openembedded-core.git/meta/recipes-support, branch fido

nettle: The variable named p in the patch file was incorrectly named.

2016-03-11T10:03:50+00:00

The variable in question should have been called ecc->p. The patch has been
updated so that the compilation of the nettle recipe would complete
successfully. The backport originated from this commit

https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d

Signed-off-by: ngutzmann 
Signed-off-by: Joshua Lock

nettle: Security fix CVE-2015-8804

2016-02-29T15:05:16+00:00

(From OE-Core master rev: 7474c7dbf98c1a068bfd9b14627b604da5d79b67)

minor tweak to get x86_64/ecc-384-modp.asm to apply

Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

nettle: Security fix CVE-2015-8803 and CVE-2015-8805

2016-02-29T15:05:16+00:00

(From OE-Core master rev: f62eb452244c3124cc88ef01c14116dac43f377a)

hand applied changes for ecc-256.c

Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

curl: Secuirty fix CVE-2016-0755

2016-02-29T15:05:16+00:00

CVE-2016-0755 curl: NTLM credentials not-checked for proxy connection re-use

(From OE-Core master rev: 8322814c7f657f572d5c986652e708d6bd774378)

hand applied changed to url.c

Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

curl: Security fix CVE-2016-0754

2016-02-29T15:05:16+00:00

CVE-2016-0754 curl: remote file name path traversal in curl tool for Windows

(From OE-Core master rev: b2c9b48dea2fd968c307a809ff95f2e686435222)

minor tweak to tool_operate.c to get it to apply

Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

libgcrypt: Security fix CVE-2015-7511

2016-02-29T15:05:16+00:00

CVE-2015-7511 libgcrypt: side-channel attack on ECDH with Weierstrass curves

affects libgcrypt < 1.6.5

adjust SRC_URI + for this version.

Patch 1 is a dependancy patch. simple macro name change.
Patch 2 is the cve fix.

(From OE-Core master rev: c691ce99bd2d249d6fdc4ad58300719488fea12c)

Signed-off-by: Armin Kuster 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

libbsd: Security fix CVE-2016-2090

2016-02-18T10:54:22+00:00

CVE-2016-2090 Heap buffer overflow in fgetwln function of libbsd

affects libbsd <= 0.8.1 (and therefore not needed in master)

Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock

libpcre: Security fixes and package update.

2016-02-16T14:02:36+00:00

this is related to [Yocto # 9008]

8.38:
The following security fixes are included:
CVE-2015-3210 pcre: heap buffer overflow in pcre_compile2()  compile_regex()
CVE-2015-3217 pcre: stack overflow in match()
CVE-2015-5073 CVE-2015-8388 pcre: Buffer overflow caused by certain patterns with an unmatched closing parenthesis
CVE-2015-8380 pcre: Heap-based buffer overflow in pcre_exec
CVE-2015-8381 pcre: Heap Overflow in compile_regex()
CVE-2015-8383 pcre: Buffer overflow caused by repeated conditional group
CVE-2015-8384 pcre: Buffer overflow caused by recursive back reference by name within certain group
CVE-2015-8385 pcre: Buffer overflow caused by forward reference by name to certain group
CVE-2015-8386 pcre: Buffer overflow caused by lookbehind assertion
CVE-2015-8387 pcre: Integer overflow in subroutine calls
CVE-2015-8389 pcre: Infinite recursion in JIT compiler when processing certain patterns
CVE-2015-8390 pcre: Reading from uninitialized memory when processing certain patterns
CVE-2015-8392 pcre: Buffer overflow caused by certain patterns with duplicated named groups
CVE-2015-8393 pcre: Information leak when running pcgrep -q on crafted binary
CVE-2015-8394 pcre: Integer overflow caused by missing check for certain conditions
CVE-2015-8395 pcre: Buffer overflow caused by certain references
CVE-2016-1283 pcre: Heap buffer overflow in pcre_compile2 causes DoS

8.37:
The following security fixes are included:
CVE-2014-8964 pcre: incorrect handling of zero-repeat assertion conditions
CVE-2015-2325 pcre: heap buffer overflow in compile_branch()
CVE-2015-2326 pcre: heap buffer overflow in pcre_compile2()

LICENSE file changed do to Copyright date updates.

Signed-off-by: Armin Kuster 

Jethro and master don't require this patch as they have newer libpcre which
contains these fixes.

Signed-off-by: Joshua Lock

libiconv_1.11.1: fix LICENSE declaration, LGPL -> LGPLv2.0

2015-11-05T22:04:15+00:00

Signed-off-by: Andre McCurdy 
Signed-off-by: Richard Purdie 

(From OE-Core master rev: 7d2da0e)

Signed-off-by: Joshua Lock

libiconv_1.11.1: merge build and packaging fixes from libiconv_1.14

2015-11-05T22:04:15+00:00

  054151c libiconv: Fix B != S with uclibc builds
  273c437 libiconv: Remove RPATH from binaries
  fcb8d6f libiconv_1.14.bb: Fix build failure [partial-merge]

Signed-off-by: Andre McCurdy 
Signed-off-by: Richard Purdie 

(From OE-Core master rev: 898e9d7)

Signed-off-by: Joshua Lock