Jethro, Fido openssl and libxml security fixes vi git

PATCH In review Armin Kuster 3 participants 3 messages Jan 12, 2016 – Jan 15, 2016

lore

Share & tools

lore

Armin Kuster

author

2016-01-12 23:25 UTC #0 lore raw

cover Jethro, Fido openssl and libxml security fixes vi git

changes in contrib branch for alt integration.

The following changes since commit 0073b234d793099a371b2e529f740987decce756:

yocto-bsp: Typo on the file extension (2016-01-07 12:13:55 +0000)

are available in the git repository at:

git://git.yoctoproject.org/poky-contrib akuster/jethro_sec_fixes
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=akuster/jethro_sec_fixes

Armin Kuster (13):
openssl: fix for CVE-2015-3193
openssl: fix for CVE-2015-3194
openssl: fix for CVE-2015-3195
libxml2: security fix CVE-2015-7941
libxml2: security fix CVE-2015-8317
libxml2: security fix CVE-2015-7942
libxml2: security fix CVE-2015-8035
libxml2: security fix CVE-2015-7498
libxml2: security fix CVE-2015-7497
libxml2: security fix CVE-2015-7499
libxml2: security fix CVE-2015-7500
libxml2: security fix CVE-2015-8242
libxml2: security fix CVE-2015-5312

 .../openssl/0001-Add-test-for-CVE-2015-3194.patch  |  66 ++++++++++
 ...64-mont5.pl-fix-carry-propagating-bug-CVE.patch | 101 +++++++++++++++
 .../CVE-2015-3194-1-Add-PSS-parameter-check.patch  |  45 +++++++
 ...CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch |  66 ++++++++++
 .../recipes-connectivity/openssl/openssl_1.0.2d.bb |   4 +
 meta/recipes-core/libxml/libxml2.inc               |  14 +++
 ...-2015-5312-Another-entity-expansion-issue.patch |  39 ++++++
 ...97-Avoid-an-heap-buffer-overflow-in-xmlDi.patch |  40 ++++++
 ...00-Fix-memory-access-error-due-to-incorre.patch | 131 +++++++++++++++++++
 ...2015-8035-Fix-XZ-compression-support-loop.patch |  38 ++++++
 ...42-Buffer-overead-with-HTML-parser-in-pus.patch |  49 ++++++++
 ...n-name-parsing-at-the-end-of-current-inpu.patch | 138 +++++++++++++++++++++
 ...ssing-entities-after-encoding-conversion-.patch |  89 +++++++++++++
 ...99-1-Add-xmlHaltParser-to-stop-the-parser.patch |  88 +++++++++++++
 ...VE-2015-7499-2-Detect-incoherency-on-GROW.patch |  43 +++++++
 ...top-parsing-on-entities-boundaries-errors.patch |  39 ++++++
 ...leanup-conditional-section-error-handling.patch |  56 +++++++++
 ...ror-in-previous-Conditional-section-patch.patch |  35 ++++++
 ...iation-of-overflow-in-Conditional-section.patch |  39 ++++++
 ...ng-early-on-if-encoding-conversion-failed.patch |  42 +++++++
 20 files changed, 1162 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Add-test-for-CVE-2015-3194.patch
 create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch
 create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2015-3194-1-Add-PSS-parameter-check.patch
 create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-1-Add-xmlHaltParser-to-stop-the-parser.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-2-Detect-incoherency-on-GROW.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-Another-variation-of-overflow-in-Conditional-section.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-8317-Fail-parsing-early-on-if-encoding-conversion-failed.patch

Signature · 1 line

2.3.5

Robert Yang

2016-01-14 06:22 UTC #1 lore raw

Hi RP and Saul,

I've verified that these patches built well on jethro, would you please help to merge them?

git://git.openembedded.org/openembedded-core-contrib rbt/jethro-next

http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=rbt/jethro-next

// Robert

Quoted 66 lines · Armin Kuster

changes in contrib branch for alt integration.
The following changes since commit 0073b234d793099a371b2e529f740987decce756:
   yocto-bsp: Typo on the file extension (2016-01-07 12:13:55 +0000)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib akuster/jethro_sec_fixes
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=akuster/jethro_sec_fixes
Armin Kuster (13):
   openssl: fix for CVE-2015-3193
   openssl: fix for CVE-2015-3194
   openssl: fix for CVE-2015-3195
   libxml2: security fix CVE-2015-7941
   libxml2: security fix CVE-2015-8317
   libxml2: security fix CVE-2015-7942
   libxml2: security fix CVE-2015-8035
   libxml2: security fix CVE-2015-7498
   libxml2: security fix CVE-2015-7497
   libxml2: security fix CVE-2015-7499
   libxml2: security fix CVE-2015-7500
   libxml2: security fix CVE-2015-8242
   libxml2: security fix CVE-2015-5312
  .../openssl/0001-Add-test-for-CVE-2015-3194.patch  |  66 ++++++++++
  ...64-mont5.pl-fix-carry-propagating-bug-CVE.patch | 101 +++++++++++++++
  .../CVE-2015-3194-1-Add-PSS-parameter-check.patch  |  45 +++++++
  ...CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch |  66 ++++++++++
  .../recipes-connectivity/openssl/openssl_1.0.2d.bb |   4 +
  meta/recipes-core/libxml/libxml2.inc               |  14 +++
  ...-2015-5312-Another-entity-expansion-issue.patch |  39 ++++++
  ...97-Avoid-an-heap-buffer-overflow-in-xmlDi.patch |  40 ++++++
  ...00-Fix-memory-access-error-due-to-incorre.patch | 131 +++++++++++++++++++
  ...2015-8035-Fix-XZ-compression-support-loop.patch |  38 ++++++
  ...42-Buffer-overead-with-HTML-parser-in-pus.patch |  49 ++++++++
  ...n-name-parsing-at-the-end-of-current-inpu.patch | 138 +++++++++++++++++++++
  ...ssing-entities-after-encoding-conversion-.patch |  89 +++++++++++++
  ...99-1-Add-xmlHaltParser-to-stop-the-parser.patch |  88 +++++++++++++
  ...VE-2015-7499-2-Detect-incoherency-on-GROW.patch |  43 +++++++
  ...top-parsing-on-entities-boundaries-errors.patch |  39 ++++++
  ...leanup-conditional-section-error-handling.patch |  56 +++++++++
  ...ror-in-previous-Conditional-section-patch.patch |  35 ++++++
  ...iation-of-overflow-in-Conditional-section.patch |  39 ++++++
  ...ng-early-on-if-encoding-conversion-failed.patch |  42 +++++++
  20 files changed, 1162 insertions(+)
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001-Add-test-for-CVE-2015-3194.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2015-3194-1-Add-PSS-parameter-check.patch create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch create mode 100644 meta/recipes-core/libxml/libxml2/0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-1-Add-xmlHaltParser-to-stop-the-parser.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-2-Detect-incoherency-on-GROW.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-Another-variation-of-overflow-in-Conditional-section.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-8317-Fail-parsing-early-on-if-encoding-conversion-failed.patch

Joshua G Lock

2016-01-15 15:18 UTC #2 lore raw

In reply to Armin Kuster

Quoted 9 lines · Armin Kuster

changes in contrib branch for alt integration.
The following changes since commit
0073b234d793099a371b2e529f740987decce756:
yocto-bsp: Typo on the file extension (2016-01-07 12:13:55 +0000)
are available in the git repository at:

Thanks very much for these Armin. I've included them in my joshugal/fido-next branch and intend to submit that for merge soon.

Regards,

Joshua

Quoted 85 lines

git://git.yoctoproject.org/poky-contrib akuster/jethro_sec_fixes
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=akuster/je
thro_sec_fixes
Armin Kuster (13):
openssl: fix for CVE-2015-3193
openssl: fix for CVE-2015-3194
openssl: fix for CVE-2015-3195
libxml2: security fix CVE-2015-7941
libxml2: security fix CVE-2015-8317
libxml2: security fix CVE-2015-7942
libxml2: security fix CVE-2015-8035
libxml2: security fix CVE-2015-7498
libxml2: security fix CVE-2015-7497
libxml2: security fix CVE-2015-7499
libxml2: security fix CVE-2015-7500
libxml2: security fix CVE-2015-8242
libxml2: security fix CVE-2015-5312
.../openssl/0001-Add-test-for-CVE-2015-3194.patch | 66 ++++++++++ ...64-mont5.pl-fix-carry-propagating-bug-CVE.patch | 101
+++++++++++++++
.../CVE-2015-3194-1-Add-PSS-parameter-check.patch | 45 +++++++ ...CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch | 66 ++++++++++ .../recipes-connectivity/openssl/openssl_1.0.2d.bb | 4 + meta/recipes-core/libxml/libxml2.inc | 14 +++
 ...-2015-5312-Another-entity-expansion-issue.patch |  39 ++++++
 ...97-Avoid-an-heap-buffer-overflow-in-xmlDi.patch |  40 ++++++
 ...00-Fix-memory-access-error-due-to-incorre.patch | 131
+++++++++++++++++++
 ...2015-8035-Fix-XZ-compression-support-loop.patch |  38 ++++++
 ...42-Buffer-overead-with-HTML-parser-in-pus.patch |  49 ++++++++
 ...n-name-parsing-at-the-end-of-current-inpu.patch | 138
+++++++++++++++++++++
...ssing-entities-after-encoding-conversion-.patch | 89
+++++++++++++
...99-1-Add-xmlHaltParser-to-stop-the-parser.patch | 88
+++++++++++++
 ...VE-2015-7499-2-Detect-incoherency-on-GROW.patch |  43 +++++++
 ...top-parsing-on-entities-boundaries-errors.patch |  39 ++++++
 ...leanup-conditional-section-error-handling.patch |  56 +++++++++
 ...ror-in-previous-Conditional-section-patch.patch |  35 ++++++
 ...iation-of-overflow-in-Conditional-section.patch |  39 ++++++
 ...ng-early-on-if-encoding-conversion-failed.patch |  42 +++++++
 20 files changed, 1162 insertions(+)
create mode 100644 meta/recipes-connectivity/openssl/openssl/0001- Add-test-for-CVE-2015-3194.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE- 2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE- 2015-3194-1-Add-PSS-parameter-check.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE- 2015-3195-Fix-leak-with-ASN.1-combine.patch
create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015- 5312-Another-entity-expansion-issue.patch
create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015- 7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015- 7500-Fix-memory-access-error-due-to-incorre.patch
create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015- 8035-Fix-XZ-compression-support-loop.patch
create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015- 8242-Buffer-overead-with-HTML-parser-in-pus.patch
create mode 100644 meta/recipes-core/libxml/libxml2/0001-Fix-a-bug- on-name-parsing-at-the-end-of-current-inpu.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7498- Avoid-processing-entities-after-encoding-conversion-.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-1- Add-xmlHaltParser-to-stop-the-parser.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-2- Detect-incoherency-on-GROW.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-1- Stop-parsing-on-entities-boundaries-errors.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-2- Cleanup-conditional-section-error-handling.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-2- Fix-an-error-in-previous-Conditional-section-patch.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942- Another-variation-of-overflow-in-Conditional-section.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-8317- Fail-parsing-early-on-if-encoding-conversion-failed.patch
--
2.3.5