openembedded-core.git/meta/recipes-support, branch dizzy

libtasn1: CVE-2015-3622

2016-01-30T12:01:40+00:00

_asn1_extract_der_octet: prevent past of boundary access

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3622
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=patch;
h=f979435823a02f842c41d49cd41cc81f25b5d677

Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

icu: CVE-2014-8146-CVE-2014-8147

2015-09-19T10:52:55+00:00

CVE-2014-8146 icu: heap overflow via incorrect isolateCount
CVE-2014-8147 icu: integer truncation in the resolveImplicitLevels function

References:
[1] https://github.com/pedrib/PoC/raw/master/generic/i-c-u-fail.7z
[2] https://www.kb.cert.org/vuls/id/602540
[3] http://bugs.icu-project.org/trac/changeset/37080
[4] http://bugs.icu-project.org/trac/changeset/37162

Signed-off-by: Sona Sarmadi 
Signed-off-by: Armin Kuster

gnutls: CVE-2015-3308

2015-09-19T10:52:50+00:00

Signed-off-by: Armin Kuster

gpgme: fix CVE-2014-3564

2015-07-20T19:53:07+00:00

Backport patch to fix CVE-2014-3564.

http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=commit;h=2cbd76f

(From OE-Core rev: 421e21b08a6a32db88aaf46033ca503a99e49b74)

Signed-off-by: Kai Kang 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 

Conflicts:
	meta/recipes-support/gpgme/gpgme_1.4.3.bb

curl: add a few missing security fixes

2015-07-20T19:53:05+00:00

CVE-2014-3707
CVE-2014-8150
CVE-2015-3153

not affected by:  CVE-2014-8151

Signed-off-by: Armin Kuster

curl: several security fixes

2015-07-20T19:53:05+00:00

Fixes below listed bugs:
1. CVE-2015-3143
2. CVE-2015-3144
3. CVE-2015-3145

Dropped: 4. CVE-2015-3148
SPNEGO was introduced in 7.39 so this version not affected

Signed-off-by: Maxin B. John 
Signed-off-by: Armin Kuster

libunwind: backport patch to link against libgcc_s intead of libgcc

2015-04-17T21:38:34+00:00

Signed-off-by: Jonathan Liu 
Signed-off-by: Armin Kuster

serf: fix 'ccache' builds

2015-04-17T21:38:33+00:00

'scons' cleans the environment which breaks ccache builds because
CCACHEDIR can point to an unexpected location:

| ccache arm-linux-gnueabi-gcc ... context.c
| ccache: failed to create .../serf/1.3.8-r0/.home/.ccache (No such file or directory)

Issue is described in

  http://www.scons.org/wiki/ImportingEnvironmentSettings

and because 'bitbake' cleans environment we can pass it completely
instead of trying to enumerate needed env.

With the 'env.patch' the FULLCC variable is not needed anymore (which
would break when CC is 'ccache arm-...-gcc' and host ccache is used)
because the correct $PATH is available during scons build:

| sh: .../sysroots/x86_64-oe-linux/usr/bin/arm-linux-gnueabi/ccache: No such file or directory
| scons: *** [context.o] Error 127

Signed-off-by: Enrico Scholz 
Signed-off-by: Ross Burton 
Signed-off-by: Armin Kuster

liburcu: revert ARM GCC blacklist commit

2015-03-27T17:59:25+00:00

This fixes the following error when building liburcu:
"Your gcc version produces clobbered frame accesses"

OE-Core is using a patched GCC 4.8.2 which is able to compile liburcu
properly.

Signed-off-by: Jonathan Liu 
Signed-off-by: Richard Purdie

boost: Avoid to use local host configuration

2015-02-11T17:39:50+00:00

(From OE-Core rev: 6586aeb3e26d58322c169dfef0228a425fe5d3fa)

Signed-off-by: Fabien Proriol 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster