826d63a98be1539)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-23 17:25:14 +01:00
Saul Wold
65306b0bfc gdb: Backport patch to changes with AVX and MPX
The current MPX target descriptions assume that MPX is always combined
with AVX, however that's not correct.  We can have machines with MPX
and without AVX; or machines with AVX and without MPX.

This patch adds new target descriptions for machines that support
both MPX and AVX, as duplicates of the existing MPX descriptions.

The following commit will remove AVX from the MPX-only descriptions.

This commit is backported from 7.12

(From OE-Core rev: 059d459d48bd42a282005698c4dc4a3ecbd2d88f)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-22 08:42:55 +01:00
Armin Kuster
f117786f24 gcc: Security Fix CVE-2016-4490
(From OE-Core rev: 69b1e25a53255433262178b91ab3e328768ad725)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
6f8a7089b3 gcc: Security fix CVE-2016-2226
(From OE-Core rev: 8fc7db068cf6e2a527e10e8333585a16ce628e22)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
1945133a22 gcc: Security fix CVE-2016-4489
(From OE-Core rev: 7bf396e7bdb3faaf900f99f72446f19df1cffe88)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Armin Kuster
e3bf77e381 gcc: Security fix CVE-2016-4488
(From OE-Core rev: 07820907d25970f2c22497415aa6ff95fe43dc40)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-17 20:56:25 +01:00
Humberto Ibarra
44585dd62a yocto-bsp: Set correct default branches and branches base for i386, qemu and x86_64 archs
Kernel recipes for linux-yocto_4.1 have outdated branches as default, making it
impossible to find the right branch if the user picks the default value.
The branches_base property uses these outdated branches also.

This updates standard/common-pc and standard/common-pc-64 branches to standard/base

The fix was tested using 'yocto-bsp create' with each one of the following archs:

-i386
-x86_64
-qemu (i386 and x86_64)

After the layer was created, it was added to local.conf and the MACHINE was set
accordingly.

'bitbake linux-yocto' ran successfully with each configuration tested.

[YOCTO #9160]

(From meta-yocto rev: 32e3c2d3910c42f12957c874902a01da94a7971a)

Signed-off-by: Humberto Ibarra <humberto.ibarra.lopez@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Humberto Ibarra
a4ee99f27a yocto-bsp: fix default kernel for x86_64 arch
When using x86_64 arch in yocto-bsp the script suggests
4.1 as the default kernel version; however, as soon as the
default is picked the script continues processing with
3.19 kernel.

This changes the default kernel version to 4.1, which is the
right value and matches the script's message.

[Yocto #9353]

(From meta-yocto rev: 932184bef928d83249c4b4e5dcd36c68d4264cd6)

Signed-off-by: Humberto Ibarra <humberto.ibarra.lopez@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Ross Burton
16d64def97 conf/distro/poky.conf: use example.com for connectivity check
Instead of pinging both the Yocto Project download and bugzilla sites, use
https://www.example.com/.  This is a reserved domain name and hosted by IANA, so
is a key part of the Internet and should be available everywhere (whereas for
example google.com is generally blocked by the Great Firewall of China).  Also
using a https: site verifies that any local proxies are configured for HTTPS as
well as HTTP.

In my testing this reduces the time taken for connectivity checks from 3 seconds
to 1 second.

(From meta-yocto rev: b253c6073be44090a19d1743deb58ef566853056)

(From meta-yocto rev: c27b1d6ccac67ff3ed16079fcbe0f9a8644499ed)

Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Joshua Lock
a31931e290 openssl: prevent ABI break from earlier jethro releases
The backported upgrade to 1.0.2h included an updated GNU LD
version-script which results in an ABI change. In order to try and
respect ABI for existing binaries built against fido this commit
partially reverts the version-script to maintain the existing ABI
and instead only add the new symbols required by 1.0.2h.

Suggested-by: Martin Jansa <martin.jansa@gmail.com>
(From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f)

(From OE-Core rev: 528541845df34843c14be5de62e9f53004d292ac)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Armin Kuster
da75750122 openssh: Security Fix CVE-2016-3115
opehssh <= 7.2

(From OE-Core rev: e0df10f586361a18f2858230a5e94ccf9c3cc2f3)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:17 +01:00
Armin Kuster
ae691815c8 busybox: Security fix CVE-2016-2147
busybox <= 1.24.2

(From OE-Core rev: 0a977091a4a5ee925b44c60bc4b13557696afadb)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Armin Kuster
ba15486e27 busybox: Security Fix CVE-2016-2148
busybox <= 1.24.2

(From OE-Core rev: 1d7ad5f32ae39f84626bb71ded75439062dd717c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Armin Kuster
2ef5feeb3d libtiff: Security fix CVE-2015-8664 and 8683
CVE-2015-8665
CVE-2015-8683

(From OE-Core rev: 49008750ece710201701a6f413537c857190798a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-14 09:40:16 +01:00
Robert Yang
a201edefae openssl: 1.0.2d -> 1.0.2h (mainly for CVEs)
* CVEs:
  - CVE-2016-0705
  - CVE-2016-0798
  - CVE-2016-0797
  - CVE-2016-0799
  - CVE-2016-0702
  - CVE-2016-0703
  - CVE-2016-0704
  - CVE-2016-2105
  - CVE-2016-2106
  - CVE-2016-2109
  - CVE-2016-2176

* The LICENSE's checksum is changed because of date changes (2011 ->
  2016), the contents are the same.

* Remove backport patches
  - 0001-Add-test-for-CVE-2015-3194.patch
  - CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch
  - CVE-2015-3194-1-Add-PSS-parameter-check.patch
  - CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch
  - CVE-2015-3197.patch
  - CVE-2016-0701_1.patch
  - CVE-2016-0701_2.patch
  - CVE-2016-0800.patch
  - CVE-2016-0800_2.patch
  - CVE-2016-0800_3.patch

* Update crypto_use_bigint_in_x86-64_perl.patch

* Add version-script.patch and update block_diginotar.patch (From master branch)

* Update openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch
  (From Armin)

(From OE-Core rev: bca156013af0a98cb18d8156626b9acc8f9883e3)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00
Tom Zanussi
00b016b010 Revert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 for kernel ARCH"
This reverts commit a6f52930a6.

In addition to also causing the problem in [YOCTO #9579], this commit
was reverted in krogoth and master but wasn't reverted in jethro but
should be.  The original revert message was:

This reverts commit 8d310b24927d0f348fb431895f0583733db2aad0.

That commit completely breaks KBUILD_DEFCONFIG because it relies on
$ARCH to match between the target OE arch and the kernel subdirectory
containing the defconfigs. In the kernel all defconfigs for everything
x86-based (including x86_64) is stored in dir arch/x86/configs/

kernel-yocto.bbclass correctly searches for all the defconfigs inside
${S}/arch/${ARCH}/configs/${KBUILD_DEFCONFIG}

Commit 8d310b249 makes it search in wrong places and _only_ if you
define TARGET_ARCH = "athlon" will it search x86 which is nonsensical.

The commit further adds an if clause to hack the mungled kernel arches
back to their original values (ugh) in do_shared_workdir which is run
after do compile, but of course the build breaks before that in
do_kernel_metadata because of the KBUILD_DEFCONFIG mentioned above (so
that hack is useless).

Please fix that corner case bug in another way which does not completely
screw up the kernel arch mapping & defconfig logic. If 64bit configs are
generated in the kernel for 32bit machines because the host is asked,
then it it a bug in the kernel, it is of no use to hack around it in OE.

(From OE-Core rev: bc02a478a5d4a5de7b3943ed809d5c22711f5b1f)

(From OE-Core rev: 88e0032f13f635c868c426e963db4d8a6fc42e9d)

Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00
Martyn Welch
877a6b3ef4 glew: Correct version in autotooling patches
The additional autotooling patched into glew claims the version is 1.9.0
whilst we are building 1.12.0. The version in the autotooling is used to
set the version number in the pkgconfig file, this results in the
configuration of packages which depend on glew > 1.9.0 failing.

This patch updates the version number used in the patches to match that of
the version being built.

(From OE-Core rev: 0ef7c0f30456cc242de331b273b92c1dfe835350)

Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00
André Draszik
ed3fc1ab85 gdb: fix QA warning (uClibc)
WARNING: QA Issue: gdb rdepends on libiconv, but it isn't a build dependency? [build-deps]

We already have virtual/libiconv which is set appropriately
in all environments, so let's use it to fix the issue.

(From OE-Core rev: 9ae38c3b24b387b02541142d40343d1dd0411c88)

Signed-off-by: André Draszik <adraszik@tycoint.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00
Tristan Van Berkom
dafc9d7755 binutils: backport bug fix to the 2.25 branch for jethro
We fail to build webkit on aarch64 due to this binutils bug:

   https://sourceware.org/bugzilla/show_bug.cgi?id=19353

Applying patch which fixes this, stripped out changelog entry
from patch to make it apply without error.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00
Yuanjie Huang
49ce0e7d4a glibc: Fix CVE-2015-8778
CVE: CVE-2015-8778

Improve check against integer wraparound in hcreate_r [BZ #18240]

This is an integer overflow in hcreate and hcreate_r which can result in
an out-of-bound memory access.  This could lead to application crashes
or, potentially, arbitrary code execution.

Upstream-Status: Backport [2.23]
(cherry-picked from commit bae7c7c7, 4bd228c8)

(From OE-Core rev: 71b051f51a44dad1fdca7ca6b3552d0aebdc91d3)

Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-11 12:37:06 +01:00
Robert Yang
6b2102cd59 boot-directdisk.bbclass: remove HDDIMG before create
Fixed when rebuild:
mkdosfs: file /path/to/hdd.image already exists

(From OE-Core rev: 69b49e8dc45cf60defba547d93e663df42c92127)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
(cherry-pick from 9abcd309c098558360cde2bff65be840ead25f83)
Signed-off-by: Tim Kilbourn <tkilbourn@gmail.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-09 14:37:28 +01:00
Stefan Agner
504e742a5e opkg: backport fix for double remove of packges
Backport the fix 7885da3974 ("pkg_get_provider_replacees: do not
add installed pkg to replacee list"). This avoids opkg trying to
remove a package twice e.g. when upgrading.

Suggested-by: Alejandro del Castillo <alejandro.delcastillo@ni.com>
(From OE-Core rev: f26fc34bbe9cf9ae059d4fe646a84501b8924f75)

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-09 14:37:28 +01:00
Sona Sarmadi
6b9d2edd7d bind: CVE-2016-1285 CVE-2016-1286
CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
CVE-2016-1286 bind: malformed signature records for DNAME records can
trigger assertion failure

[YOCTO #9400]

External References:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1285
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1286

References to the Upstream commits and Security Advisories:

CVE-2016-1285: https://kb.isc.org/article/AA-01352
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=e7e15d1302b26a96fa0a5307d6f2cb0d8ad4ea63

CVE-2016-1286: https://kb.isc.org/article/AA-01353
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=456e1eadd2a3a2fb9617e60d4db90ef4ba7c6ba3

https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=patch;
h=499952eb459c9a41d2092f1d98899c131f9103b2

(From OE-Core rev: e8bc043f871e507542955ad28de74f67afa9bc36)

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-09 14:37:28 +01:00