sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity
generic-poky/meta/recipes-devtools
History
Daniel BORNAZ da75a9aaf0 python: fix _json module arbitrary process memory read vulnerability 
http://bugs.python.org/issue21529

Python 2 and 3 are susceptible to arbitrary process memory reading by
a user or adversary due to a bug in the _json module caused by
insufficient bounds checking.

The sole prerequisites of this attack are that the attacker is able to
control or influence the two parameters of the default scanstring
function: the string to be decoded and the index.

The bug is caused by allowing the user to supply a negative index
value. The index value is then used directly as an index to an array
in the C code; internally the address of the array and its index are
added to each other in order to yield the address of the value that is
desired. However, by supplying a negative index value and adding this
to the address of the array, the processor's register value wraps
around and the calculated value will point to a position in memory
which isn't within the bounds of the supplied string, causing the
function to access other parts of the process memory.

(From OE-Core rev: 9ec213bf67afbdfdbe25802ec86487bb22aeb2e4)

Signed-off-by: Benjamin Peterson <benjamin@python.org>

Applied to python-native recipe in order to fix the above mentioned
vulnerability.

Upstream-Status: Submitted

Signed-off-by: Daniel BORNAZ <daniel.bornaz@enea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 		2014-07-25 15:34:01 +01:00
..
apt apt/package_mamager: Ensure WORKDIR is used for lists directory 2014-03-27 09:42:06 +00:00
autoconf autoconf: don't disable the autoheader warnings 2014-06-06 09:26:39 +01:00
autogen autogen-native: upgrade from 2.18.2 to 2.18.3 2014-06-06 10:24:07 +01:00
automake Add texinfo.bbclass; recipes that use texinfo utils at build-time inherit it. 2014-05-02 20:46:59 +01:00
binutils binutils-cross-canadian: Explicitly DEPEND on nativesdk-flex, we require it anyway 2014-07-25 15:33:58 +01:00
bison Add texinfo.bbclass; recipes that use texinfo utils at build-time inherit it. 2014-05-02 20:46:59 +01:00
btrfs-tools btrfs-tools: Upgrade 3.12 -> 3.14.2 2014-07-17 12:28:50 +01:00
ccache ccache: update to upstream version 3.1.9 2013-08-26 11:47:19 +01:00
cdrtools cdrtools-native: upgrade to 3.01a20 2014-01-14 11:33:52 +00:00
chrpath chrpath: upgrade to 0.16 2014-03-02 17:25:28 +00:00
cmake cmake: Avoid accidentally including libacl.h 2014-05-28 08:19:30 +01:00
desktop-file-utils Replace one-line DESCRIPTION with SUMMARY 2014-01-02 12:50:18 +00:00
devel-config recipes: convert remaining SUMMARY/DESCRIPTION cosmetic issues 2014-02-17 15:28:59 +00:00
diffstat diffstat: update to version 1.59 2014-07-19 00:09:01 +01:00
distcc Globally replace 'base_contains' calls with 'bb.utils.contains' 2014-04-25 17:19:19 +01:00
dmidecode mirrors.bbclass: Add mirror site for savannah 2014-05-11 12:27:21 +01:00
docbook-dsssl-stylesheets sgml-common-native: fix the generation of sgml-docbook.cat 2014-03-19 14:42:43 +00:00
docbook-sgml-dtd sgml-common-native: fix the generation of sgml-docbook.cat 2014-03-19 14:42:43 +00:00
docbook-utils docbook-utils-native: Unbreak the build after source and build dir split 2013-03-25 20:51:19 +00:00
docbook-xml docbook-xml: add docbook-xml-dtd4 2014-07-16 10:20:50 +01:00
dosfstools Don't set DESCRIPTION to the same value as SUMMARY 2013-12-03 17:45:52 +00:00
dpkg dpkg: Security Advisory - CVE-2014-3127 2014-06-17 10:23:53 +01:00
e2fsprogs e2fsprogs: use update-alt for chattr 2014-06-14 08:43:55 +01:00
elfutils elfutils/elfutils-native: Fix patching generated files 2014-07-03 17:41:17 +01:00
expect expect: fix do_install failure on SLED 11.2 2014-03-19 14:42:43 +00:00
file file: remove dump and filesystems 2014-07-16 10:20:50 +01:00
flex flex: Update to 2.5.39 version 2014-05-21 19:50:21 +01:00
gcc gcc-4.9.inc: fix parallel building failure 2014-07-25 15:34:00 +01:00
gdb gdb: Upgrade 7.7 -> 7.7.1 2014-07-17 12:28:49 +01:00
git git: update to v2.0.1 2014-07-16 10:20:50 +01:00
gnu-config gnu-config: Let it recognise *-*-musl* triplets 2014-06-01 14:29:29 +01:00
guile recipes: Add missing pkgconfig class inherits 2014-06-03 16:49:19 +01:00
guilt guilt-native: tidy up recipe 2014-01-02 12:50:24 +00:00
help2man help2man update to 1.44.1 2014-04-24 17:55:14 +01:00
i2c-tools i2c-tools: Add i2c-tools to the core 2014-05-28 09:42:14 +01:00
icecc-create-env icecc-create-env-native: add SUMMARY and tweak DESCRIPTION 2014-01-02 12:50:23 +00:00
icon-naming-utils autotools-brokensep: Mark recipes with broken separate build dir support 2014-02-28 14:01:16 +00:00
insserv insserv: enable ptest support 2014-02-21 16:09:08 +00:00
installer adt-installer: fix sed input file error 2014-07-23 21:59:14 +01:00
intltool intltool: Define DATADIRNAME=share for uclibc based systems 2014-03-17 14:01:41 +00:00
json-c recipes: convert remaining SUMMARY/DESCRIPTION cosmetic issues 2014-02-17 15:28:59 +00:00
kconfig-frontends kconfig-frontends: fix the incorrect depends on gperf 2014-01-06 11:14:00 +00:00
libtool Add texinfo.bbclass; recipes that use texinfo utils at build-time inherit it. 2014-05-02 20:46:59 +01:00
linuxdoc-tools linuxdoc-tools: remove usage of FILESPATH 2014-05-13 19:32:05 +01:00
m4 Add texinfo.bbclass; recipes that use texinfo utils at build-time inherit it. 2014-05-02 20:46:59 +01:00
make Add texinfo.bbclass; recipes that use texinfo utils at build-time inherit it. 2014-05-02 20:46:59 +01:00
makedevs Replace one-line DESCRIPTION with SUMMARY 2014-01-02 12:50:18 +00:00
mkelfimage autotools-brokensep: Mark recipes with broken separate build dir support 2014-02-28 14:01:16 +00:00
mklibs mklibs-native: upgrade from 0.1.38 to 0.1.39 2014-04-23 11:43:28 +01:00
mmc mmc-utils: fix compilation failure for mips64 target. 2014-05-08 13:00:32 +01:00
mtd mtd-utils: upgrade to 1.5.1+gitAUTOINC+12158de 2014-04-23 11:43:28 +01:00
mtools Add texinfo.bbclass; recipes that use texinfo utils at build-time inherit it. 2014-05-02 20:46:59 +01:00
nasm nasm: Update 2.11.02 -> 2.11.05 2014-07-17 12:28:50 +01:00
openjade sgml-common-native: fix the generation of sgml-docbook.cat 2014-03-19 14:42:43 +00:00
opensp opensp: replace obsolete automake macros with working ones 2013-01-15 08:10:12 +00:00
opkg opkg: Upgrade to v0.2.2 2014-04-25 17:19:19 +01:00
opkg-utils opkg-utils: Update SRCREV 2014-06-01 14:29:30 +01:00
orc Replace one-line DESCRIPTION with SUMMARY 2014-01-02 12:50:18 +00:00
ossp-uuid recipes: convert remaining SUMMARY/DESCRIPTION cosmetic issues (part 2) 2014-02-20 14:28:13 +00:00
packagegroups packagegroup-*: add RREPLACES/RCONFLICTS 2012-09-04 18:03:18 +01:00
patch Globally replace 'base_contains' calls with 'bb.utils.contains' 2014-04-25 17:19:19 +01:00
pax-utils pax-utils: upgrade to 0.8.1 2014-05-13 19:32:06 +01:00
perl perl: fix rebuid failed while ${CC} changed 2014-07-25 15:34:00 +01:00
pkgconfig pkgconfig: Drop version from RPROVIDES 2014-07-17 12:28:49 +01:00
postinst-intercept postinst-intercept: New recipe to include postinstall intercepts in nativesdk 2014-02-02 22:37:40 +00:00
prelink Globally replace 'base_contains' calls with 'bb.utils.contains' 2014-04-25 17:19:19 +01:00
pseudo pseudo: uprev to 1.6.1 2014-07-19 00:18:21 +01:00
python python: fix _json module arbitrary process memory read vulnerability 2014-07-25 15:34:01 +01:00
qemu qemu: Use PACKAGECONFIG for libusb to avoid floating dependency 2014-07-25 15:33:58 +01:00
quilt quilt: Update to 0.63 version 2014-05-21 09:09:01 +01:00
remake remake: fix insufficient gettext dependency 2013-07-24 11:35:36 +01:00
rpm rpm: compile rpmqv.c instead of rpmqv.cc 2014-07-19 00:08:59 +01:00
rsync Replace one-line DESCRIPTION with SUMMARY 2014-01-02 12:50:18 +00:00
run-postinsts run-postinsts: fix issue with checking IMAGE_FEATURES 2014-03-27 15:44:43 +00:00
sgml-common sgml-common-native: fix the generation of sgml-docbook.cat 2014-03-19 14:42:43 +00:00
sgmlspl Don't set DESCRIPTION to the same value as SUMMARY 2013-12-03 17:45:52 +00:00
squashfs-tools squashfs-tools: Add nativesdk in BBCLASSEXTEND 2014-07-23 21:59:17 +01:00
strace strace: fix 64 bit process detection 2014-07-19 00:09:02 +01:00
subversion subversion: Disable make install parallelism 2014-07-19 00:08:58 +01:00
swabber Replace one-line DESCRIPTION with SUMMARY 2014-01-02 12:50:18 +00:00
syslinux syslinux: fix isohybird overflows on 32 bit system 2014-06-24 19:54:12 +01:00
tcf-agent meta: fix no newline at end of file 2014-07-03 17:41:16 +01:00
tcltk tcl: cleanup 2014-05-08 13:00:33 +01:00
ubootchart Replace one-line DESCRIPTION with SUMMARY 2014-01-02 12:50:18 +00:00
unfs3 recipes: convert remaining SUMMARY/DESCRIPTION cosmetic issues (part 2) 2014-02-20 14:28:13 +00:00
unifdef Replace one-line DESCRIPTION with SUMMARY 2014-01-02 12:50:18 +00:00
vala vala: inherit pkgconfig 2014-04-10 17:35:15 +01:00
valgrind Upstream-Status Cleanups 2014-04-25 17:19:20 +01:00
xmlto xmlto: add version 0.0.25 2014-07-16 10:20:50 +01:00
yasm yasm: add from meta-oe and tweak 2013-08-13 23:05:58 +01:00
zisofs-tools Revert "zisofs-tools-native: Add missing dependency on zlib-native" 2014-03-31 23:04:35 +01:00