openembedded-core.git/meta/recipes-core, branch dizzy

init-install-efi.sh: Avoid /mnt/mtab creation if already present

2016-07-11T21:22:34+00:00

The base-files recipe installs /mnt/mtab (it is a softlink of /proc/mounts),
so if an image includes the latter, there is no new to created it again inside
the install-efi.sh script, otherwise an error may occur as indicated on the
bug's site.

[YOCTO #7971]

Signed-off-by: Leonardo Sandoval 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

glibc: CVE-2015-8776

2016-03-21T15:48:37+00:00

it was found that out-of-range time values passed to the strftime function may
cause it to crash, leading to a denial of service, or potentially disclosure
information.

(From OE-Core rev: b9bc001ee834e4f8f756a2eaf2671aac3324b0ee)

Signed-off-by: Armin Kuster 
Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie

glibc: CVE-2015-9761

2016-03-21T15:48:29+00:00

A stack overflow vulnerability was found in nan* functions that could cause
applications which process long strings with the nan function to crash or,
potentially, execute arbitrary code.

(From OE-Core rev: fd3da8178c8c06b549dbc19ecec40e98ab934d49)

Signed-off-by: Armin Kuster 
Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie

glibc: CVE-2015-8779

2016-03-21T15:48:21+00:00

A stack overflow vulnerability in the catopen function was found, causing
applications which pass long strings to the catopen function to crash or,
potentially execute arbitrary code.

(From OE-Core rev: af20e323932caba8883c91dac610e1ba2b3d4ab5)

Signed-off-by: Armin Kuster 
Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie

glibc: CVE-2015-8777

2016-03-21T15:48:21+00:00

The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or
libc6) before 2.23 allows local users to bypass a pointer-guarding protection
mechanism via a zero value of the LD_POINTER_GUARD environment variable.

(From OE-Core rev: 22570ba08d7c6157aec58764c73b1134405b0252)

Signed-off-by: Armin Kuster 
Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie

glibc 2.20: Security fix CVE-2015-7547

2016-02-26T11:42:15+00:00

CVE-2015-7547: getaddrinfo() stack-based buffer overflow

Signed-off-by: Koen Kooi 
Signed-off-by: Richard Purdie

glibc: Fixes a heap buffer overflow in glibc wscanf.

2016-01-30T12:02:16+00:00

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1472
https://sourceware.org/ml/libc-alpha/2015-02/msg00119.html
http://openwall.com/lists/oss-security/2015/02/04/1

Reference to upstream fix:
https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;
h=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06

Signed-off-by: Sona Sarmadi 
Signed-off-by: Tudor Florea 

Hand applied.

Signed-off-by: Armin Kuster

libxml2: CVE-2015-8241

2016-01-30T12:02:02+00:00

Upstream bug (contains reproducer):
https://bugzilla.gnome.org/show_bug.cgi?id=756263

Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=
ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe

Signed-off-by: Tudor Florea 
Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

libxml2: CVE-2015-8035

2016-01-30T12:02:01+00:00

Fixes DoS when parsing specially crafted XML document
if XZ support is enabled.

References:
https://bugzilla.gnome.org/show_bug.cgi?id=757466

Upstream correction:
https://git.gnome.org/browse/libxml2/commit/?id=
f0709e3ca8f8947f2d91ed34e92e38a4c23eae63

Signed-off-by: Tudor Florea 
Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

libxml2: CVE-2015-7942

2016-01-30T12:01:59+00:00

Fixes heap-based buffer overflow in xmlParseConditionalSections().

Upstream patch:
https://git.gnome.org/browse/libxml2/commit/
?id=9b8512337d14c8ddf662fcb98b0135f225a1c489

Upstream bug:
https://bugzilla.gnome.org/show_bug.cgi?id=756456

Signed-off-by: Sona Sarmadi 
Signed-off-by: Tudor Florea 
Signed-off-by: Armin Kuster