mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity
68,198 Commits 6 Branches 483 Tags
030d5daa7de21548039d0691768182ba9ee03008
Commit Graph

68198 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Korsgaard
030d5daa7d package/x11r7/xserver_xorg-server: security bump to version 21.1.10 
Fixes the following security issues:

1) CVE-2023-6377: X.Org server: Out-of-bounds memory write in XKB button actions

A device has XKB button actions for each button on the device.  When a
logical device switch happens (e.g.  moving from a touchpad to a mouse), the
server re-calculates the information available on the respective master
device (typically the Virtual Core Pointer).  This re-calculation only
allocated enough memory for a single XKB action rather instead of enough for
the newly active physical device's number of button.  As a result, querying
or changing the XKB button actions results in out-of-bounds memory reads and
writes.

This may lead to local privilege escalation if the server is run as root or
remote code execution (e.g. x11 over ssh).

2) CVE-2023-6478: X.Org server: Out-of-bounds memory read in
RRChangeOutputProperty and RRChangeProviderProperty

This fixes an OOB read and the resulting information disclosure.

Length calculation for the request was clipped to a 32-bit integer.  With
the correct stuff->nUnits value the expected request size was truncated,
passing the REQUEST_FIXED_SIZE check.

The server then proceeded with reading at least stuff->nUnits bytes
(depending on stuff->format) from the request and stuffing whatever it finds
into the property.  In the process it would also allocate at least
stuff->nUnits bytes, i.e.  4GB.

See also CVE-2022-46344 where this issue was fixed for other requests.

For more details, see the advisory:
https://lists.x.org/archives/xorg-announce/2023-December/003435.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9b62f5905e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 21:02:56 +01:00
Fabrice Fontaine
232a039592 package/libiec61850: add mbedtls optional dependency 
mbedtls is an optional dependency since bump to version 1.5.0 in
commit a42e0e4600 and
19f2cbf0e7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4d07864d4c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 21:02:15 +01:00
Fabrice Fontaine
d643e10124 package/ipcalc: bump to version 1.0.3 
https://gitlab.com/ipcalc/ipcalc/-/blob/1.0.3/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2d61c7dba8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 20:54:47 +01:00
Fabrice Fontaine
639032459f package/libraw: bump to version 0.21.2 
Drop patch (already in version)

https://github.com/LibRaw/LibRaw/blob/0.21.2/Changelog.txt

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c67de80597)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 20:43:02 +01:00
Fabrice Fontaine
dabe89e5a4 package/libcap-ng: disable python3 
python3 is an optional dependency (enabled by default) since bump to
version 0.7.7 in commit 4314c86b0b and
02fc25f9d3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4d21ec5021)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 20:41:17 +01:00
Thomas Petazzoni
e4e40d106b package/pkg-qmake.mk: drop host-perl dependency 
Since commit 5770a645a3 ("package/qt5:
bump packages to latest kde submodule versions"), the
QT_HEADERS_SYNC_HOOK hook no longer calls the syncqt.pl script, so
host-perl is no longer needed as a dependency of running this
hook (and as a dependency of building Qt).

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b678091a1c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 20:39:28 +01:00
Thomas Petazzoni
095c5f78e4 Config.in: rework BR2_DOWNLOAD_FORCE_CHECK_HASHES 
BR2_DOWNLOAD_FORCE_CHECK_HASHES currently has the following
dependency:

	depends on BR2_GLOBAL_PATCH_DIR != ""

However, strictly speaking checking all hashes does not necessarily
require using BR2_GLOBAL_PATCH_DIR, as long as you don't use custom
versions.

But more importantly:

- Having this dependency means that this options is hidden when people
  don't use BR2_GLOBAL_PATCH_DIR. Instead the option should always be
  made visible, encouraging people to turn it on.

- The Config.in comment was there to mitigate this previous argument,
  but this comment then shows up all the time when you have an empty
  global patch dir.

This seems over-complicated, and it sounds much easier to have the
option unconditionally available, and visible, and clarify in its help
text that in order to this to work fully with custom package versions,
BR2_GLOBAL_PATCH_DIR can be used to provide extra hash files.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[yann.morin.1998@free.fr:
  - fix typo noticed by Peter K.
  - reword kast sentence after review by Peter K.
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5b0c02a77a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 20:29:50 +01:00
Peter Korsgaard
628138f7e8 package/gstreamer1-editing-services: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5dbff1a92f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:10 +01:00
Peter Korsgaard
e84e2bd841 package/gst-omx: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 574a119101)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:10 +01:00
Peter Korsgaard
728e96c542 package/gst1-vaapi: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7289bdb475)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:09 +01:00
Peter Korsgaard
b975d4b927 package/gst1-rtsp-server: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d70360eed5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:08 +01:00
Peter Korsgaard
c6e9ef5e4c package/gst1-python: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bbc3fdea58)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:08 +01:00
Peter Korsgaard
92e11f0196 package/gst1-libav: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d6c03ac99e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:07 +01:00
Peter Korsgaard
633ad20721 package/gst1-devtools: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 32935c020f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:06 +01:00
Peter Korsgaard
9e9f87ea12 package/gst1-plugins-ugly: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f93be77769)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:06 +01:00
Peter Korsgaard
8d01c5a5b5 package/gst1-plugins-bad: security bump to version 1.22.8 
Fixes the following security issue:

ZDI-CAN-22300: Heap-based buffer overflow in the AV1 codec parser when
handling certain malformed streams before GStreamer 1.22.8

https://gstreamer.freedesktop.org/security/sa-2023-0011.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7add923aed)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:05 +01:00
Peter Korsgaard
06a8a00749 package/gst1-plugins-good: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0489447535)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:04 +01:00
Peter Korsgaard
9600b54b79 package/gst1-plugins-base: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 44820b6021)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:03 +01:00
Peter Korsgaard
22c1fff0ff package/gstreamer1: bump to version 1.22.8 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2631267648)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 18:09:03 +01:00
Peter Seiderer
c5a72c5a22 package/libcamera: add i.MX8 ISI pipeline option 
Add i.MX8 ISI pipeline option (introduced with upstream commit [1] (since
version v0.0.1).

[1] https://git.libcamera.org/libcamera/libcamera.git/commit/?id=0ec982d210861cc6aaebb5d6e8f1a755a16c9792

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3438a8869f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 16:40:46 +01:00
Peter Seiderer
c7b77dfa85 package/libcamera: disable python bindings 
Disable python binding option (introduced with upstream commit [1]
since version v0.0.1).

[1] https://git.libcamera.org/libcamera/libcamera.git/commit/?id=8aa02271fd716ed046970a0b1f89176963303f50

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 09e61e40d2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 16:39:02 +01:00
Fabrice Fontaine
0f2ffac1c9 package/wolfssl: security bump to version 5.6.6 
- Use official tarball and so drop autoreconf
- Fix CVE-2023-6935, CVE-2023-6936 and CVE-2023-6937

https://github.com/wolfSSL/wolfssl/releases/tag/v5.6.6-stable

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d0c4bd703a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 11:22:08 +01:00
Fabrice Fontaine
29bf1f4574 package/mp4v2: security bump to version 2.1.3 
Fix CVE-2023-1450, CVE-2023-1451 and CVE-2023-29584

https://github.com/enzo1982/mp4v2/releases/tag/v2.1.3
https://github.com/enzo1982/mp4v2/releases/tag/v2.1.2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 19f0837174)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 11:21:20 +01:00
Fabrice Fontaine
91f09db85f package/gstreamer1/gstd: drop readline dependency 
readline is not a dependency since bump to version 0.15.0 in commit
cbd06adac5 and
978b503840

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 95a5ed7545)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 11:20:44 +01:00
Thomas Petazzoni
09703ea9f9 package/x11r7/xwayland: security bump to 23.2.3 
According to
https://lists.x.org/archives/xorg-announce/2023-December/003437.html:

  This release contains the fixes for CVE-2023-6377 and CVE-2023-6478
  in today's security advisory:
  https://lists.x.org/archives/xorg-announce/2023-December/003435.html

The release has only 10 commits compared to 23.2.2, all of which being
fixes, two of them being the security fixes. So it seems like bumping
the version is a reasonable trade-off vs. backporting the security
fixes.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 078b8558b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 11:18:57 +01:00
Fabrice Fontaine
961fd7154b package/squid: security bump to version 6.6 
- Drop patch (already in version)
- Fix CVE-2023-50269: This problem allows a remote client to perform
  Denial of Service attack by sending a large X-Forwarded-For header
  when the follow_x_forwarded_for feature is configured.

https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3
https://github.com/squid-cache/squid/blob/SQUID_6_6/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c13199c932)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 11:16:36 +01:00
Fabrice Fontaine
8b99e6639e package/ksmbd-tools: security bump to version 3.5.1 
Fix potential NULL deference errors.

https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.5.1
https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.5.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 66a77af985)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:48:25 +01:00
Fabrice Fontaine
53acf79ed0 package/libebml: security bump to version 1.4.5 
Fix invalid memory access (reading beyond allocated memory) due to
missing integer overflow check.

https://github.com/Matroska-Org/libebml/blob/release-1.4.5/NEWS.md

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 69df189aea)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:46:58 +01:00
Fabrice Fontaine
f9bc00b561 package/libebml: bump to version 1.4.4 
- Drop patch (already in version)
- C++14 is required since
  4159caf84c

https://github.com/Matroska-Org/libebml/blob/release-1.4.4/NEWS.md

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit cef841bf7d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:46:42 +01:00
Fabrice Fontaine
f67494c4f1 package/opensc: security bump to version 0.24.0 
- Drop patches (already in version) and so drop autoreconf
- Fix the following security issues:
  - CVE-2023-40660: Fix Potential PIN bypass
  - CVE-2023-40661: Important dynamic analyzers reports
  - CVE-2023-4535: Out-of-bounds read in MyEID driver handling
    encryption using symmetric keys

https://github.com/OpenSC/OpenSC/releases/tag/0.24.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 37eb68c9fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:41:05 +01:00
Fabrice Fontaine
5b35141a89 package/opensc: fix libressl build 
Fix the following build failure with libressl >= 3.8 raised since bump
of libressl to version 3.8.2 in commit
21eca49ed5:

In file included from card-westcos.c:37:
/home/autobuild/autobuild/instance-11/output-1/host/arm-buildroot-linux-gnueabi/sysroot/usr/include/openssl/evp.h:627:32: error: macro "EVP_sha3_224" passed 1 arguments, but takes just 0
  627 | const EVP_MD *EVP_sha3_224(void);
      |                                ^

Fixes:
 - http://autobuild.buildroot.org/results/cecee659371f370bf4bd2b27a4752bf20ceff326

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e8ca87083b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:40:50 +01:00
Bernd Kuhls
8d9e696724 package/opensc: disable tests 
Fixes:
http://autobuild.buildroot.net/results/50b/50b6962ccd884a91391d13ee75852dd0e9ea1a84/

This error only occurs when building with BR2_SHARED_STATIC_LIBS=y, it
fails for src/tests/fuzzing/fuzz_pkcs15init which is only available when
static linking is enabled:
https://github.com/OpenSC/OpenSC/blob/master/src/tests/fuzzing/Makefile.am#L14

The upstream build system has no support to extract the correct ldflags
for libatomic.so provided by libcrypto.pc. Because we do not need the
tests anyway we just disable them to "fix" the build error for us.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e83a151725)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:40:31 +01:00
Bernd Kuhls
3a58c4cfe7 package/opensc: renumber patch 
Buildroot commit c02707a342 added two
upstream patches with the same number, renumber the younger patch.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7c46330cb6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:40:22 +01:00
Bernd Kuhls
5173d24fc9 package/opensc: bump version to 0.23.0 
Release notes:
    https://github.com/OpenSC/OpenSC/blob/master/NEWS

Also carry two patches from upstream to fix build against newer
LibreSSL. Those patches can't be backported to pre-0.23.0 versions,
though.

Fixes:
    http://autobuild.buildroot.net/results/913/91318abb98146dd967115ed6233949daa60d8bba/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[yann.morin.1998@free.fr: squash LibreSSL fixes together with bump]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c02707a342)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:39:45 +01:00
Fabrice Fontaine
66c04c8838 package/strongswan: security bump to version 5.9.13 
A vulnerability in charon-tkm related to processing DH public values was
discovered in strongSwan that can result in a buffer overflow and
potentially remote code execution. All versions since 5.3.0 are
affected.

https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-(cve-2023-41913).html
https://github.com/strongswan/strongswan/blob/5.9.13/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9e5cbbb413)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-10 10:36:47 +01:00
Fabrice Fontaine
2ed65a2f44 package/cjson: security bump to version 1.7.17 
- Fix null reference in cJSON_SetValuestring (CVE-2023-50472)
- Fix null reference in cJSON_InsertItemInArray (CVE-2023-50471)

https://github.com/DaveGamble/cJSON/releases/tag/v1.7.17

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 449538348e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 21:28:27 +01:00
Francois Perrad
574eafa5c0 package/libgtk3: bump to version 3.24.39 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a449898d82)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 21:24:42 +01:00
Bernd Kuhls
885942976f {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 6}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d42683a055)
[Peter: drop 6.6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 21:10:27 +01:00
Adam Duskett
35d98448a2 package/google-breakpad: disable uclibc support 
The google-breakpad package uses stab.h which is not included in
uClibc, causing the following build error:

src/common/stabs_reader.cc:37:10: fatal error: stab.h: No such file or directory
   37 | #include <stab.h>
      |          ^~~~~~~~
compilation terminated.

Fixes:

  http://autobuild.buildroot.net/results/bba513b7c63a24a83805d2b989a9b95e5fe08e82/

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c20334d35c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 14:36:30 +01:00
Bernd Kuhls
34fee4fb35 package/php: bump version to 8.2.14 
Changelog: https://www.php.net/ChangeLog-8.php#8.2.14
Release notes: https://www.php.net/releases/8_2_14.php

This release fixes build errors with libxml2 2.12.0.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 973eff2ff2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 14:05:49 +01:00
Thomas Petazzoni
e98898bf51 .checkpackageignore: stop ignoring ShellCheck issues in google-breakpad 
The issues have been fixed by commit
f1089391a8 ("package/google-breakpad/gen-syms.sh:
fix shellcheck warnings")

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/5815132933

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9212a719a5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 13:50:18 +01:00
Adam Duskett
7dbc0dde06 package/google-breakpad: fix building with gcc 13.x 
Fixes the following error when building with gcc 13.x:

‘uintptr_t’ is defined in header ‘<cstdint>’; did you forget to ‘#include <cstdint>’?

Fixes:

  http://autobuild.buildroot.net/results/73f17ec308b6fd20dabdb7e391a3f67793a14d5b/

  (which happens with the target google-breakpad, but the issue can
  also happen when building host-google-breakpad if the host system
  uses gcc 13.x)

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Thomas: use upstream fix, improve commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 08fa882d3c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 13:40:25 +01:00
Adam Duskett
731d17da87 package/google-breakpad/gen-syms.sh: fix shellcheck warnings 
Fixes warning SC2068

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f1089391a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-09 13:40:12 +01:00
Peter Korsgaard
1c537e0bf2 package/libssh: security bump to version 0.10.6 
Fixes the following security issues:

- CVE-2023-6004: Command Injection using malicious hostname in expanded proxycommand
  https://www.libssh.org/security/advisories/CVE-2023-6004.txt

- CVE-2023-48795: Avoid potential downgrade attacks by implementing strict kex
  https://www.libssh.org/security/advisories/CVE-2023-48795.txt

- CVE-2023-6918: Avoid potential use of weak keys in low memory conditions
  by systematically checking return values of MD functions.
  https://www.libssh.org/security/advisories/CVE-2023-6918.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a8362e5c85)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-07 23:42:28 +01:00
Peter Korsgaard
1c70425ddb package/putty: security bump to version 0.80 
As described in the announcement, this fixes a security issue:

There is one security fix in this release:

 - Fix for a newly discovered security issue known as the 'Terrapin'
   attack, also numbered CVE-2023-48795. The issue affects widely-used
   OpenSSH extensions to the SSH protocol: the ChaCha20+Poly1305
   cipher system, and 'encrypt-then-MAC' mode.

   In order to benefit from the fix, you must be using a fixed version
   of PuTTY _and_ a server with the fix, so that they can agree to
   adopt a modified version of the protocol. Alternatively, you may be
   able to reconfigure PuTTY to avoid selecting any of the affected
   modes.

   If PuTTY 0.80 connects to an SSH server without the fix, it will
   warn you if the initial protocol negotiation chooses an insecure
   mode to run the connection in, so that you can abandon the
   connection. If it's possible to alter PuTTY's configuration to
   avoid the problem, then the warning message will tell you how to do
   it.

https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 922132c39e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-07 23:40:17 +01:00
Fabrice Fontaine
02c3ce317a package/putty: disable gssapi 
PUTTY_GSSAPI is enabled by default resulting in the following build
failure since bump to version 0.78 in commit
5673ea3ce4:

 /home/fabrice/buildroot/output/build/putty-0.79/unix/gss.c:133:10: fatal error: gssapi/gssapi.h: No such file or directory
  133 | #include <gssapi/gssapi.h>
      |          ^~~~~~~~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/d6d06b5aa0df070c3880399e044fb3cd3a830aec

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 499b4d6d22)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-07 23:40:12 +01:00
Fabrice Fontaine
d2f9e1ea52 package/putty: fix static build 
Fix the following static build failure raised since bump to version 0.78
in commit 5673ea3ce4:

In file included from /home/buildroot/autobuild/instance-0/output-1/build/putty-0.78/putty.h:8,
                 from /home/buildroot/autobuild/instance-0/output-1/build/putty-0.78/callback.c:8:
/home/buildroot/autobuild/instance-0/output-1/build/putty-0.78/unix/platform.h:11:10: fatal error: dlfcn.h: No such file or directory
   11 | #include <dlfcn.h>                     /* Dynamic library loading */
      |          ^~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/06f0b14bd0414f97b06070198e290fb3253348c5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3d8e0a263f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-07 23:40:00 +01:00
Fabrice Fontaine
4aedd5f93b package/putty: fix legal info 
Commit bf284bcfba forgot to update hash of
license file (year updated)

Fixes:
 - http://autobuild.buildroot.org/results/900b3fe8d4bf029c6bca6ca63c6e093e42cc1072

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e4038b6af4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-07 23:39:54 +01:00
Alexander Dahl
0e44d4e383 package/putty: bump version to 0.79 
Bug fixes mostly.

Link: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
Signed-off-by: Alexander Dahl <post@lespocky.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bf284bcfba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-07 23:39:48 +01:00
Bernd Kuhls
896de01e0e package/putty: bump version to 0.78 
Changelog:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

Removed patch, the patched file does not exist anymore in this release.

Updated license hash due to copyright year bump:
https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=ce59d8bb4f7a1c6aff677d1431ec84a803a24091

Switched build system to cmake.

Added optional dependency to libgtk3.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5673ea3ce4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-01-07 23:38:30 +01:00