openembedded-core.git/meta/recipes-core/libxml, branch dizzy

libxml2: CVE-2015-8241

2016-01-30T12:02:02+00:00

Upstream bug (contains reproducer):
https://bugzilla.gnome.org/show_bug.cgi?id=756263

Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=
ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe

Signed-off-by: Tudor Florea 
Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

libxml2: CVE-2015-8035

2016-01-30T12:02:01+00:00

Fixes DoS when parsing specially crafted XML document
if XZ support is enabled.

References:
https://bugzilla.gnome.org/show_bug.cgi?id=757466

Upstream correction:
https://git.gnome.org/browse/libxml2/commit/?id=
f0709e3ca8f8947f2d91ed34e92e38a4c23eae63

Signed-off-by: Tudor Florea 
Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

libxml2: CVE-2015-7942

2016-01-30T12:01:59+00:00

Fixes heap-based buffer overflow in xmlParseConditionalSections().

Upstream patch:
https://git.gnome.org/browse/libxml2/commit/
?id=9b8512337d14c8ddf662fcb98b0135f225a1c489

Upstream bug:
https://bugzilla.gnome.org/show_bug.cgi?id=756456

Signed-off-by: Sona Sarmadi 
Signed-off-by: Tudor Florea 
Signed-off-by: Armin Kuster

libxml2: Security Advisory - libxml2 - CVE-2015-1819

2015-07-20T19:53:09+00:00

for CVE-2015-1819 Enforce the reader to run in constant memory

(From OE-Core rev: 9e67d8ae592a37d7c92d6566466b09c83e9ec6a7)

Signed-off-by: Yue Tao 
Signed-off-by: Wenzong Fan 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 

Conflicts:
	meta/recipes-core/libxml/libxml2.inc

libxml2: Backport fix for CVE introduced entity issues

2015-02-11T17:39:47+00:00

The CVE fix introduced problems with entity issues, we observed this
when building the Yocto Docs in particular. Backport the fix from
upstream so we can build our docs correctly.

[YOCTO #7134]

(From OE-Core rev: af501bd51f9a86edd34e0405bc32dabe21312229)

Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: fix CVE-2014-3660

2015-02-11T17:39:47+00:00

It was discovered that the patch for CVE-2014-0191 for libxml2 is
incomplete.  It is still possible to have libxml2 incorrectly perform
entity substituton even when the application using libxml2 explicitly
disables the feature.  This can allow a remote denial-of-service attack on
systems with libxml2 prior to 2.9.2.

References:
    http://www.openwall.com/lists/oss-security/2014/10/17/7
    https://www.ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html

(From OE-Core rev: 643597a5c432b2e02033d0cefa3ba4da980d078f)

Signed-off-by: Joe MacDonald 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

recipes: Remove references to eglibc

2014-09-01T17:00:31+00:00

change use of eglibc related variabled to glibc equivalents

Signed-off-by: Khem Raj

meta: fix RDEPNEDS for the test related pkgs

2014-08-28T14:11:11+00:00

Add bash, python or perl to the ptest pkgs to fix the RDEPENDS issues.

Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie

libxml2: Explicitly enable zlib support

2014-08-25T09:23:27+00:00

The zlib support is a must if you are using RPM backend. So this
explicitly enable it and adds a comment in the recipe to avoid its
removal by mistake.

Signed-off-by: Otavio Salvador 
Signed-off-by: Richard Purdie

libxml2: port AM_PATH_XML2 to use pkg-config

2014-08-15T17:19:56+00:00

Upstream AM_PATH_XML2 uses xml2-config which we disable, so port this macro to
use pkg-config.

Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie