openembedded-core.git/meta/recipes-extended/bash, branch dylan

bash: Fix-for-CVE-2014-6278

2014-10-12T20:29:14+00:00

This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278

(From OE-Core daisy rev: de596b5f31e837dcd2ce991245eb5548f12d72ae)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-6277

2014-10-12T20:29:14+00:00

Follow up bash42-049 to parse properly function definitions in the
values of environment variables, to not allow remote attackers to
execute arbitrary code or to cause a denial of service.

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277

(From OE-Core daisy rev: 85961bcf81650992259cebb0ef1f1c6cdef3fefa)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-7186 and CVE-2014-7187

2014-10-12T20:29:14+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

(From OE-Core daisy rev: 153d1125659df9e5c09e35a58bd51be184cb13c1)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: Fix for exported function namespace change

2014-10-12T20:29:14+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

This patch changes the encoding bash uses for exported functions to avoid
clashes with shell variables and to avoid depending only on an environment
variable's contents to determine whether or not to interpret it as a shell
function.

(From OE-Core daisy rev: 6c51cc96d03df26d1c10867633e7a10dfbec7c45)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: Fix CVE-2014-7169

2014-10-12T20:29:14+00:00

This is a followup patch to incomplete CVE-2014-6271 fix
code execution via specially-crafted environment

Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed
(From OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc)

Signed-off-by: Khem Raj 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang 
Signed-off-by: Paul Eggleton

bash: fix CVE-2014-6271

2014-10-12T20:29:14+00:00

CVE-2014-6271 aka ShellShock.

"GNU Bash through 4.3 processes trailing strings after function definitions in
the values of environment variables, which allows remote attackers to execute
arbitrary code via a crafted environment."

(From OE-Core master rev: 798d833c9d4bd9ab287fa86b85b4d5f128170ed3)

Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang 
Signed-off-by: Paul Eggleton

bash: Use new _ptest functions

2013-03-07T11:12:57+00:00

Signed-off-by: Björn Stenberg 
Signed-off-by: Saul Wold

bash: fix mkbuiltins build failure

2013-01-09T12:36:22+00:00

Same patch for non-gplv3 version:

http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=1fd9a16d2a4594a4e9179dc7353ac51ce32eb712

[YOCTO #3646]

Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

Add ptest for bash.

2012-12-25T22:00:20+00:00

Signed-off-by: Björn Stenberg 
Signed-off-by: Saul Wold

bash: fix mkbuiltins build failure

2012-11-14T15:57:13+00:00

On hosts with FORTIFY_SOURCES, stringize support is required, as it's used by
the macros to wrap functions (e.g. read and open in unistd.h). Those wrappers
use the STRING() macro from unistd.h. A header in the bash sources overrides
the unistd.h macro to 'x' when HAVE_STRINGIZE is not defined, causing the
wrappers to generate calls to 'xread' and 'xopen', which do not exist,
resulting in a failure to link.

Assume we have stringize support when cross-compiling, which works around the
issue.

It may be best for upstream to either give up on supporting compilers without
stringize support, or to not define STRING() at all when FORTIFY_SOURCES is
defined, letting the unistd.h one be used, instead.

Signed-off-by: Christopher Larson 
Signed-off-by: Richard Purdie