summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
AgeCommit message (Collapse)Author
2020-08-10libpcre: Add fix for CVE-2020-14155stable/zeus-nextRahul Taya
Added below patch in libpcre CVE-2020-14155.patch This patch fixes below error: PCRE could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in libpcre via a large number after (?C substring. By sending a request with a large number, an attacker can execute arbitrary code on the system or cause the application to crash. Tested-by: Rahul Taya <Rahul.Taya@kpit.com> Signed-off-by: Saloni Jain <Saloni.Jain@kpit.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-28nss: Fix CVE-2020-12399Ovidiu Panait
Master (nss version 3.54) is not affected by this issue. This is a backport from nss version 3.54. NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Upstream patch: https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-28sqlite: backport CVE fixSakib Sajal
Fixes CVE-2020-11655 (From OE-Core rev: 3b06a6c73f4e49c6d00f758423c2e8865ec2de00) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [ without the CVE-2020-11656 fix that did not apply cleanly ] Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-17iso-codes: switch upstream branch master -> mainHongxu Jia
(From OE-Core rev: 6e16ef0c2e0ec2bbb862231cd84e7650bd5789af) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 75e91b8e52ec77398e6b0fc09456e971662d9d7e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-17vim: _FORTIFY_SOURCE=2 be goneJoe Slater
vim will abort in many places with this setting. Replace it with the benign _FORTIFY_SOURCE=1. (From OE-Core rev: d9de155f6452f916edd3131addd0c2eebaf4d639) Signed-off-by: Joe Slater <joe.slater@windriver.com> (cherry picked from commit 18129cbaeddb3278efe9963718556e3765f06c1e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-07-17libexif: fix CVE-2020-13114Lee Chee Yang
(From OE-Core rev: 2e497029ee00babbc50f3c1d99580230bc46155c) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-06-29gnutls: fixed CVE-2020-13777haiqing
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket Backport the patch from upstream: https://gitlab.com/gnutls/gnutls.git commit c2646aeee94e71cb15c90a3147cf3b5b0ca158ca commit 50ad8778a81f9421effa4c5a3b457f98e559b178 commit 3d7fae761e65e9d0f16d7247ee8a464d4fe002da Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-29icu: update SRC_URIAlexander Kanavin
New releases of ICU are published on github. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-05gnutls: upgrade 3.6.12 -> 3.6.13Wang Mingyu
(From OE-Core rev: 5cc0f0dcf1f41bc148b034b3f7abef756a328cd3) Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [ includes the fix for CVE-2020-11501 ] Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-05gnutls: upgrade 3.6.11.1 -> 3.6.12Alexander Kanavin
(From OE-Core rev: 8652c95ceb505dd7386166842486c833ea5a7ee7) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-05gnutls: upgrade 3.6.8 -> 3.6.11.1Alex Kiernan
Drop patch from 81485be19b18 ("gnutls: don't use HOSTTOOLS_DIR/bash as a shell on target") as upstream now honours POSIX_SHELL when set as the primary target shell. (From OE-Core rev: bc487ced3be40569157fb40c99bfa68871f74744) Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-05-05gnupg: upgrade 2.2.17 -> 2.2.19Wang Mingyu
(From OE-Core rev: 287de363f80a2f9919b942a1349f58575e8b91d8) Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [ includes the fix for CVE-2019-14855 ] Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-03-20icu: fix CVE-2020-10531Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-03-16aspell: CVE-2019-20433Stefan Ghinea
libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable. References: https://nvd.nist.gov/vuln/detail/CVE-2019-20433 Upstream patches: https://github.com/GNUAspell/aspell/commit/de29341638833ba7717bd6b5e6850998454b044b https://github.com/GNUAspell/aspell/commit/cefd447e5528b08bb0cd6656bc52b4255692cefc Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-03-16sqlite: fix numerous CVEsRoss Burton
Fix the following CVEs: - CVE-2019-19244 - CVE-2019-19923 - CVE-2019-19924 - CVE-2019-19925 - CVE-2019-19926 - CVE-2019-19959 - CVE-2019-20218 Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [ removed the CVE-2019-19880 fix that did not apply cleanly ] Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-03-16libpcre2: fix CVE-2019-20454Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2020-02-11libevdev: Fix determinism issueRichard Purdie
We need to sort python dict output to be deterministic and generate consistent header files. (From OE-Core rev: 75e4cedb986379db2e8a897df52ee1363f9a9a80) (From OE-Core rev: fc6e8e527698a82bf8047d02e0e792c4a1a64449) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11libgcrypt: Fix determinism issueRichard Purdie
The build was injection git information from the wrong git tree, stop this to allow reproducible builds. (From OE-Core rev: 506b36b6d86b3454fcc3cb85f6229cbe8d14f5b5) (From OE-Core rev: 2b68ffc6d7c45541958f1b0c0b9ca9e39064e096) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-11curl: fix CVE-2019-15601Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-12-31nss: Backport clang build fixKhem Raj
(From OE-Core rev: 35bbb1deb4ddab3861dce7ca2ada778094fb353e) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-12-16recipes: change SRC_URI to use httpsStefan Müller-Klieser
Change all recipes to https where we get an http 301 permanent redirect. (From OE-Core rev: e514acda9e12bccde6d3974e0fd1a37b3837191a) Signed-off-by: Stefan Müller-Klieser <s.mueller-klieser@phytec.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-06libsoup-2.4: upgrade to 2.66.4Ross Burton
Fixes CVE-2019-17266. (From OE-Core rev: ffdbcd78955d43d34988991f1d217036f044167d) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [Bug fix release: https://gitlab.gnome.org/GNOME/libsoup/compare/2.66.2...2.66.4] Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-25boost: fix build for x32Anuj Mittal
Commit: d336110b94 boost: update to 1.67.0 dropped the patch that ensured boost doesn't over-ride the architecture flags set by us resulting in errors: | build/tmp/work/x86_64_x32-poky-linux-gnux32/boost/1.69.0-r0/recipe-sysroot/usr/include/bits/long-double.h:44:10: fatal error: bits/long-double-64.h: No such file or directory | #include <bits/long-double-64.h> | ^~~~~~~~~~~~~~~~~~~~~~~ | compilation terminated. Remove the relevant part from gcc.jam again to ensure we are passing them correctly again. Fixes [YOCTO #13598] (From OE-Core rev: aad28f42b1c8aa1335c040630ebff4a69be07e35) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-25libsoup: set CVE_PRODUCTRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-25lz4: Whitelist CVE-2014-4715Adrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-10libgcrypt: fix CVE-2019-13627Trevor Gamblin
Backport two fixes for CVE-2019-13627 from upstream to zeus. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10libxslt: fix CVE-2019-18197Joe Slater
Use patch from upstream after 1.1.33 release. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-10-29libgcrypt: fix CVE-2019-12904Yi Zhao
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12904 Patches from: https://github.com/gpg/libgcrypt/commit/1374254c2904ab5b18ba4a890856824a102d4705 https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762 https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 37e390ff05b6a4509019db358ed496731d80cc51) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25aspell: fix CVE-2019-17544Trevor Gamblin
Backport CVE-2019-17544 fix to zeus. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25sqlite3: fix CVE-2019-16168Qi.Chen@windriver.com
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-07ethtool, libcap: fix upstream version checkAlexander Kanavin
The default URI returns a gzip-compressed index page which browsers can auto-detect, but we can't. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-27apr: Check for libtoolize rather than libtoolRobert Yang
Backport a patch from debian to make it check libtoolize rather than libtool. https://sources.debian.org/data/main/a/apr/1.6.5-1/debian/patches/libtoolize_check.patch This can also fix: $ bitbake nativesdk-apr buildconf: libtool not found. You need libtool version 1.4 or newer installed Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-19libmpc: Remove dead UPSTREAM_CHECK_URIAdrian Bunk
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-18libical: upgrade to 3.0.6Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-18libunwind: apply configure over-ride to both big and little endian ARMAndre McCurdy
Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-16curl: update to 7.66.0Oleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-15libsoup:enable libsoup build as native packageJiang Lu
Enable libsoup build as a native package, for it may invoked by other native package, such as ostree. Signed-off-by: Jiang Lu <lu.jiang@windriver.com> Signed-off-by: Liwei Song <liwei.song@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-15gnupg: Extend -native wrapper to fix gpgme-native's gpgconf problemsJason Wessel
The gpg commit signing in ostree-native doesn't work properly when running from sstate. The ostree-native is linked with gpgme-native's libraries, which have calls into gpg. Ultimately it turned out the problem was that gpgme calls gpgconf and some of the other gnupg-native binaries directly. Not all the binaries have a wrapper which sets the environment variable GNUPG_BIN. Without this wrapper these binaries it gets the path assignment from the original compilation which causes a fault when running from sstate in a new tmp directory because these paths will not exist. Signed-off-by: Jason Wessel <jason.wessel@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-15libtasn1: fix build with api-documentation enabledRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-11libevent: don't treat test stats line as pass/fail in ptestTrevor Gamblin
Supplemental to commit fb17b46e2. The libevent "regress" test outputs its own pass/fail results, e.g. "2/300 TESTS FAILED. (31 skipped)", which will be miscounted as an extra test fail in the ptest log. Fixed this to ignore the libevent results line when counting actual pass/fail results. Also removed the for loop in run-ptest and targeted only the libevent "regress" test, as the other tests being run were related to performance and did not provide a relevant pass/fail output. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-07libevent: add granularity to ptest logTrevor Gamblin
The libevent ptest used to report only a global pass or a fail result. Count individual PASS, FAIL, SKIP results. The SKIP results now include tests that are disabled in the libevent code. libevent's ptest output did not comply with the automake-style output "result: testname", and reported a FAIL status at the end of the test run if any of the libevent tests failed. This patch makes the log consistent with the automake style: PASS: http/cancel_by_host_no_ns PASS: http/cancel_inactive_server PASS: http/cancel_by_host_no_ns_inactive_server SKIPPED: http/cancel_by_host_server_timeout SKIPPED: http/cancel_server_timeout and provides a summary as follows: === Test Summary === TOTAL: 316 PASSED: 300 FAILED: 0 SKIPPED: 16 DURATION: 87 END: /usr/lib/libevent/ptest Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-06libgpg-error: Fix build with gawk 5.xKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-09-06libnl: don't patch libnl-3.0.pcRoss Burton
This patch originally came from oe-classic in 2010 with the comment "fix pc file so that it actually links to the support libraries". If an application wants to link to the support libraries then it should be using the relevant .pc files to do so. oe-core builds successfully with this patch removed and other distributions don't carry it, so drop the patch. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-06libnl: upgrade to 3.5.0Ross Burton
Drop the musl workaround, as upstream has solved this correctly now. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-01libgpg-error: Fix build with gawk 5.xKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-31libevdev: update to 1.8.0Oleksandr Kravchuk
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-31libbsd: upgrade 0.9.1 -> 0.10.0Yi Zhao
License-Update: copyright years updated. Drop the backport patch. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-30libpsl: use python 3 during buildsAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-30ca-certificates: use python 3 for buildsAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-08-30libffi: fix upstream version checkAlexander Kanavin
As there is no version newer than 3.3-rc0 yet, an exception from the check is needed. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-27 15:28:48 +0000