summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* iotop: Drop python-distutils from RDEPENDSMartin Jansa2014-12-261-1/+1
| | | | | | | * nothing in iotop is using that for normal function Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lvm2: add lvm.con to CONFFILESLiu Jian2014-12-261-0/+2
| | | | | | | | | | | | * Files will be over written when updating using rpm. * If there is no %config micro before the file in the spec file, this file will be over-written after updating this package using rpm. This will make our settings lost. Signed-off-by: Jian Liu <jian.liu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* hostapd: several fixes for init scriptJackie Huang2014-12-261-3/+24
| | | | | | | | | | | | | | * restart: The stop may delay a few seconds according to different wireless devices, on debian/ubuntu, the init script directly sleep 8 seconds to wait the stop complete, here we add a delay function (sleep in a loop) to ensure the stop is completed before start. * add status command. * add --oknodo for stop so it will not break restart if there is no running process. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glibmm: add perl to RDEPENDS_{PN}-devAndreas Müller2014-12-261-0/+2
| | | | | | | | QA Issue: glibmm-dev requires /usr/bin/perl, but no providers in its RDEPENDS [file-rdeps] Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* rrdtool: add missing dependency on groff-nativeJackie Huang2014-12-261-1/+1
| | | | | | | | rrdtool needs groff-native to format the documentation. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* rrdtool: inherit cpan-base to help build perl modulesJackie Huang2014-12-261-9/+9
| | | | | | | | | | | | | | It's incorrect to use -I for nativeperl to specify @INC/#include directory to target build perl, which cause error like: | temp/do_configure/run.do_configure.20749: line 112: 20256 Illegal instruction (core dumped) | perl -I/path/to/tmp/sysroots/intel-haswell-64/usr/lib64/perl/$perl_version Makefile.PL Inherit cpan-base and set related env vars to fix this and avoid using sed to hack Makefile when build perl modules. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dfu-util: Point to gitorious.org repository as gnumonks.org is downChris Morgan2014-12-261-3/+6
| | | | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Chris Morgan <chmorgan@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: fix error messages when startup samba serviceChong.Lu@windriver.com2014-12-261-1/+7
| | | | | | | | | | This solves the following error messages when startup samba: Unable to open new log file '/var/log/samba/log.smbd': No such file or directory Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: add winbind.service to winbind packageChong.Lu@windriver.com2014-12-261-0/+1
| | | | | | | | | | | This solves the following warning: lib32-samba-3.6.24: lib32-samba: Files/directories were installed but not shipped /lib/systemd/system/winbind.service [installed-vs-shipped] Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postfix.inc: Remove references to buildmachine paths in target makedefs.outJackie Huang2014-12-261-0/+5
| | | | | | | | | | | | Fixed the buildpaths QA issue: ERROR: QA Issue: File /work/core2-64-wrs-linux/postfix/2.11.1-r0/packages-split/postfix/etc/postfix/makedefs.out in package contained reference to tmpdir [buildpaths] Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* polarssl: add dependency opensslKai Kang2014-12-261-0/+1
| | | | | | | | | | | | | | polarssl compiles with openssl to build unit test cases. If openssl doesn't exist, native libssl.so will be used. Then causes error: | .../bitbake_build/tmp/sysroots/x86_64-linux/usr/lib/libssl.so: error adding symbols: File in wrong format Add dependency openssl for polarssl to fix it. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Mark Hatle <mark.hatle@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* imagemagick: update URI to allow fetching current and previous releasesPeter Bigot2014-12-261-1/+1
| | | | | | | | | The only version available at the original URI is patch 9. All releases are available at the /releases sub-path. Signed-off-by: Peter A. Bigot <pab@pabigot.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* krb5: fix CVE-2014-5351Wenzong Fan2014-12-012-0/+93
| | | | | | | | | | | | | The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authentic- ated users to forge tickets by leveraging administrative access. This back-ported patch fixes CVE-2014-5351. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: update to 1.12.2Armin Kuster2014-12-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The following vulnerabilities have been fixed. * wnpa-sec-2014-20 SigComp UDVM buffer overflow. (Bug 10662) CVE-2014-8710 * wnpa-sec-2014-21 AMQP crash. (Bug 10582) CVE-2014-8711 * wnpa-sec-2014-22 NCP crashes. (Bug 10552, Bug 10628) CVE-2014-8712, CVE-2014-8713 * wnpa-sec-2014-23 TN5250 infinite loops. (Bug 10596) CVE-2014-8714 Reference: https://www.wireshark.org/docs/relnotes/wireshark-1.12.2.html Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* syslog-ng: Fix memory leak when udp connection is used [ LIN7-1379 ]Xufeng Zhang2014-12-015-48/+136
| | | | | | | | | | When udp connection is used, there are several memory leaks happen after run a long time. Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gvfs: replace deprecated g_memmove by memmoveAndreas Müller2014-12-012-0/+37
| | | | | | | | | | | * g_memmove was deprecated ib glib-2.0 2.40 * opening a remote connection created by gigolo with thunar failed with: | thunar: symbol lookup error: /usr/lib/modules/libgvfsdbus.so: undefined symbol: g_memmove * further tests showed that browsing in windows networks is fixed now Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xfce4-weather-plugin: make work properly after met.no API changeAndreas Müller2014-12-013-0/+193
| | | | | | | | | | see [1] for more information https://bugzilla.xfce.org/show_bug.cgi?id=10916 Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libyaml: add fix for CVE-2014-2525 Security AdvisoryKang Kai2014-12-012-1/+45
| | | | | | | | | | | | | | Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2525 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: add fix for CVE-2014-0065 and CVE-2014-0066 Security AdvisoryKang Kai2014-12-012-0/+394
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity identified a number of places in which it couldn't prove that a string being copied into a fixed-size buffer would fit. We believe that most, perhaps all of these are in fact safe, or are copying data that is coming from a trusted source so that any overrun is not really a security issue. Nonetheless it seems prudent to forestall any risk by using strlcpy() and similar functions. Fixes by Peter Eisentraut and Jozef Mlich based on Coverity reports. In addition, fix a potential null-pointer-dereference crash in contrib/chkpass. The crypt(3) function is defined to return NULL on failure, but chkpass.c didn't check for that before using the result. The main practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., "FIPS mode"). This ideally should've been a separate commit, but since it touches code adjacent to one of the buffer overrun changes, I included it in this commit to avoid last-minute merge issues. This issue was reported by Honza Horak. Security: CVE-2014-0065 for buffer overruns, CVE-2014-0066 for crypt() https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0065 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0066 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: add fix for CVE-2014-0067 Security AdvisoryKang Kai2014-12-012-0/+76
| | | | | | | | | | | | | | | The make check command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0067 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: add fix for CVE-2014-0063 Security AdvisoryKang Kai2014-12-012-0/+466
| | | | | | | | | | | | | | | | | Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0063 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: add fix for CVE-2014-0062 Security AdvisoryKang Kai2014-12-012-0/+1083
| | | | | | | | | | | | | | | | Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0062 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: add fix for CVE-2014-0061 Security AdvisoryKang Kai2014-12-012-0/+268
| | | | | | | | | | | | | | | The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0061 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: add fix for CVE-2014-0060 Security AdvisoryKang Kai2014-12-012-0/+274
| | | | | | | | | | | | | | | PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0060 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: add fix for CVE-2014-0064 Security AdvisoryKang Kai2014-12-012-2/+608
| | | | | | | | | | | | | | | | Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0064 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* net-snmp: fix for Security Advisory - CVE-2014-3565Roy Li2014-12-012-0/+456
| | | | | | | | | | | | | | snmplib/mib.c in net-snmp 5.7.0 and earlier, when the -OQ option is used, allows remote attackers to cause a denial of service (snmptrapd crash) via a crafted SNMP trap message, which triggers a conversion to the variable type designated in the MIB file, as demonstrated by a NULL type in an ifMtu trap message. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3565 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* phpmyadmin: fix for Security Advisory CVE-2014-5274Roy Li2014-12-012-0/+44
| | | | | | | | | | | | Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5274 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* phpmyadmin: fix for Security Advisory CVE-2014-5273Roy Li2014-12-012-0/+30
| | | | | | | | | | | | | | | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5273 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openvpn: bypass check for /sbin/ip on the hostBen Shelton2014-12-012-1/+292
| | | | | | | | | | | | | In the commit 'openvpn: use default iproute2 path', the configure flag to explicitly set the iproute2 path was removed, since busybox now provides the 'ip' applet at the default path. However, setting this flag is necessary to bypass the configure-time check for /sbin/ip on the host, which will otherwise fail if iproute2 is not installed on the host. Add back the flag (pointing to the correct path), and add a comment to describe why this is necessary. Signed-off-by: Ben Shelton <ben.shelton@ni.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* openvpn: bypass check for /sbin/ip on the hostBen Shelton2014-10-301-0/+3
| | | | | | | | | | | | | In the commit 'openvpn: use default iproute2 path', the configure flag to explicitly set the iproute2 path was removed, since busybox now provides the 'ip' applet at the default path. However, setting this flag is necessary to bypass the configure-time check for /sbin/ip on the host, which will otherwise fail if iproute2 is not installed on the host. Add back the flag (pointing to the correct path), and add a comment to describe why this is necessary. Signed-off-by: Ben Shelton <ben.shelton@ni.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* update maintainer info in README's for dizzyArmin Kuster2014-10-3016-56/+144
| | | | | | | | * This is the first time meta-python is being taged with a release Acked-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* vlc/libdvdcss: Upgrade to 1.3.0MiLo2014-10-301-2/+2
| | | | | | | Tested and in use for a while in OpenPLi. Signed-off-by: Mike Looijmans <milo-software@users.sourceforge.net> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* inetutils: inherit texinfoRoy.Li2014-10-301-1/+1
| | | | | | | inherit texinfo to use native command instead of host command Signed-off-by: Roy.Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* syslog-ng: add gawk to RDEPENDSChong.Lu@windriver.com2014-10-301-0/+1
| | | | | | | | | | This solves the following warning: syslog-ng-3.5.4.1: syslog-ng requires /usr/bin/awk, but no providers in its RDEPENDS [file-rdeps] Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* libhugetlbfs: add bash and perl to RDEPENDSChong.Lu@windriver.com2014-10-301-1/+2
| | | | | | | | | | | | This solves the following warning: libhugetlbfs-2.18: libhugetlbfs-tests requires /bin/bash, but no providers in its RDEPENDS [file-rdeps] libhugetlbfs-2.18: libhugetlbfs requires /bin/bash, /usr/bin/perl, but no providers in its RDEPENDS [file-rdeps] Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* sharutils: Add new packageHongjun.Yang2014-10-302-0/+47
| | | | | Signed-off-by: Hongjun.Yang <hongjun.yang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* audiofile: Use gnome mirrors for SRC_URIKhem Raj2014-10-301-1/+1
| | | | | | | original uri seems to be down now Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* mpd: upgrade to 0.19.1Cristian Iorga2014-10-301-5/+4
| | | | | | | | - Added icu and boost as dependencies; Signed-off-by: Cristian Iorga <ubik3000@gmail.com> Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* mpg123: upgrade to 1.21.0Cristian Iorga2014-10-301-2/+2
| | | | | Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* mpd: fix fetch failure for 0.18.xCristian Iorga2014-10-301-1/+1
| | | | | | | | | | | MPD stable download location will contain only the latest stable branch, so fetch will not work in case of an older OE recipe. i.e., mpd 0.18.x recipe will no longer work after 0.19 branch is released (as it is the case now). Signed-off-by: Cristian Iorga <ubik3000@gmail.com> Signed-off-by: Cristian Iorga <cristian.iorga@intel.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp: Security Advisory - php - CVE-2014-3597Yue Tao2014-10-302-0/+283
| | | | | | | | | | | | | | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3597 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp: Security Advisory - php - CVE-2014-3587Yue Tao2014-10-302-0/+32
| | | | | | | | | | | | | Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3587 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp: Security Advisory - php - CVE-2014-5120Yue Tao2014-10-302-0/+36
| | | | | | | | | | | | | gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5120 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* squid: Add a PACKAGECONFIG for libnetfilter-conntrackChong.Lu@windriver.com2014-10-301-0/+2
| | | | | | | | | | This solves the following warning: WARNING: QA Issue: squid rdepends on libnetfilter-conntrack, but it isn't a build dependency? [build-deps] Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* tcpdump: Add ptestHongjun.Yang2014-10-303-1/+50
| | | | | | | Add ptest supports for tcpdump Signed-off-by: Hongjun.Yang <hongjun.yang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* ruby-lang.org changed the subdomain/hostname of their download server.Chad Nelson2014-10-301-1/+1
| | | | | Signed-off-by: Chad Nelson <cnelson@agleader.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* libtinyxml2: new packageA. Varnin2014-10-271-0/+38
| | | | | | | TinyXML-2 is a rewrite of TinyXML-1. It provides some advantages over the original. They are covered on the homepage. (http://www.grinninglizard.com/tinyxml2/) Signed-off-by: A. Varnin <fenixk19@mail.ru> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* toybox: Upgrade to v0.5.0Paul Barker2014-10-272-16/+34
| | | | | | | The patch applied to toybox is rebased onto the new release and updated. Signed-off-by: Paul Barker <paul@paulbarker.me.uk> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* vim: Upgrade to v7.4.481Paul Barker2014-10-271-1/+1
| | | | | Signed-off-by: Paul Barker <paul@paulbarker.me.uk> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* modphp, xdebug: blacklist because of conflict with phpMartin Jansa2014-10-272-0/+4
| | | | Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 20:48:51 +0000