Commit Graph

40064 Commits

Author SHA1 Message Date
Saul Wold
8f5becc3ab archiver: fix gcc-source handling
The source archiver was not handling the gcc-source target correctly, since it uses the
work-shared directory, we don't want to unpack and patch it twice, just as the comments
say, but the code was not there to check for the gcc-source target.

[YOCTO #10265]

(From OE-Core rev: bbac0699ceadb7a25a60643fb23dffce8b4d23d0)

(From OE-Core rev: 7c83d20fe48064df2200f4aa9e7c7d772b69f574)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-08 23:47:12 +00:00
Pascal Bach
732dd581f3 glibc: fix CVE-2016-1234, CVE-2016-3075, CVE-2016-5417
Only relevant for krogoth since version 2.24+ (master, morty) is not affected.

(From OE-Core rev: 88be4b40bacc7c8a08fb76fc220f491deb2c1c3a)

Signed-off-by: Pascal Bach <pascal.bach@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-11-08 23:47:12 +00:00
Scott Rifenbark
40f4a6d075 bsp-guide: Updated the yocto-bsp create selections in the example.
(From yocto-docs rev: 3008f226da2466e3ecaf8bdbc458b4df58d1a618)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-13 23:16:56 +01:00
Scott Rifenbark
88b7f1a1e2 yocto-project-qs: Fixed Minnow MAX build example
Fixes [YOCTO #9667]

The actual command in the example to build the image for
Minnow MAX should be for 'core-image-base'.  I changed it to
be that.

(From yocto-docs rev: ea8c9eaa069a44807800a7143f2a4be40707cc74)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-13 23:16:56 +01:00
Scott Rifenbark
8e2ab57852 yocto-project-qs: Altered MinnowBoard MAX example
Fixes [YOCTO #9667]

The example that built the image out for the MinnowBoard MAX was
buiding a core-image-minimal.  This was not ideal.  I have fixed
it so that several types of images are suggested as examples with
a reference to the Images chapter in the ref-manual.  The actual
command now builds out core-image-base.

(From yocto-docs rev: feb4c1ae79fa15ef03dfba3c629f8da8bbd58e24)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-13 23:16:56 +01:00
Scott Rifenbark
204b2bae4a bsp-guide: Fixed the yocto-bsp create example output
Fixes [YOCTO #10385]

The output for the yocto-bsp create example uses 4.1 as the
default kernel when it should be 4.4.  I updated the exmaple
output to reflect reality for the Krogoth release.

(From yocto-docs rev: 9c2eea8693e439accdee6091484072aa54a5d02e)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-11 08:51:13 +01:00
Christophe Chapuis
e93596fe74 binutils: fix AR issue when opkg is unpacking IPKs containing empty entries
* this patch is backported from 2.26.1 which is already in oe-core/master
  since this patch:
  commit 37e8b6ecf9f9163d7b5b3becdc2feba57df4838f
  Author: Khem Raj <raj.khem@gmail.com>
  Date:   Thu Jul 7 11:08:29 2016 -0700
  Subject: binutils: Upgrade to 2.26.1

  -SRCREV = "71fa566a9cf2597b60a58c1d7c148bab637454a6"
  +SRCREV = "c29838e7f484e0b5714b02e7feb9a88d3a045dd2"

* verified that the patch exists in this SRCREV range:
  ~/projects/binutils $ git log --oneline 71fa566a9cf2597b60a58c1d7c148bab637454a6..c29838e7f484e0b5714b02e7feb9a88d3a045dd2^C
  ...
  343a405 Allow zero length archive elements
  ...
  so it isn't needed in master branch

(From OE-Core rev: a8f44dff13481feaa97e494a3aeafb5b63d40f3f)

Signed-off-by: Christophe Chapuis <chris.chapuis@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 14:09:42 +01:00
Armin Kuster
56a27c9aad python3: Security fix CVE-2016-1000110
(From OE-Core rev: 744eb37c8abf4c30a0c462580541bf195a987a56)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:30 +01:00
Armin Kuster
4b27738c5e python: Security fix CVE-2016-1000110
(From OE-Core rev: d3f0d6834416b3ee0e09f7b6a3ae09839fc16376)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:30 +01:00
Mingli Yu
529bbe2cc2 perl: fix CVE-2016-1238
Backport patch to fix CVE-2016-1238 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab

(From OE-Core rev: 7d06ffcbcd0c71dc6dc9efde02bf0cd8d7c7d7e3)

(From OE-Core rev: 3f22b7ee01b4ce8592401db59c7ca4a7f3f88ede)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:30 +01:00
Joshua Lock
82641d700d multilib_header: avoid sstate checksum issues for -nativesdk recipes
Much as with -native recipes, as addressed in commit
b15730caf0, arch specific variables
like MIPSPKGSFX_ABI were affecting -nativesdk sstate checksums for
recipes like nativesdk-glibc-initial.

Disable multilib_header for nativesdk as we don't use multilibs in
this scenario.

[YOCTO #10320]

(From OE-Core rev: f1c7b4f16dc9a7e5155108641fed8b3d98c931f3)

(From OE-Core rev: 8faaa040d205ac07417255d3c4a452b43e47c956)

Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:30 +01:00
Armin Kuster
118f7a2247 tzdata: update to 2016g
LICENSE md5sum changed do to rewording some text not released to the license.
see 8c143a2b65

  Changes to future time stamps

    Turkey switched from EET/EEST (+02/+03) to permanent +03,
    effective 2016-09-07.  (Thanks to Burak AYDIN.)  Use "+03" rather
    than an invented abbreviation for the new time.

    New leap second 2016-12-31 23:59:60 UTC as per IERS Bulletin C 52.
    (Thanks to Tim Parenti.)

  Changes to past time stamps

    For America/Los_Angeles, spring-forward transition times have been
    corrected from 02:00 to 02:01 in 1948, and from 02:00 to 01:00 in
    1950-1966.

    For zones using Soviet time on 1919-07-01, transitions to UT-based
    time were at 00:00 UT, not at 02:00 local time.  The affected
    zones are Europe/Kirov, Europe/Moscow, Europe/Samara, and
    Europe/Ulyanovsk.  (Thanks to Alexander Belopolsky.)

  Changes to past and future time zone abbreviations

    The Factory zone now uses the time zone abbreviation -00 instead
    of a long English-language string, as -00 is now the normal way to
    represent an undefined time zone.

    Several zones in Antarctica and the former Soviet Union, along
    with zones intended for ships at sea that cannot use POSIX TZ
    strings, now use numeric time zone abbreviations instead of
    invented or obsolete alphanumeric abbreviations.  The affected
    zones are Antarctica/Casey, Antarctica/Davis,
    Antarctica/DumontDUrville, Antarctica/Mawson, Antarctica/Rothera,
    Antarctica/Syowa, Antarctica/Troll, Antarctica/Vostok,
    Asia/Anadyr, Asia/Ashgabat, Asia/Baku, Asia/Bishkek, Asia/Chita,
    Asia/Dushanbe, Asia/Irkutsk, Asia/Kamchatka, Asia/Khandyga,
    Asia/Krasnoyarsk, Asia/Magadan, Asia/Omsk, Asia/Sakhalin,
    Asia/Samarkand, Asia/Srednekolymsk, Asia/Tashkent, Asia/Tbilisi,
    Asia/Ust-Nera, Asia/Vladivostok, Asia/Yakutsk, Asia/Yekaterinburg,
    Asia/Yerevan, Etc/GMT-14, Etc/GMT-13, Etc/GMT-12, Etc/GMT-11,
    Etc/GMT-10, Etc/GMT-9, Etc/GMT-8, Etc/GMT-7, Etc/GMT-6, Etc/GMT-5,
    Etc/GMT-4, Etc/GMT-3, Etc/GMT-2, Etc/GMT-1, Etc/GMT+1, Etc/GMT+2,
    Etc/GMT+3, Etc/GMT+4, Etc/GMT+5, Etc/GMT+6, Etc/GMT+7, Etc/GMT+8,
    Etc/GMT+9, Etc/GMT+10, Etc/GMT+11, Etc/GMT+12, Europe/Kaliningrad,
    Europe/Minsk, Europe/Samara, Europe/Volgograd, and
    Indian/Kerguelen.  For Europe/Moscow the invented abbreviation MSM
    was replaced by +05, whereas MSK and MSD were kept as they are not
    our invention and are widely used.

  Changes to zone names

    Rename Asia/Rangoon to Asia/Yangon, with a backward compatibility link.
    (Thanks to David Massoud.)

(From OE-Core rev: d1341aeda6d9fa5d7f13afabadae60a6fc295b87)

(From OE-Core rev: 73d5a84c3eaa32ee9c066bc80847f57d3724293c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:29 +01:00
Armin Kuster
5b24e5b39b tzcode-native: Update to 2016g
LICENSE file checksum changed do to a verbage change.

  Changes to code

    zic no longer generates binary files containing POSIX TZ-like
    strings that disagree with the local time type after the last
    explicit transition in the data.  This fixes a bug with
    Africa/Casablanca and Africa/El_Aaiun in some year-2037 time
    stamps on the reference platform.  (Thanks to Alexander Belopolsky
    for reporting the bug and suggesting a way forward.)

    If the installed localtime and/or posixrules files are symbolic
    links, zic now keeps them symbolic links when updating them, for
    compatibility with platforms like OpenSUSE where other programs
    configure these files as symlinks.

    zic now avoids hard linking to symbolic links, avoids some
    unnecessary mkdir and stat system calls, and uses shorter file
    names internally.

    zdump has a new -i option to generate transitions in a
    more-compact but still human-readable format.  This option is
    experimental, and the output format may change in future versions.
    (Thanks to Jon Skeet for suggesting that an option was needed,
    and thanks to Tim Parenti and Chris Rovick for further comments.)

  Changes to build procedure

    An experimental distribution format is available, in addition
    to the traditional format which will continue to be distributed.
    The new format is a tarball tzdb-VERSION.tar.lz with signature
    file tzdb-VERSION.tar.lz.asc.  It unpacks to a top-level directory
    tzdb-VERSION containing the code and data of the traditional
    two-tarball format, along with extra data that may be useful.
    (Thanks to Antonio Diaz Diaz, Oscar van Vlijmen, and many others
    for comments about the experimental format.)

    The release version number is now more accurate in the usual case
    where releases are built from a Git repository.  For example, if
    23 commits and some working-file changes have been made since
    release 2016g, the version number is now something like
    '2016g-23-g50556e3-dirty' instead of the misleading '2016g'.
    Official releases uses the same version number format as before,
    e.g., '2016g'.  To support the more-accurate version number, its
    specification has moved from a line in the Makefile to a new
    source file 'version'.

    The experimental distribution contains a file to2050.tzs that
    contains what should be the output of 'zdump -i -c 2050' on
    primary zones.  If this file is available, 'make check' now checks
    that zdump generates this output.

    'make check_web' now works on Fedora-like distributions.

  Changes to documentation and commentary

    tzfile.5 now documents the new restriction on POSIX TZ-like
    strings that is now implemented by zic.

    Comments now cite URLs for some 1917-1921 Russian DST decrees.
    (Thanks to Alexander Belopolsky.)

    tz-link.htm mentions JuliaTime (thanks to Curtis Vogt) and Time4J
    (thanks to Meno Hochschild) and ThreeTen-Extra, and its
    description of Java 8 has been brought up to date (thanks to
    Stephen Colebourne).  Its description of local time on Mars has
    been updated to match current practice, and URLs have been updated
    and some obsolete ones removed.

(From OE-Core rev: 19c365b23c3b835dcb5595aba598f35bf16a6d81)

(From OE-Core rev: e125775a1acdcb183d470d4d4e1c360c918e8d0a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:29 +01:00
Davis, Michael
a78dddb624 pulseaudio: Disable unit tests
Pulseaudio unit tests create a dependency on check not in the recipe.
Since unit tests are not used they are disabled to eliminate build race condition.

Backported from master commit 92cfdb2ba7e04e2b70986c6569f500dd2a48b5d1

(From OE-Core rev: 3bb87439e8458cff898a4e120dd65a9e32d7197b)

Signed-off-by: Michael Davis <michael.davis@essvote.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-06 08:51:29 +01:00
Richard Purdie
3b3cdfd71a pigz: Update SRC_URI
Upstream have released a new tarball and removed the old one. Revert to
the Yocto Project source mirror instead, preserving the upstream version
check.

(From OE-Core rev: da3f47842a511c4622e4e66075e386e7d623a855)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-10-05 10:41:34 +01:00
Richard Purdie
ed4ed5313b useradd: Fix infinite build loop
http://git.openembedded.org/openembedded-core-contrib/commit/?id=642c6cf0b6a0371de476513162bd0cefa9c438b3
introduces a problem if the USERADD_PARAM variable has trailing
whitespace as the code infinitely loops causing build hangs.

Add a similar sed expression to $remaining to avoid this.

(From OE-Core rev: d6241e4c94a0a72acfc57e96a59918c0b2146d65)

(From OE-Core rev: 0900fed3fb6eec62e9e25f6d03af934f9776d105)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-29 11:00:51 +01:00
Maxin B. John
de056577ce libarchive: respect disable-acl configuration option
Update configure.ac to properly handle --disable-acl option

[YOCTO #9668]

(From OE-Core rev: 84fe3f29f2bdaf98c9beefdfede143084fba093b)

(From OE-Core rev: 687d3b8d54aa3190bbbbc94ae2f91303fccf7c8d)

Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Denys Dmytriyenko <denys@ti.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 22:18:51 +01:00
Khem Raj
2ea93e2b1d useradd.bbclass: Strip trailing ';' in cmd params
When there are more than 1 packages in a recipe requiring useradd
services, they are concatnated and a ';' is inserted just after
each of the users being added by the packages. A situation arises
in cases where this is controlled by PACKAGECONFIG then we add a
';' separator in the USERADD_PARAM value itself for each packagecofig
since we do not know which one will be picked, we end up in situation
where the final string returned from get_all_cmd_params() appears to be

a; ; b; c;

and then the logic which uses these cmds triggers with ';' as separator
but in this case it will fail after executing useradd 'a' because the next
cmd it will call will be just a whitespace

This is highlighted by the systemd patch to add more users as needed
by systemd 229 components.

(From OE-Core rev: e8d4356c38e3c2aacd6dc49231c73bcb7d597308)

(From OE-Core rev: 4f69a4be79e17ef009351c447694e46b5cb517c2)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
2b330e5439 openssl: Security fix CVE-2016-6306
affects openssl < 1.0.1i

(From OE-Core rev: 378e58a93127cbf7c330aa1ae4df9a96681bc410)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
e08094e604 openssl: Security fix CVE-2016-6304
affects openssl < 1.0.1i

(From OE-Core rev: ae1db7aea891978e42e5205d2ffc93c16703134c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
5f97311702 openssl: Security fix CVE-2016-6303
affects openssl < 1.0.1i

(From OE-Core rev: bb812836c2c8d89da54d905b65487a9f1acd5f3c)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
7026b2b05a openssl: Security fix CVE-2016-6302
affects openssl < 1.0.1i

(From OE-Core rev: 6d26328bd1d950ddc5ca1cda47da4b8f3d432a1e)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
8e5e92193a openssl: Security fix CVE-2016-2182
affects openssl < 1.0.1i

(From OE-Core rev: 4be4162d5a03af6a20adc2314575e4d0baa5337a)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Martin Jansa
06ed5c5a10 useradd: use bindir_native for pseudo PATH
* useradd/userdel functions will fail for recipes which override their target prefix
  (e.g. to /opt/foo), because it will try to use pseudo from native-sysroot/opt/foo/bin/pseudo

(From OE-Core rev: 96189e71a86c0f4833e8e51d678208fd908bfe30)

(From OE-Core rev: fe20ce64de7a3d8bcd21bb1fc2cfd65563b82767)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
9fa0bc4500 openssl: Security fix CVE-2016-2181
affects openssl < 1.0.1i

(From OE-Core rev: 401f3ccd509d012c4b048eb9fcb5d0f4ab5cc7d2)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
82017f2367 openssl: Security fix CVE-2016-2180
affects openssl < 1.0.1i

(From OE-Core rev: 94b44f40fb52f642eeab1211bd5fc57ceba29f7e)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
e1e5b18a5e openssl: Security fix CVE-2016-2179
affects openssl < 1.0.1i

(From OE-Core rev: 8eb58cf801a26ec17dfc67bae2881f0fc03ea49b)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Armin Kuster
9995a7a144 openssl: Security fix CVE-2016-2178
affects openssl < 1.0.2i

(From OE-Core rev: 2752dba61da730ccd914b7720490754a476d1024)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:57 +01:00
Dengke Du
9fd6b093a4 cracklib: Apply patch to fix CVE-2016-6318
Fix CVE-2016-6318

Backport from cracklib upstream:

47e5dec521

(From OE-Core rev: bc7691c47f21a7d7549788fe0370c3080fc4dff5)

(From OE-Core rev: 64757265e0122314036e80aa1440c29654c052c0)

Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:56 +01:00
Zhixiong Chi
b7bb83a4bb wpa_supplicant: Security Advisory-CVE-2016-4477
Add CVE-2016-4477 patch for avoiding \n and \r characters in passphrase
parameters, which allows remote attackers to cause a denial of service
(daemon outage) via a crafted WPS operation.
Patches came from http://w1.fi/security/2016-1/

(From OE-Core rev: d4d4ed5f31c687b2b2b716ff0fb8ca6c7aa29853)

(From OE-Core rev: 9db41b45beae7224ba928f9267046f1b6a8288a0)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:56 +01:00
Zhixiong Chi
45bc60015c wpa_supplicant: Security Advisory-CVE-2016-4476
Add CVE-2016-4476 patch for avoiding \n and \r characters in passphrase
parameters, which allows remote attackers to cause a denial of service
(daemon outage) via a crafted WPS operation.
Patches came from http://w1.fi/security/2016-1/

(From OE-Core rev: ed610b68f7e19644c89d7131e34c990a02403c62)

(From OE-Core rev: 6ef620c717c43a29f51ccd298c84070552bdfe52)

Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-27 09:05:56 +01:00
Richard Purdie
e6c1d03d3d oeqa/buildiptables: Switch from netfilter.org to yoctoproject.org mirror
We've had some upstream mirror instability so use our own mirror for the
iptables sources to ensure this doesn't affect the test results.

(From OE-Core rev: 25f6af8895d5f5c6dcedde0a21285d63522769c8)

(From OE-Core rev: c3110b9a360571f308123b23f7c99500362b4987)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-24 09:27:51 +01:00
Alejandro Hernandez
d2ca721d31 python3: Fixes several python3 dependency problems
This patch adds the packages python3-signal, python3-enum and python3-selectors,
while it also fixes python3-subprocess which in turn fix the installation of
python3-modules

[YOCTO #10276]

(From OE-Core rev: 8c0f2775bcc25f460d7a0b38031690fa10a0f11d)

Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:39:36 +01:00
Scott Rifenbark
260ff60f93 documentation: Changes to support a 2.1.2 krogoth release.
Updated the poky.ent file to have the 2.1.2 variables.

Updated the manual revision tables to use 2.1.2 and October (a guess)

Updated the mega-manual.sed file so mega-manual links would resolve

(From yocto-docs rev: edf0777e7aa1fc2b41691791284c29d75dc94357)

Signed-off-by: Scott Rifenbark <srifenbark@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:25 +01:00
Jussi Kukkonen
71291ed53e tiff: Update download URL
remotesensing.org domain has been taken over by someone unrelated.
There does not seem to be an up-to-date tiff homepage, but
osgeo.org is a reliable download site.

(From OE-Core rev: f544e1d10e9dc0f750efdb45a78ce9d5c9603070)

(From OE-Core rev: ee2b4b537233172cfc62779bc2397eac598d87e6)

Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Mingli Yu
5b3af2abd7 perl: fix CVE-2015-8607
Backport patch to fix CVE-2015-8607 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/0b6f93036de171c12ba95d415e264d9cf7f4e1fd

(From OE-Core rev: e2289647ace9ef96e6a7e4aae201fd9149e56678)

(From OE-Core rev: 7978432bb5bcf11e3baa78cd1a9051f472338a00)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Mingli Yu
70c4134e4b perl: fix CVE-2016-6185
Backport patch to fix CVE-2016-6185 from perl upstream:
http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7

(From OE-Core rev: 81e550d0c23c9842b85207cdfa73bbe9102e01fb)

(From OE-Core rev: 05202a9328c92e006ff8c349cef9c059e74ac10b)

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
He Zhe
90dd677528 perl: Correct perl path for ptest
Substitute /usr/local with ${bindir}

(From OE-Core rev: bc372d65bc395290e1b7132908a3b943e1b73144)

(From OE-Core rev: 74ded01feab9d0ba2b837e015d40d15a78fec544)

Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Ioan-Adrian Ratiu
6db9299d9e perl-native: backport libnm link fix
pre-5.25.0 perl by default tries to link to an antiquated libnm (new
math) which is not used anymore since the early 1990's. After 2014
another libnm appeared for NetworkManager causing build failures.

(From OE-Core rev: 97d2ba227044571408151f84cfe611e1a72dd816)

(From OE-Core rev: 60e0374240c2121485dc91892a693cd6ac2eae24)

Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Kai Kang
2561b58ac8 perl: fix CVE-2016-2381
Backport patch to fix CVE-2016-2381 from perl upstream:

http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076

(From OE-Core rev: 07ca8a0131f43e9cc2f720e1cdbcb7ba7c074886)

(From OE-Core rev: 9f90044241cfe7910e707d97c966ee7d88883c26)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Bill Randle
9e14b83fa4 perl: fix several perl test failures
Several ExtUtils-MakeMaker tests fail when cross-compiled and run on
the target machine. Backport an upstream patch to fix the issues. Also
update the customized.dat hash file for the files modified by this patch
and other existing patches so the porting/customized.t test passes.

[YOCTO #8656]

(From OE-Core rev: bf1160a62d758b0148856482cb7b3f6fed63a0c2)

(From OE-Core rev: f8548ffd9e2b57ba2eb91ed9372ed4b45fe946db)

Signed-off-by: Bill Randle <william.c.randle@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Bill Randle
a8ac03fce1 perl: some perl tests require libssp
Add libssp to the list of dependencies when building with perl-ptest
as some tests require it.

[YOCTO #8656]

(From OE-Core rev: 9ea1d6474c5cd3546d1cad7c0f02a1ee8b3c76bb)

(From OE-Core rev: e0f6cba32a1682ac48196ae5ecad26275b9ce72b)

Signed-off-by: Bill Randle <william.c.randle@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Bill Randle
8b9b998258 perl: set proper perl subversion number in config files
During the upgrade from Perl 5.22.0 to 5.22.1 in commit
f4c9908eae1ae3dcc38877abe2d5fbeb46851dd4 the config.sh file was hand edited
to change the subversion numbers. However, the edit was not entirely
correct. As a result the Perl version test failed. Set the correct
version strings.

[YOCTO #8656]

(From OE-Core rev: 6e06fec1ca71979e361d8a6e35ef4ec442e71881)

(From OE-Core rev: 3f828924d2e4c2ac8423e40a693c4bca19b514f7)

Signed-off-by: Bill Randle <william.c.randle@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Armin Kuster
76aa0c3d5d qemu: Secuirty fix for CVE-2016-5403
affects qemu < 2.7.0-rc0

(From OE-Core rev: c53820180cdccd97de1f314078570fac1ff16052)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Armin Kuster
11c8c8aa15 qemu: Security fix for CVE-2016-4002
affects qemu < 2.6.0

(From OE-Core rev: 4c6493e90c7102a5bfa8aba4c00b112d083e91b8)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Armin Kuster
5a8a6a753f qemu: Security fix CVE-2016-6351
affects qemu < 2.6.0

(From OE-Core rev: 72ee7cac11523a56b99282c03199b5b84326edf5)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Armin Kuster
aa4b7b2257 qemu: Security fix CVE-2016-4439
affects qemu < 2.6.0

(From OE-Core rev: b5c787631cd35fa5b3f10391c883ae7a3717690f)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Armin Kuster
ea62893915 qemu: Security Fix CVE-2016-3712
affects qemu < 2.6.0

(From OE-Core rev: ed78691a46a3c928297ae166e92fabdffa9e53c9)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Armin Kuster
990b8e7919 qemu: Security Fix CVE-2016-3710
affects Qemu < 2.6.0

(From OE-Core rev: aa366a5cb5c4ed84537381d71dd5e66514c575be)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00
Armin Kuster
db8258864e util-linux: Security fix for CVE-2016-5011
affects util-linux < 2.28.2

(From OE-Core rev: 72a8636e3cfdfef8d95fee4af721dd7acaa89ffc)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-09-23 15:27:06 +01:00