openembedded-core.git/meta/recipes-devtools/subversion, branch daisy

subversion: fix for Security Advisory CVE-2013-4277

2014-05-29T12:42:11+00:00

Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through
1.8.1 allows local users to overwrite arbitrary files or kill arbitrary
processes via a symlink attack on the file specified by the --pid-file
option.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4277

(From OE-Core rev: e0e483c5b2f481240e590ebb7d6189a211450a7e)

Signed-off-by: Yue Tao 
Signed-off-by: Roy Li 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

subversion: fix for Security Advisory CVE-2013-1847 and CVE-2013-1846

2014-05-29T12:42:11+00:00

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21
and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of
service (NULL pointer dereference and crash) via a LOCK on an activity URL.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1846

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20
and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service
(NULL pointer dereference and crash) via an anonymous LOCK for a URL that does
not exist.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1847

(From OE-Core rev: 3962b76185194fa56be7f1689204a1188ea44737)

Signed-off-by: Yue Tao 
Signed-off-by: Roy Li 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

subversion: fix for Security Advisory CVE-2013-1845

2014-05-29T12:42:11+00:00

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before
1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to
cause a denial of service (memory consumption) by (1) setting or (2)
deleting a large number of properties for a file or directory.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1845

(From OE-Core rev: 432666b84b80f8b0d13672aa94855369f577c56d)

Signed-off-by: Yue Tao 
Signed-off-by: Roy Li 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

subversion: fix for Security Advisory CVE-2013-4131

2014-05-29T12:42:11+00:00

The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through
1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause
a denial of service (assertion failure or out-of-bounds read) via a
certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision
root.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4131

(From OE-Core rev: ce41ed3ca5b6ef06c02c5ca65f285e5ee8c04e7f)

Signed-off-by: Yue Tao 
Signed-off-by: Roy Li 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

subversion: fix for Security Advisory CVE-2013-4505

2014-05-29T12:42:11+00:00

The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0
through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass
intended access restrictions and possibly cause a denial of service
(resource consumption) via a relative URL in a REPORT request.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4505

(From OE-Core rev: 02314673619f44e5838ddb65bbe22f9342ee6167)

Signed-off-by: Yue Tao 
Signed-off-by: Roy Li 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

subversion: fix for Security Advisory CVE-2013-1849

2014-05-29T12:42:11+00:00

Reject operations on getcontentlength and getcontenttype properties
if the resource is an activity.

(From OE-Core rev: 94e8b503e8a5ae476037d4aa86f8e27d4a8c23ea)

Signed-off-by: Yue Tao 
Signed-off-by: Roy Li 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

Replace one-line DESCRIPTION with SUMMARY

2014-01-02T12:47:33+00:00

A lot of our recipes had short one-line DESCRIPTION values and no
SUMMARY value set. In this case it's much better to just set SUMMARY
since DESCRIPTION is defaulted from SUMMARY anyway and then the SUMMARY
is at least useful. I also took the opportunity to fix up a lot of the
new SUMMARY values, making them concisely explain the function of the
recipe / package where possible.

Signed-off-by: Paul Eggleton

subversion: fix build problem when sysroot contains '-D' or '-I'

2013-12-03T17:10:25+00:00

If sysroot contains '-D' or '-I' characters, the SVN_NEON_INCLUDES and
the corresponding CFLAGS will not get the correct value.

This will cause build failures.

This patch fixes the above problem.

[YOCTO #5458]

Signed-off-by: Chen Qi 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

subversion: Add dependency on file for libmagic

2013-10-06T08:49:51+00:00

Signed-off-by: Martin Jansa 
Signed-off-by: Richard Purdie

subversion: Add patch to use neon 0.30

2013-08-07T06:43:31+00:00

The neon update is not recognized but subversion, so we need to patch the configure.ac
to know about 0.30, otherwise we don't have http/https support in subversion.

Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie