openembedded-core.git/meta/recipes-extended/bash/bash_3.2.48.bb, branch dora

bash: Fix-for-CVE-2014-6278

2014-10-12T20:24:36+00:00

This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278

(From OE-Core daisy rev: de596b5f31e837dcd2ce991245eb5548f12d72ae)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-6277

2014-10-12T20:24:36+00:00

Follow up bash42-049 to parse properly function definitions in the
values of environment variables, to not allow remote attackers to
execute arbitrary code or to cause a denial of service.

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277

(From OE-Core daisy rev: 85961bcf81650992259cebb0ef1f1c6cdef3fefa)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-7186 and CVE-2014-7187

2014-10-12T20:24:36+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

(From OE-Core daisy rev: 153d1125659df9e5c09e35a58bd51be184cb13c1)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: Fix for exported function namespace change

2014-10-12T20:24:35+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

This patch changes the encoding bash uses for exported functions to avoid
clashes with shell variables and to avoid depending only on an environment
variable's contents to determine whether or not to interpret it as a shell
function.

(From OE-Core daisy rev: 6c51cc96d03df26d1c10867633e7a10dfbec7c45)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: Fix CVE-2014-7169

2014-10-02T07:03:41+00:00

This is a followup patch to incomplete CVE-2014-6271 fix
code execution via specially-crafted environment

Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed
(From OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc)

Signed-off-by: Khem Raj 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang

bash: fix CVE-2014-6271

2014-10-02T07:03:40+00:00

CVE-2014-6271 aka ShellShock.

"GNU Bash through 4.3 processes trailing strings after function definitions in
the values of environment variables, which allows remote attackers to execute
arbitrary code via a crafted environment."

(From OE-Core master rev: 798d833c9d4bd9ab287fa86b85b4d5f128170ed3)

Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang

bash: Add ptest

2013-07-26T06:44:27+00:00

ptest support was already added for v4.2 but for the distros
using GPLv2 version of bash (3.2.48) this update is required.

Signed-off-by: Muhammad Shakeel 
Signed-off-by: Saul Wold

bash: fix mkbuiltins build failure

2013-01-09T12:36:22+00:00

Same patch for non-gplv3 version:

http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=1fd9a16d2a4594a4e9179dc7353ac51ce32eb712

[YOCTO #3646]

Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

bash: Make it possible to run bash 3.2.48 instead of 4.2.

2012-09-24T10:10:55+00:00

bash-3.2.48 did not provide the linking from sh to bash, making it unusable.
Moving the license part out of the bash.inc file, and into bash_4.2.bb file makes
us able to use that file also for bash_3.2.48.bb, which makes maintaining both
at the same time a lot easier.

Signed-off-by: Martin Ertsaas 
Signed-off-by: Richard Purdie

PR bump for all recipes that DEPEND on ncurses

2012-03-14T23:34:10+00:00

The packaging changes to ncurses could break package feeds,
so bump the PR on everythong that DEPENDS on ncurses.

Signed-off-by: Scott Garman 
Signed-off-by: Richard Purdie