openembedded-core.git/meta/recipes-support, branch jethro

gnutils: Security fix CVE-2016-7444

2016-12-06T13:19:39+00:00

affects gnutls < 3.3.24

Signed-off-by: Armin Kuster

gnupg: fix find-version for beta checking

2016-11-03T17:40:52+00:00

find-version always assumes that gnupg is beta if autogen.sh is run
out of git-repo. This doesn't work for users whom just take release
tarball and re-run autoconf in their local build dir.

This fixes runtime issue:

  $gpg --list-sigs
  gpg: NOTE: THIS IS A DEVELOPMENT VERSION!
  gpg: It is only intended for test purposes and should NOT be
  gpg: used in a production environment or with production keys!

Signed-off-by: Wenzong Fan 
Signed-off-by: Ross Burton

libpcre: Fix CVE-2016-3191

2016-09-23T22:21:43+00:00

Fix workspace overflow for (*ACCEPT) with deeply nested parentheses.

The patch is from libpcre version control at
http://vcs.pcre.org/pcre?view=revision&revision=1631 with the ChangeLog
part removed. Original author is Philip Hazel.

Signed-off-by: Ismo Puustinen 
Signed-off-by: Ross Burton 
(cherry picked from commit 386534f968f4da376ba7778b5d436bad4ce8355b)
Signed-off-by: Armin Kuster

curl: security fix for CVE-2016-5421

2016-09-02T07:48:20+00:00

Affected versions: libcurl 7.32.0 to and including 7.50.0

Signed-off-by: Maxin B. John 
Signed-off-by: Richard Purdie

curl: security fix for CVE-2016-5420

2016-09-02T07:48:20+00:00

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John 
Signed-off-by: Richard Purdie

curl: security fix for CVE-2016-5419

2016-09-02T07:48:20+00:00

Affected versions: libcurl 7.1 to and including 7.50.0

Signed-off-by: Maxin B. John 
Signed-off-by: Richard Purdie

boost: ensure boost to remain an empty metapackage

2016-04-11T21:01:54+00:00

To ensure that boost remains an empty metapackage after version
updates, we explicitly require boost files to be empty. If new
libraries exist after a version update of the boost recipe,
bitbake will emit a warning at the do_package task. For example,
at the version update from 1.58.0 to 1.59.0, the new timer
library is indicated with:

WARNING: QA Issue: boost: Files/directories were installed but not shipped in any package:
  /usr/lib/libboost_timer.so.1.59.0
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
boost: 1 installed and not shipped files. [installed-vs-shipped]

Ross Burton suggested this improvement on the openembedded-core
mailing list during review of the boost recipe version update [1].

[1] http://lists.openembedded.org/pipermail/openembedded-core/2015-December/114314.html

(From OE-Core master rev: c4e33232db2da3594cc4ba38eea56ee1acb54d3a)

Signed-off-by: Lukas Bulwahn 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie

libgcrypt: Security fix CVE-2015-7511

2016-02-21T09:37:22+00:00

CVE-2015-7511 libgcrypt: side-channel attack on ECDH with Weierstrass curves

affects libgcrypt < 1.6.5

Patch 1 is a dependancy patch. simple macro name change.
Patch 2 is the cve fix.

Signed-off-by: Armin Kuster

libbsd: Security fix CVE-2016-2090

2016-02-18T10:57:06+00:00

CVE-2016-2090 Heap buffer overflow in fgetwln function of libbsd

affects libbsd <= 0.8.1 (and therefore not needed in master)

Signed-off-by: Armin Kuster 
Signed-off-by: Joshua Lock 
Signed-off-by: Richard Purdie

curl: Secuirty fix CVE-2016-0755

2016-02-07T22:47:12+00:00

CVE-2016-0755 curl: NTLM credentials not-checked for proxy connection re-use

Signed-off-by: Armin Kuster