For #11400

Fixed CVEs:

- CVE-2020-11739
- CVE-2020-11740
- CVE-2020-11741
- CVE-2020-11742
- CVE-2020-11743

CVE-2019-19579 XSA-306
CVE-2019-19582 XSA-307
CVE-2019-19583 XSA-308
CVE-2019-19578 XSA-309
CVE-2019-19580 XSA-310
CVE-2019-19577 XSA-311

ref #11132

- CVE-2019-18425 XSA-298
- CVE-2019-18421 XSA-299
- CVE-2019-18423 XSA-301
- CVE-2019-18424 XSA-302
- CVE-2019-18422 XSA-303
- CVE-2018-12207 XSA-304
- CVE-2019-11135 XSA-305

ref #10968

Richard Mortier authored 5 years ago and Natanael Copa committed 5 years ago

Signed-off-by: Richard Mortier <mort@cantab.net>

Fixes XSA-295, CVE not yet assigned

CVE-2018-12126
CVE-2018-12127
CVE-2018-12130
CVE-2019-11091

Also includes needed patches from the xen stable-4.12 branch

Henrik Riomar authored 6 years ago and Natanael Copa committed 5 years ago

Upstream renamed /usr/lib/fs -> /usr/lib/xenfsimage

Drop patches included upstream

Henrik Riomar authored 6 years ago and Natanael Copa committed 6 years ago

CVEs now assigned for the latest XSAs

Henrik Riomar authored 6 years ago and Natanael Copa committed 6 years ago

While at it, drop depend that was not needed after all

See also:
https://github.com/alpinelinux/aports/pull/5629

Oliver Smith authored 6 years ago and Timo Teräs committed 6 years ago

This makes it possible to provide armv7 as additional architecture in
Alpine, next to armhf. See the discussion in this ML thread:
<https://lists.alpinelinux.org/alpine-devel/6271.html>

It's done by adding armv7 next to armhf in the arch line and also
!armv7 where the arch line said !armhf. The following script was used:

Add flex & bison to build deps (src/xen-4.11.0/README)

Add brige-utils to runtime deps of $pkgname-bridge

CVE-2018-8897, XSA-260
CVE-2018-10982, XSA-261
CVE-2018-10981, XSA-262

Fixes #8885

tun-1 is the disk if the iscsi target is tgtd

Daniel Sabogal authored 7 years ago and Natanael Copa committed 7 years ago

CVE-2018-7540 XSA-252
CVE-2018-7541 XSA-255
CVE-2018-7542 XSA-256

fixes #8613

William Johansson authored 7 years ago and Ariadne Conill committed 7 years ago

Adds a basic xen-pci release OpenRC script that will run before
xendomains and release PCI devices from dom0, so they can
be pci "passthroughed" to e.g. network or storage domain domUs.

Daniel Sabogal authored 7 years ago and Natanael Copa committed 7 years ago

(cherry picked from commit 1f6e64f5)

Note this was 4.9.1-r2 in the alpine-3.7 branch

Henrik Riomar authored 7 years ago and Natanael Copa committed 7 years ago

Add Xen page-table isolation (XPTI) for XEN 4.9.1

More info: http://xenbits.xen.org/xsa/xsa254/README.pti

Daniel Sabogal authored 7 years ago and Natanael Copa committed 7 years ago

Security fixes for all applicable XSAs up to (and including) XSA-245
Upstream rombios makefile now enforces non-PIC/PIE mode

Daniel Sabogal authored 7 years ago and Natanael Copa committed 7 years ago

UPDATES IN VERSION 5
====================

New final patch, addressing a hypervisor crash the original fix caused,
which by itself represents another security issue (DoS).

http://openwall.com/lists/oss-security/2017/11/15/4

Daniel Sabogal authored 7 years ago and Natanael Copa committed 7 years ago

CVE-2017-15590 XSA-237
XSA-238
CVE-2017-15589 XSA-239
CVE-2017-15595 XSA-240
CVE-2017-15588 XSA-241
CVE-2017-15593 XSA-242
CVE-2017-15592 XSA-243
CVE-2017-15594 XSA-244

Andy Chu authored 7 years ago and Ariadne Conill committed 7 years ago

Fix bugs in 2 packages by removing Unicode whitespace.

I found these problems by parsing all APKBUILD scripts with my shell
(http://www.oilshell.org/).

The problem only occurs if 'make' fails.  Here is an excerpt:

$ od -c unicode-space.sh
0000000   m   a   k   e       |   | 302 240   r   e   t   u   r   n
0000020   1  \n
0000022

\302 \204 is a utf-8 whitespace.  No shells accept this -- it's parsed
as part of the 'return' word, which makes it an invalid command.

$ busybox ash unicode-space.sh
make: *** No targets specified and no makefile found.  Stop.
unicode-space.sh: line 1:  return: not found

$ bash unicode-space.sh
make: *** No targets specified and no makefile found.  Stop.
unicode-space.sh: line 1:  return: command not found

$ dash unicode-space.sh
make: *** No targets specified and no makefile found.  Stop.
unicode-space.sh: 1: unicode-space.sh:  return: not found

Remove '|| return 1' from lines that contained unicode whitespace.

abuild now runs with 'set -e'.

Daniel Sabogal authored 7 years ago and Natanael Copa committed 7 years ago

CVE-2017-14316 XSA-231
CVE-2017-14318 XSA-232
CVE-2017-14317 XSA-233
CVE-2017-14319 XSA-234

Daniel Sabogal authored 7 years ago and Timo Teräs committed 7 years ago

Update patch for XSA-226 (fixes a regression).
http://openwall.com/lists/oss-security/2017/08/29/2

Include fix for XSA-235.

Daniel Sabogal authored 7 years ago and Natanael Copa committed 7 years ago

fixes #7732

CVE-2017-12135 XSA-226
CVE-2017-12137 XSA-227
CVE-2017-12136 XSA-228
CVE-2017-12855 XSA-230