openembedded-core.git/meta/recipes-support, branch daisy

curl: Security Advisory - curl - CVE-2014-3620

2014-11-05T23:27:02+00:00

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus
making them apply broader than cookies are allowed. This can allow arbitrary
sites to set cookies that then would get sent to a different and unrelated site
or domain.

(From OE-Core rev: ddbaade8afbc9767583728bfdc220639203d6853)

Signed-off-by: Chong Lu 
Signed-off-by: Richard Purdie

curl: Security Advisory - curl - CVE-2014-3613

2014-11-05T23:26:57+00:00

By not detecting and rejecting domain names for partial literal IP addresses
properly when parsing received HTTP cookies, libcurl can be fooled to both
sending cookies to wrong sites and into allowing arbitrary sites to set cookies
for others.

(From OE-Core rev: 985ef933208da1dd1f17645613ce08e6ad27e2c1)

Signed-off-by: Chong Lu 
Signed-off-by: Richard Purdie 

Conflicts:
	meta/recipes-support/curl/curl_7.35.0.bb

gnupg: CVE-2013-4242

2014-10-23T20:42:03+00:00

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x
and possibly other products, allows local users to obtain private RSA
keys via a cache side-channel attack involving the L3 cache, aka
Flush+Reload.

Patch from commit e2202ff2b704623efc6277fb5256e4e15bac5676 in
git://git.gnupg.org/libgcrypt.git

Signed-off-by: Yong Zhang 
Signed-off-by: Kai Kang

nspr: Fix for CVE-2014-1545

2014-10-10T14:05:51+00:00

Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote
attackers to execute arbitrary code or cause a denial of service
(out-of-bounds write) via vectors involving the sprintf and console
functions.Per: http://cwe.mitre.org/data/definitions/787.html

(From OE-Core rev: 191cab2f679491c2b6ddba49c5cf4886dcd22f57)

Signed-off-by: Xufeng Zhang 
Signed-off-by: Jackie Huang 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie

nss: CVE-2014-1544

2014-10-10T14:05:51+00:00

the patch comes from:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-1544
https://hg.mozilla.org/projects/nss/rev/204f22c527f8

author  Robert Relyea 
https://bugzilla.mozilla.org/show_bug.cgi?id=963150
Bug 963150: Add nssCertificate_AddRef and nssCertificate_Destroy calls
to PK11_ImportCert to prevent nssTrustDomain_AddCertsToCache from
freeing the CERTCertificate associated with the NSSCertificate. r=wtc.

(From OE-Core rev: 7ef613c7f4b9e4ff153766f31dae81fc4810c0df)

Signed-off-by: Li Wang 
Signed-off-by: Richard Purdie

nss-3.15.1: fix CVE-2013-1739

2014-09-29T10:51:26+00:00

Mozilla Network Security Services (NSS) before 3.15.2 does
not ensure that data structures are initialized before
read operations, which allows remote attackers to cause a
denial of service or possibly have unspecified other
impact via vectors that trigger a decryption failure.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1739
(From OE-Core rev: 9b43af77d112e75fa9827a9080b7e94f41f9a116)

Signed-off-by: yzhu1 
Signed-off-by: Jackie Huang 
Signed-off-by: Richard Purdie 

Conflicts:
	meta/recipes-support/nss/nss.inc

nss: CVE-2013-5606

2014-09-29T10:51:25+00:00

the patch comes from:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5606
https://bugzilla.mozilla.org/show_bug.cgi?id=910438
http://hg.mozilla.org/projects/nss/rev/d29898e0981c

The CERT_VerifyCert function in lib/certhigh/certvfy.c in
Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides
an unexpected return value for an incompatible key-usage certificate
when the CERTVerifyLog argument is valid, which might allow remote
attackers to bypass intended access restrictions via a crafted certificate.

(From OE-Core rev: 1e153b1b21276d56144add464d592cd7b96a4ede)

Signed-off-by: Li Wang 
Signed-off-by: Jackie Huang 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie 

Conflicts:
	meta/recipes-support/nss/nss.inc

libfm: Ensure m4 directory exists

2014-06-10T16:10:33+00:00

configure.ac references the m4 directory so things like gtkdocize
will try and place m4 files there. We need to ensure the directory
exists or the builds can fail.

(From OE-Core rev: 0ced649c055dd25c500d0fd34e4ea94504d98580)

Signed-off-by: Richard Purdie

gnutls: patch for CVE-2014-3466 backported

2014-06-06T09:26:56+00:00

Backported patch for CVE-2014-3466.
This patch is for daisy.

Signed-off-by: Valentin Popa 
Signed-off-by: Richard Purdie

nss: CVE-2013-1740

2014-05-29T12:42:11+00:00

the patch comes from:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1740
https://bugzilla.mozilla.org/show_bug.cgi?id=919877
https://bugzilla.mozilla.org/show_bug.cgi?id=713933

changeset:   10946:f28426e944ae
user:        Wan-Teh Chang 
date:        Tue Nov 26 16:44:39 2013 -0800
summary:     Bug 713933: Handle the return value of both ssl3_HandleRecord calls

changeset:   10945:774c7dec7565
user:        Wan-Teh Chang 
date:        Mon Nov 25 19:16:23 2013 -0800
summary:     Bug 713933: Declare the |falseStart| local variable in the smallest

changeset:   10848:141fae8fb2e8
user:        Wan-Teh Chang 
date:        Mon Sep 23 11:25:41 2013 -0700
summary:     Bug 681839: Allow SSL_HandshakeNegotiatedExtension to be called before the handshake is finished, r=brian@briansmith.org

changeset:   10898:1b9c43d28713
user:        Brian Smith 
date:        Thu Oct 31 15:40:42 2013 -0700
summary:     Bug 713933: Make SSL False Start work with asynchronous certificate validation, r=wtc

(From OE-Core rev: 11e728e64e37eec72ed0cb3fb4d5a49ddeb88666)

Signed-off-by: Li Wang 
Signed-off-by: Roy Li 
Signed-off-by: Saul Wold 
Signed-off-by: Richard Purdie