openembedded-core.git/meta/recipes-extended, branch dora

ltp: Added zip-native as a DEPENDS

2014-11-21T16:46:34+00:00

The Makefile checks for zip during installation

[YOCTO #6699]

(From OE-Core rev: a6e8ced3fa8e8e2aa3df0798b80eb26e5ebc4b15)

(Backport to older version 20130503)

Signed-off-by: Alejandro Hernandez 
Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie

bash: Fix-for-CVE-2014-6278

2014-10-12T20:24:36+00:00

This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278

(From OE-Core daisy rev: de596b5f31e837dcd2ce991245eb5548f12d72ae)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-6277

2014-10-12T20:24:36+00:00

Follow up bash42-049 to parse properly function definitions in the
values of environment variables, to not allow remote attackers to
execute arbitrary code or to cause a denial of service.

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277

(From OE-Core daisy rev: 85961bcf81650992259cebb0ef1f1c6cdef3fefa)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-7186 and CVE-2014-7187

2014-10-12T20:24:36+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

(From OE-Core daisy rev: 153d1125659df9e5c09e35a58bd51be184cb13c1)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: Fix for exported function namespace change

2014-10-12T20:24:35+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

This patch changes the encoding bash uses for exported functions to avoid
clashes with shell variables and to avoid depending only on an environment
variable's contents to determine whether or not to interpret it as a shell
function.

(From OE-Core daisy rev: 6c51cc96d03df26d1c10867633e7a10dfbec7c45)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: add missing patch for CVE-2014-7169 to 4.2 recipe

2014-10-02T15:39:35+00:00

The bash_4.2 recipe was missed when the fix was backported to the dora
branch.

Patch from OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc
by Khem Raj 

Signed-off-by: Paul Eggleton 
Signed-off-by: Richard Purdie

bash: add missing patch for CVE-2014-6271 to 4.2 recipe

2014-10-02T15:39:35+00:00

The bash_4.2 recipe was missed when the fix was backported to the dora
branch.

Patch based on the one from OE-Core master rev
798d833c9d4bd9ab287fa86b85b4d5f128170ed3 by Ross Burton
, with the content replaced from the
appropriate upstream patch.

Signed-off-by: Paul Eggleton 
Signed-off-by: Richard Purdie

bash: Fix CVE-2014-7169

2014-10-02T07:03:41+00:00

This is a followup patch to incomplete CVE-2014-6271 fix
code execution via specially-crafted environment

Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed
(From OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc)

Signed-off-by: Khem Raj 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang

bash: fix CVE-2014-6271

2014-10-02T07:03:40+00:00

CVE-2014-6271 aka ShellShock.

"GNU Bash through 4.3 processes trailing strings after function definitions in
the values of environment variables, which allows remote attackers to execute
arbitrary code via a crafted environment."

(From OE-Core master rev: 798d833c9d4bd9ab287fa86b85b4d5f128170ed3)

Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang

lsbtest: fix comparison bashism

2014-03-13T22:38:02+00:00

== is a bashism use = instead.

(Based on OE-Core master rev: c90d1047c41148cbd57f26b5a34563346602a71b)

Signed-off-by: Stefan Stanacar 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie 
Signed-off-by: Paul Eggleton 
Signed-off-by: Richard Purdie