openembedded-core.git/meta/recipes-extended, branch dylan

bash: Fix-for-CVE-2014-6278

2014-10-12T20:29:14+00:00

This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278

(From OE-Core daisy rev: de596b5f31e837dcd2ce991245eb5548f12d72ae)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-6277

2014-10-12T20:29:14+00:00

Follow up bash42-049 to parse properly function definitions in the
values of environment variables, to not allow remote attackers to
execute arbitrary code or to cause a denial of service.

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277

(From OE-Core daisy rev: 85961bcf81650992259cebb0ef1f1c6cdef3fefa)

Signed-off-by: Catalin Popeanga 
Signed-off-by: Paul Eggleton

bash: Fix for CVE-2014-7186 and CVE-2014-7187

2014-10-12T20:29:14+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

(From OE-Core daisy rev: 153d1125659df9e5c09e35a58bd51be184cb13c1)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: Fix for exported function namespace change

2014-10-12T20:29:14+00:00

This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment

This patch changes the encoding bash uses for exported functions to avoid
clashes with shell variables and to avoid depending only on an environment
variable's contents to determine whether or not to interpret it as a shell
function.

(From OE-Core daisy rev: 6c51cc96d03df26d1c10867633e7a10dfbec7c45)

Signed-off-by: Sona Sarmadi 
Signed-off-by: Paul Eggleton

bash: Fix CVE-2014-7169

2014-10-12T20:29:14+00:00

This is a followup patch to incomplete CVE-2014-6271 fix
code execution via specially-crafted environment

Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed
(From OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc)

Signed-off-by: Khem Raj 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang 
Signed-off-by: Paul Eggleton

bash: fix CVE-2014-6271

2014-10-12T20:29:14+00:00

CVE-2014-6271 aka ShellShock.

"GNU Bash through 4.3 processes trailing strings after function definitions in
the values of environment variables, which allows remote attackers to execute
arbitrary code via a crafted environment."

(From OE-Core master rev: 798d833c9d4bd9ab287fa86b85b4d5f128170ed3)

Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang 
Signed-off-by: Paul Eggleton

lsbtest: fix comparison bashism

2014-03-12T19:00:34+00:00

== is a bashism use = instead.

(Based on OE-Core master rev: c90d1047c41148cbd57f26b5a34563346602a71b)

Signed-off-by: Stefan Stanacar 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie 
Signed-off-by: Paul Eggleton

grep: Add patch for texinfo 5.1

2014-01-21T21:55:48+00:00

(From OE-Core master rev: bc6258f88705b0e7989089a8666ac5e5d2355823)

Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

findutils_4.2.31: backport fixes for doc build errors

2013-10-10T11:21:01+00:00

[YOCTO #5212]

(From OE-Core rev: cb41aff1ac343b4fa8b4c9d43cc38652f7593ee6)

Signed-off-by: Jackie Huang 
Signed-off-by: Richard Purdie

mc: Don't remove libdir and split helpers into packages

2013-10-10T11:20:59+00:00

It contains helper programs that are needed to make mc do the right actions
for the various file formats it understands.

The helpers are perl, python and shell scripts, split them out so the core
mc does not try to pull in perl and python, it will still run without these
helpers.

[YOCTO #4432]

(From OE-Core rev: 6d0205576ef1e8a62c469b883dc0c962440469a7)

Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie