aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2017-05-11bitbake: lib/bb/checksum: avoid exception on broken symlinksakuster/krogoth-nextPaul Eggleton
If using OE's externalsrc with a source tree that is not tracked by git and contains broken symlinks, you can receive "TypeError: unorderable types: NoneType() < str()" within the file checksum code due to: checksums.sort(key=operator.itemgetter(1)) Don't add files with no checksum to the checksums list in order to avoid this. (Bitbake rev: 484fe5a3f5b840e5422cbdff0eef9aecfe944a19) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11pseudo: Work around issues with glibc 2.24Richard Purdie
There are issues with a change made to RTLD_NEXT behaviour in glibc 2.24 and that change was also backported to older glibc versions in some distros like Fedora 23. This adds a workaround whilst the pseudo maintainer fixes various issues properly. (From OE-Core rev: 21c38a091c4a1917f62a942c4751b0fd11dce340) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11pseudo: obey our LDFLAGSChristopher Larson
(From OE-Core rev: fc04eae73cb99d3783b09d062120a9b7dc95210a) Signed-off-by: Christopher Larson <chris_larson@mentor.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl.inc: avoid random ptest failuresPatrick Ohly
"make alltests" is sensitive to the timestamps of the installed files. Depending on the order in which cp copies files, .o and/or executables may end up with time stamps older than the source files. Running tests then triggers recompilation attempts, which typically will fail because dev tools and files are not installed. "cp -a" is not enough because the files also have to be newer than the installed header files. Setting the file time stamps to the current time explicitly after copying solves the problem because do_install_ptest_base is guaranteed to run after do_install. (From OE-Core rev: 101e2a5e0b7822ca3de3d3a73369405c05ab3c5b) Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: fix do_configure error when cwd is not in @INCRobert Yang
Fixed when building on Debian-testing: | Can't locate find.pl in @INC (@INC contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.22.2 /usr/local/share/perl/5.22.2 /usr/lib/x86_64-linux-gnu/perl5/5.22 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.22 /usr/share/perl/5.22 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base) at perlpath.pl line 7. (From OE-Core rev: c28065671b582c140d5971c73791d2ac8bdebe69) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> fixed merge conflict Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: Security fix CVE-2016-2177Armin Kuster
Affects openssl <= 1.0.2h CVSS v2 Base Score: 7.5 HIGH (From OE-Core rev: 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> fixed merge conflicts Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: prevent warnings from openssl-c_rehash.shJoshua Lock
The openssl-c_rehash.sh script reports duplicate files and files which don't contain a certificate or CRL by echoing a WARNING to stdout. This warning gets picked up by the log checker during rootfs and results in several warnings getting reported to the console during an image build. To prevent the log from being overrun by warnings related to certificates change these messages in openssl-c_rehash.sh to be prefixed with NOTE not WARNING. (From OE-Core rev: 88c25318db9f8091719b317bacd636b03d50a411) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: Ensure SSL certificates are stored on sysconfdirOtavio Salvador
Debian and other generic distributions has moved the certificates for sysconfdir (/etc/ssl) and made the libdir content to link for it. This provides several advantages specially for read-only rootfs. Another benefit is that it ensures foreign implementations (e.g: BoringSSL, from Chromium, when running with OpenSSL backend for the certificates) to find the content correctly. (From OE-Core rev: 50d63fa346bbb05dafffc0cb55e21e1092272d95) Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: Add Shell-Script based c_rehash utilityOtavio Salvador
The PLD Linux distribution has ported the c_rehash[1] utility from Perl to Shell-Script, allowing it to be shipped by default. 1. https://git.pld-linux.org/?p=packages/openssl.git;a=blob;f=openssl-c_rehash.sh;h=0ea22637ee6dbce845a9e2caf62540aaaf5d0761 The OpenSSL upstream intends[2] to convert the utility for C however did not yet finished the conversion. 2. https://rt.openssl.org/Ticket/Display.html?id=2324 This patch adds this script and thus removed the Perl requirement for it. (From OE-Core rev: cb6150f1a779e356f120d5e45c91fda75789970a) Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: fix add missing dependencies building for test directoryAndrej Valek
Regarding the last commit about missing dependencies, another issue was found. The problem was found, while ptest has been built with some set extra settings. It means, when ptest is going to be built, it is necessary to rebuild dependencies for test directory too. (From OE-Core rev: 030142d0410bec85aeacfff6be27d5fed41ce808) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: fix add missing `make depend` command before `make` libraryAndrej Valek
Settings from EXTRA_OECONF like en/disable no-ssl3, are transferred only into DEPFLAGS. It means that settings have no effect on output files. DEPFLAGS will be transferred into output files with make depend command. https://wiki.openssl.org/index.php/Compilation_and_Installation#Dependencies (From OE-Core rev: e3c251427a305780d3257a011260bd978de273d5) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Pascal Bach <pascal.bach@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: Fix MIPS64be and add MIPS64leZubair Lutfullah Kakakhel
MIPS64 target was being configured for linux-mips which defaults to MIPS32. Doesn't cause any issue as far as I can see but it would be wiser to use the correct target configuration. Also add MIPS64le configuration which is missing. (From OE-Core rev: 0afec72913bc31d315cba079da317e8b28755ded) Signed-off-by: Zubair Lutfullah Kakakhel <Zubair.Kakakhel@imgtec.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11mesa: update SRC_URIArmin Kuster
ERROR: mesa-2_11.1.2-r0 do_checkuri: Function failed: Fetcher failure for URL: 'ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz'. URL ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz doesn't work ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/i586-poky-linux/mesa/2_11.1.2-r0/temp/log.do_checkuri.30779 Log data follows: | DEBUG: Executing python function do_checkuri | DEBUG: Testing URL ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz | DEBUG: checkstatus() urlopen failed: <urlopen error ftp error: 550 Failed to change directory.> | DEBUG: Python function do_checkuri finished | ERROR: Function failed: Fetcher failure for URL: 'ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz'. URL ftp://ftp.freedesktop.org/pub/mesa/11.1.2/mesa-11.1.2.tar.xz doesn't work Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11bitbake: fetch2/wget: attempt checkstatus again if it failsRoss Burton
Some services such as SourceForge seem to struggle to keep up under load, with the result that over half of the autobuilder checkuri runs fail with sourceforge.net "connection timed out". Attempt to mitigate this by re-attempting once the network operation on failure. (Bitbake rev: 54b1961551511948e0cbd2ac39f19b39b9cee568) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Hand applied Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11libpng -lsb: update SRC_URIArmin Kuster
ERROR: libpng12-1.2.56-r0 do_checkuri: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/i586-poky-linux/libpng12/1.2.56-r0/temp/log.do_checkuri.19750 Log data follows: | DEBUG: Executing python function do_checkuri | DEBUG: Testing URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz | DEBUG: checkstatus() urlopen failed: HTTP Error 404: Not Found | DEBUG: Python function do_checkuri finished | ERROR: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11libxslt: update SRC_URIArmin Kuster
| ERROR: Function failed: Fetcher failure for URL: 'ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz'. URL ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz doesn't work ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/x86_64-linux/libxslt-native/1.1.28-r0/temp/log.do_checkuri.16102 Log data follows: | DEBUG: Executing python function do_checkuri | DEBUG: Testing URL ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz | DEBUG: checkstatus() urlopen failed: <urlopen error ftp error: [Errno 110] Connection timed out> | DEBUG: Python function do_checkuri finished | ERROR: Function failed: Fetcher failure for URL: 'ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz'. URL ftp://xmlsoft.org/libxslt/libxslt-1.1.28.tar.gz doesn't work Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11libpng: update SRC_URI back to SFArmin Kuster
ERROR: Task 944 (virtual:nativesdk:/home/akuster/oss/maint/poky/meta/recipes-multimedia/libpng/libpng_1.6.21.bb, do_checkuri) failed with exit code '1' ERROR: libpng12-1.2.56-r0 do_checkuri: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work ERROR: Logfile of failure stored in: /home/akuster/oss/maint/poky/build/tmp/work/i586-poky-linux/libpng12/1.2.56-r0/temp/log.do_checkuri.14781 Log data follows: | DEBUG: Executing python function do_checkuri | DEBUG: Testing URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz | DEBUG: checkstatus() urlopen failed: HTTP Error 404: Not Found | DEBUG: Python function do_checkuri finished | ERROR: Function failed: Fetcher failure for URL: 'http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz'. URL http://distfiles.gentoo.org/distfiles/libpng-1.2.56.tar.xz doesn't work SF now has a old releases dir which contains this tarball. It got dropped from Gentoo Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11libpcre: update SRC_URIArmin Kuster
ERROR: Task 75 (/home/akuster/oss/maint/poky/meta/recipes-support/libpcre/libpcre_8.38.bb, do_checkuri) failed with exit code '1' ERROR: libpcre-native-8.38-r0 do_checkuri: Function failed: Fetcher failure for URL: 'ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.38.tar.bz2'. URL ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.38.tar.bz2 doesn't work Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11zlib: update SRC_URI to fix fetchingJoshua Lock
Upstream have removed the file from zlib.net as a new version has been released, switch to fetching from the official sourceforge mirror. [YOCTO #10879] (From OE-Core rev: bb99e4a620efd59556539c156cd98ea23aae74c8) (From OE-Core rev: b7599330f1d629384e16a5fbeffc1a65c1555667) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11populate_sdk_ext: whitelist do_package tasksEd Bartosh
With enabled SSTATE_MIRRORS sstate code expects mirrors to contain entries for all tasks, which is not the case for ext installer as it uses reduced sstate cache. Added do_package tasks to BB_SETSCENE_ENFORCE_WHITELIST to prevent installer failing with ERROR: Sstate artifact unavailable [YOCTO #10832] (From OE-Core rev: 2ed46ada4b8e496493835e84b36f7e9c367f59d2) (From OE-Core rev: eb2fc2cd9081a4533ed30fe81c9f491b06cc5ae1) Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11populate_sdk_ext: fix working with uninative sstateEd Bartosh
Mapped uninative sstate directories to make ext SDK installer to use them when it's run on systems with gcc version different from gcc version used to build installer. [YOCTO #10832] (From OE-Core rev: fb945c0fd2e66d70461e6cf2e602020eeabe32f7) Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tiff: Security fix CVE-2016-9538Mingli Yu
* tools/tiffcrop.c: fix read of undefined buffer in readContigStripsIntoBuffer() due to uint16 overflow. External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9538 Patch from: https://github.com/vadz/libtiff/commit/43c0b81a818640429317c80fea1e66771e85024b#diff-c8b4b355f9b5c06d585b23138e1c185f (From OE-Core rev: 9af5d5ea882c853e4cb15006f990d3814eeea9ae) (From OE-Core rev: 33cad1173f6d1b803b794a2ec57fe8a9ef19fb44) Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tiff: Security fix CVE-2016-9535Mingli Yu
* libtiff/tif_predict.h, libtiff/tif_predict.c: Replace assertions by runtime checks to avoid assertions in debug mode, or buffer overflows in release mode. Can happen when dealing with unusual tile size like YCbCr with subsampling. External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9535 Patch from: https://github.com/vadz/libtiff/commit/3ca657a8793dd011bf869695d72ad31c779c3cc1 https://github.com/vadz/libtiff/commit/6a984bf7905c6621281588431f384e79d11a2e33 (From OE-Core rev: 61d3feb9cad9f61f6551b43f4f19bfa33cadd275) (From OE-Core rev: d55b4470c20f4a4b73b1e6f148a45d94649dfdb5) Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tiff: Security fix CVE-2016-9539Zhixiong Chi
tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9539 Patch from: https://github.com/vadz/libtiff/commit/ae9365db1b271b62b35ce018eac8799b1d5e8a53 (From OE-Core rev: 58bf0a237ca28459eb8c3afa030c0054f5bc1f16) (From OE-Core rev: 0933a11707a369c8eaefebd31e8eea634084d66e) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tiff: Security fix CVE-2016-9540Zhixiong Chi
tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow." External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9540 Patch from: https://github.com/vadz/libtiff/commit/5ad9d8016fbb60109302d558f7edb2cb2a3bb8e3 (From OE-Core rev: cc97dc66006c7892473e3b4790d05e12445bb927) (From OE-Core rev: ad2c4710ef15c35f6dd4e7642efbceb2cbf81736) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tiff: Security fix CVE-2016-3632Yi Zhao
CVE-2016-3632 libtiff: The _TIFFVGetField function in tif_dirinfo.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3632 http://bugzilla.maptools.org/show_bug.cgi?id=2549 https://bugzilla.redhat.com/show_bug.cgi?id=1325095 The patch is from RHEL7. (From OE-Core rev: 9206c86239717718be840a32724fd1c190929370) (From OE-Core rev: 0c6928f4129e5b1e24fa2d42279353e9d15d39f0) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tiff: Security fix CVE-2016-3658Zhixiong Chi
The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3658 http://bugzilla.maptools.org/show_bug.cgi?id=2546 Patch from: https://github.com/vadz/libtiff/commit/45c68450bef8ad876f310b495165c513cad8b67d (From OE-Core rev: c060e91d2838f976774d074ef07c9e7cf709f70a) (From OE-Core rev: cc266584158c8dfc8583d21534665b6152a4f7ee) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11expat: CVE-2012-6702, CVE-2016-5300Sona Sarmadi
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6702 http://www.openwall.com/lists/oss-security/2016/06/04/5 Reference to upstream fix: https://bugzilla.redhat.com/attachment.cgi?id=1165210 Squashed backport against vanilla Expat 2.1.1, addressing: * CVE-2012-6702 -- unanticipated internal calls to srand * CVE-2016-5300 -- use of too little entropy Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11oeqa: fix hasPackage, add hasPackageMatchRoss Burton
hasPackage() was looking for the string provided as an RE substring in the manifest, which resulted in a large number of false positives (i.e. libgtkfoo would match "gtk+"). Rewrite the manifest loader to parse the files into a proper data structure, change hasPackage to do full string matches, and add hasPackageMatch which does RE substring matches. (From OE-Core rev: b9409863af71899e02275439949e3f4cdfaf2d0f) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tzdata: update to 2016iArmin Kuster
Briefly: Cyprus split into two time zones on 2016-10-30, and Tonga reintroduces DST on 2016-11-06. Changes to future time stamps Pacific/Tongatapu begins DST on 2016-11-06 at 02:00, ending on 2017-01-15 at 03:00. Assume future observances in Tonga will be from the first Sunday in November through the third Sunday in January, like Fiji. (Thanks to Pulu ʻAnau.) Switch to numeric time zone abbreviations for this zone. Changes to past and future time stamps Northern Cyprus is now +03 year round, causing a split in Cyprus time zones starting 2016-10-30 at 04:00. This creates a zone Asia/Famagusta. (Thanks to Even Scharning and Matt Johnson.) Antarctica/Casey switched from +08 to +11 on 2016-10-22. (Thanks to Steffen Thorsen.) Changes to past time stamps Several corrections were made for pre-1975 time stamps in Italy. These affect Europe/Malta, Europe/Rome, Europe/San_Marino, and Europe/Vatican. First, the 1893-11-01 00:00 transition in Italy used the new UT offset (+01), not the old (+00:49:56). (Thanks to Michael Deckers.) Second, rules for daylight saving in Italy were changed to agree with Italy's National Institute of Metrological Research (INRiM) except for 1944, as follows (thanks to Pierpaolo Bernardi, Brian Inglis, and Michael Deckers): The 1916-06-03 transition was at 24:00, not 00:00. The 1916-10-01, 1919-10-05, and 1920-09-19 transitions were at 00:00, not 01:00. The 1917-09-30 and 1918-10-06 transitions were at 24:00, not 01:00. The 1944-09-17 transition was at 03:00, not 01:00. This particular change is taken from Italian law as INRiM's table, (which says 02:00) appears to have a typo here. Also, keep the 1944-04-03 transition for Europe/Rome, as Rome was controlled by Germany then. The 1967-1970 and 1972-1974 fallback transitions were at 01:00, not 00:00. (From OE-Core rev: daf95f7fd9f7ab65685d7b764d8e50df8d00d308) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tzcode: update to 2016iArmin Kuster
Changes to code The code should now be buildable on AmigaOS merely by setting the appropriate Makefile variables. (From a patch by Carsten Larsen.) (From OE-Core rev: d2b8c4ee535684f5d874082a7f76efbda1907ea5) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11openssl: Security fix CVE-2016-8610Armin Kuster
affects openssl < 1.0.2i (From OE-Core rev: 0256b61cdafe540edb3cec2a34429e24b037cfae) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tiff: Security fix CVE-2016-3622Yi Zhao
CVE-2016-3622 libtiff: The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3622 http://www.openwall.com/lists/oss-security/2016/04/07/4 Patch from: https://github.com/vadz/libtiff/commit/92d966a5fcfbdca67957c8c5c47b467aa650b286 (From OE-Core rev: 0af0466f0381a72b560f4f2852e1d19be7b6a7fb) (From OE-Core rev: 928eadf8442cf87fb2d4159602bd732336d74bb7) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-05-11tiff: Security fix CVE-2016-3623Yi Zhao
CVE-2016-3623 libtiff: The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v or (2) h parameter to 0. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3623 http://bugzilla.maptools.org/show_bug.cgi?id=2569 Patch from: https://github.com/vadz/libtiff/commit/bd024f07019f5d9fea236675607a69f74a66bc7b (From OE-Core rev: d66824eee47b7513b919ea04bdf41dc48a9d85e9) (From OE-Core rev: f0e77ffa6bbc3adc61a2abd5dbc9228e830c055d) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-05-11tiff: Security fix CVE-2016-3991Yi Zhao
CVE-2016-3991 libtiff: Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3991 http://bugzilla.maptools.org/show_bug.cgi?id=2543 Patch from: https://github.com/vadz/libtiff/commit/e596d4e27c5afb7960dc360fdd3afd90ba0fb8ba (From OE-Core rev: d31267438a654ecb396aefced201f52164171055) (From OE-Core rev: cf58711f12425fc1c29ed1e3bf3919b3452aa2b2) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-05-11tiff: Security fix CVE-2016-3990Yi Zhao
CVE-2016-3990 libtiff: Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3990 http://bugzilla.maptools.org/show_bug.cgi?id=2544 Patch from: https://github.com/vadz/libtiff/commit/6a4dbb07ccf92836bb4adac7be4575672d0ac5f1 (From OE-Core rev: c6492563037bcdf7f9cc50c8639f7b6ace261e62) (From OE-Core rev: d7165cd738ac181fb29d2425e360f2734b0d1107) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-05-11tiff: Security fix CVE-2016-3945Yi Zhao
CVE-2016-3945 libtiff: Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write. External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3945 http://bugzilla.maptools.org/show_bug.cgi?id=2545 Patch from: https://github.com/vadz/libtiff/commit/7c39352ccd9060d311d3dc9a1f1bc00133a160e6 (From OE-Core rev: 04b9405c7e980d7655c2fd601aeeae89c0d83131) (From OE-Core rev: 3a4d2618c50aed282af335ef213c5bc0c9f0534e) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-05-11tzdata: Update to 2016hArmin Kuster
Changes to future time stamps Asia/Gaza and Asia/Hebron end DST on 2016-10-29 at 01:00, not 2016-10-21 at 00:00. (Thanks to Sharef Mustafa.) Predict that future fall transitions will be on the last Saturday of October at 01:00, which is consistent with predicted spring transitions on the last Saturday of March. (Thanks to Tim Parenti.) Changes to past time stamps In Turkey, transitions in 1986-1990 were at 01:00 standard time not at 02:00, and the spring 1994 transition was on March 20, not March 27. (Thanks to Kıvanç Yazan.) Changes to past and future time zone abbreviations Asia/Colombo now uses numeric time zone abbreviations like "+0530" instead of alphabetic ones like "IST" and "LKT". Various English-language sources use "IST", "LKT" and "SLST", with no working consensus. (Usage of "SLST" mentioned by Sadika Sumanapala.) (From OE-Core rev: ff11ca44fec8e4b2aa523e032bd967e3ab8339a8) (From OE-Core rev: 5637d1555b51569cdd7202ee47a0b913a0b429cb) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11tzcode-native: update to 2016hArmin Kuster
Changes to code zic no longer mishandles relativizing file names when creating symbolic links like /etc/localtime, when these symbolic links are outside the usual directory hierarchy. This fixes a bug introduced in 2016g. (Problem reported by Andreas Stieger.) (From OE-Core rev: 9c5de646e01a83219be74e99dcf7c1e56ba38b53) (From OE-Core rev: 9288b6e699abbf5b314029b0db9230ca159b335a) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8625Sona Sarmadi
IDNA 2003 makes curl use wrong host Affected versions: curl 7.12.0 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102K.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8624Sona Sarmadi
invalid URL parsing with '#' Affected versions: curl 7.1 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102J.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8623Sona Sarmadi
Use-after-free via shared cookies Affected versions: curl 7.10.7 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102I.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8622Sona Sarmadi
URL unescape heap overflow via integer truncation Affected versions: curl 7.24.0 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102H.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8621Sona Sarmadi
curl_getdate read out of bounds Affected versions: curl 7.12.2 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102G.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8620Sona Sarmadi
glob parser write/read out of bounds Affected versions: curl 7.34.0 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102F.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8619Sona Sarmadi
double-free in krb5 code Affected versions: curl 7.3 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102E.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8618Sona Sarmadi
double-free in curl_maprintf Affected versions: curl 7.1 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102D.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8617Sona Sarmadi
OOB write via unchecked multiplication Affected versions: curl 7.1 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102C.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8616Sona Sarmadi
case insensitive password comparison Affected versions: curl 7.7 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102B.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-05-11curl: CVE-2016-8615Sona Sarmadi
cookie injection for other servers Affected versions: curl 7.1 to and including 7.50.3 Reference: https://curl.haxx.se/docs/adv_20161102A.html Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-20 02:41:10 +0000