openembedded-core.git/meta/recipes-graphics, branch morty Mirror of openembedded-core libx11: CVE-2016-7943 2017-02-08T12:00:01+00:00 Sona Sarmadi sona.sarmadi@enea.com 2017-01-30T11:46:23+00:00 d627e5bd50f66275cb3a77036ea3376a6f1e9a96 The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7943 https://lists.x.org/archives/xorg-announce/2016-October/002720.html Upstream patch: https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> 
The XListFonts function in X.org libX11 before 1.6.4 might allow
remote X servers to gain privileges via vectors involving length
fields, which trigger out-of-bounds write operations.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7943
https://lists.x.org/archives/xorg-announce/2016-October/002720.html

Upstream patch:
https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
libX11: CVE-2016-7942 2017-02-08T12:00:00+00:00 Sona Sarmadi sona.sarmadi@enea.com 2017-01-30T11:46:22+00:00 6d4421301a54c26e390fa943805574ced6e18c3a The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations. References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7942 Upstream patch https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> 
The XGetImage function in X.org libX11 before 1.6.4 might allow remote X
servers to gain privileges via vectors involving image type and geometry,
which triggers out-of-bounds read operations.

References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7942
Upstream patch
https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
libXrandr: fix for CVE-2016-7947 and CVE-2016-7948 2017-02-08T12:00:00+00:00 Sona Sarmadi sona.sarmadi@enea.com 2017-01-27T11:59:35+00:00 1c293e889f6eeae36f8f6ddd9676c65d613ad0fc CVE-2016-7947 Insufficient validation of server responses result in Integer overflows CVE-2016-7948 Insufficient validation of server responses result in various data mishandlings References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948 https://lists.x.org/archives/xorg-announce/2016-October/002720.html Upstream patch for both CVEs: https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> 
CVE-2016-7947
Insufficient validation of server responses result in Integer overflows

CVE-2016-7948
Insufficient validation of server responses result in various data mishandlings

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948
https://lists.x.org/archives/xorg-announce/2016-October/002720.html

Upstream patch for both CVEs:
https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
libxrender: CVE-2016-7949 2017-02-08T11:59:59+00:00 Sona Sarmadi sona.sarmadi@enea.com 2017-01-27T07:26:12+00:00 87ffd7ce2e8ece8b44ff3f1c219a74b3590cf14b Insufficient validation of server responses results in overflow of previously reserved memory Upstream patch: https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4 External References: https://lists.x.org/archives/xorg-announce/2016-October/002720.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7949 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> 
Insufficient validation of server responses results
in overflow of previously reserved memory

Upstream patch:
https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4

External References:
https://lists.x.org/archives/xorg-announce/2016-October/002720.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7949

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
libxtst: 1.2.2 -> 1.2.3 2017-02-03T09:51:17+00:00 Sona Sarmadi sona.sarmadi@enea.com 2017-01-10T11:10:51+00:00 02a0dd90c3f3b1fc6ebddc17feb824d11848b2a7 Upgrade libxtst from 1.2.2 to 1.2.3 to address: Out of Bounds Write Denial of Service Vulnerability, CVE-2016-7951 References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7951 https://cgit.freedesktop.org/xorg/lib/libXtst/commit/?id=9556ad67af3129ec4a7a4f4b54a0d59701beeae3 Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> 
Upgrade libxtst from 1.2.2 to 1.2.3 to address:
Out of Bounds Write Denial of Service Vulnerability, CVE-2016-7951

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7951
https://cgit.freedesktop.org/xorg/lib/libXtst/commit/?id=9556ad67af3129ec4a7a4f4b54a0d59701beeae3

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
mesa: make sure GLES3 headers are installed 2017-01-11T11:46:43+00:00 Samuli Piippo samuli.piippo@qt.io 2016-11-23T14:36:37+00:00 fd02a12e875a900e46f50d92772098298ed4bc73 Since there is no libgles3-mesa package that would pull in the headers, add dependency to libgles2-mesa-dev. Now there no need to manually add GLES3 headers to image or toolchain. (From OE-Core rev: a93bbfa096cd7de8e935c6c2d2ad98d72a1c297f) Signed-off-by: Samuli Piippo <samuli.piippo@qt.io> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> 
Since there is no libgles3-mesa package that would pull in the headers,
add dependency to libgles2-mesa-dev. Now there no need to manually add
GLES3 headers to image or toolchain.

(From OE-Core rev: a93bbfa096cd7de8e935c6c2d2ad98d72a1c297f)

Signed-off-by: Samuli Piippo <samuli.piippo@qt.io>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
weston: Add no-input-device patch to 1.11.0. 2017-01-11T11:46:38+00:00 Daniel Díaz daniel.diaz@linaro.org 2016-11-24T22:09:31+00:00 8fa5e442d16b1d04066b51b9fd56be41ae67d2d5 The included patch, backported from Weston master (and OE-Core master since Weston 1.11.1, b6864b1), allows it to run without any input device at launch. An ini option is introduced for this purpose, so there is no behavioral change. Related change in weston.ini: [core] require-input=true Default is true; setting it false allows Weston to run without a keyboard or mouse, which is handy for automated environments. Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> 
The included patch, backported from Weston master (and OE-Core
master since Weston 1.11.1, b6864b1), allows it to run without
any input device at launch. An ini option is introduced for
this purpose, so there is no behavioral change.

Related change in weston.ini:
  [core]
  require-input=true

Default is true; setting it false allows Weston to run
without a keyboard or mouse, which is handy for automated
environments.

Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
libxcb: use python3 to build it 2016-10-15T08:55:03+00:00 Robert Yang liezhi.yang@windriver.com 2016-10-11T10:16:40+00:00 c488656825accf4543754cb712256a775d5a92e7 Backport Fix-inconsistent-use-of-tabs-vs.-space.patch to make it can be built by python3. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
Backport Fix-inconsistent-use-of-tabs-vs.-space.patch to make it can be
built by python3.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
xcb-proto: fix for python3 2016-10-15T08:54:41+00:00 Robert Yang liezhi.yang@windriver.com 2016-10-12T02:48:12+00:00 647ff3bed1823b53a41a5c2640ffc5f4d50d1e11 Backport two patches to make it py3 friendly. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
Backport two patches to make it py3 friendly.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
xcb-proto: create .pyc files for python2 2016-10-15T08:54:24+00:00 Robert Yang liezhi.yang@windriver.com 2016-09-22T09:36:55+00:00 3007f8b365270c35fdb1829d83affd98d8d5475a Its Makefile's do_install creates .pyc files for python3, now also create them for python2 so that they will be recorded by manifest, and can be cleaned correctly. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> 
Its Makefile's do_install creates .pyc files for python3, now also
create them for python2 so that they will be recorded by manifest, and
can be cleaned correctly.

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>