mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity
78,795 Commits 6 Branches 483 Tags
032e91d9ea7487e6c2adbce57cd60f21cb8f0cc3
Commit Graph

78795 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bernd Kuhls
032e91d9ea package/unbound: security bump version to 1.24.2 
Changelog: https://nlnetlabs.nl/projects/unbound/download/

Fixes CVE-2025-11411:
https://nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt

Removed UNBOUND_IGNORE_CVES, the fix is included in this release.

The unbound version 1.23.0 also includes a fix when compiling with
gcc 15. See:
https://github.com/NLnetLabs/unbound/pull/1262

Fixes:
https://autobuild.buildroot.net/results/d3d/d3d6b84ba667e3e2586b7cfdaddcd160232eddfd/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add comment about gcc-15 fix]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a1f691fb02)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:32 +01:00
Thomas Petazzoni
df5b222291 package/glibc: only supports ARC little-endian since glibc 2.41 
Since upstream commit
https://sourceware.org/git/?p=glibc.git;a=commit;h=4ff55d08df0e6f11cbd217f4dca4532bd7d9330d,
glibc no longer supports ARC big-endian, and the configure step fails
with:

checking for egrep -e... (cached) /bin/grep -E
checking for big endian... yes
configure: error: big-endian not supported
make: *** [package/pkg-generic.mk:263: /home/buildroot/instance-0/output-1/build/glibc-2.41-70-g1502c248d58cb99a203731707987a4342926e830/.stamp_configured] Error 1

This commit was first merged in glibc 2.41, so this issue is
applicable to both master (glibc 2.42) and 2025.02.x (glibc 2.41).

Fixes:

  https://autobuild.buildroot.net/results/87e4b84f3aee64d041c3b845cb003e6b90649ffb/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d4a998f0fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:30 +01:00
Bernd Kuhls
5f40e75e07 package/lugaru: switch to github 
Old site returns 404 for the tarball and does not contain any repos:
https://bitbucket.org/osslugaru/workspace/repositories/

Switch _SITE to URL shown at https://osslugaru.gitlab.io/

The hash value of the tarball is unchanged.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a65bbef5ba)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:28 +01:00
Raphael Pavlidis
2e7569be2e package/xwayland: security bump to version 24.1.9 
Fixes the following security issues:

1) CVE-2025-62229: Use-after-free in XPresentNotify structures creation

    Using the X11 Present extension, when processing and adding the
    notifications after presenting a pixmap, if an error occurs, a dangling
    pointer may be left in the error code path of the function causing a
    use-after-free when eventually destroying the notification structures
    later.

    Introduced in: Xorg 1.15
    Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
    Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5a4286b1
    Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.

2) CVE-2025-62230: Use-after-free in Xkb client resource removal

    When removing the Xkb resources for a client, the function
    XkbRemoveResourceClient() will free the XkbInterest data associated
    with the device, but not the resource associated with it.

    As a result, when the client terminates, the resource delete function
    triggers a use-after-free.

    Introduced in: X11R6
    Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
    Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/99790a2c
         https://gitlab.freedesktop.org/xorg/xserver/-/commit/10c94238
    Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.

3) CVE-2025-62231: Value overflow in Xkb extension XkbSetCompatMap()

    The XkbCompatMap structure stores some of its values using an unsigned
    short, but fails to check whether the sum of the input data might
    overflow the maximum unsigned short value.

    Introduced in: X11R6
    Fixed in: xorg-server-21.1.19 and xwayland-24.1.9
    Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/475d9f49
    Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.

https://lists.x.org/archives/xorg-announce/2025-October/003635.html

Changelog:
https://lists.x.org/archives/xorg/2025-October/062148.html

Also update the COPYING hash for a change of copyright year.

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Peter: Mark as security bump, extend commit message, fix COPYING hash]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e11cac64a2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:26 +01:00
Raphael Pavlidis
192719df0e package/x11r7/xserver_xorg-server: security bump to version 21.1.20 
Changelog:
https://lists.x.org/archives/xorg/2025-October/062147.html
https://lists.x.org/archives/xorg/2025-October/062150.html

This commit also updates the COPYING license file hash, after year
update in upstream commit:
7cd443c610

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-62229
https://www.cve.org/CVERecord?id=CVE-2025-62230
https://www.cve.org/CVERecord?id=CVE-2025-62231

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Julien: fix COPYING license file hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 78513ff979)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:24 +01:00
Bernd Kuhls
4b6e9ebd09 package/apache: security bump version to 2.4.66 
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.66

Fixes CVE-2025-55753, CVE-2025-58098, CVE-2025-59775, CVE-2025-65082 &
CVE-2025-66200.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 77e4a8858c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:21 +01:00
Raphael Pavlidis
ec37574a63 package/podman: security bump to version 5.7.0 
Changelog:
https://github.com/containers/podman/releases/tag/v5.7.0

This commit fixes the CVE-2025-52881 security vulnerability. See:
https://github.com/advisories/GHSA-cgrx-mc8f-2prm

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fc4ec2369b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:19 +01:00
Bernd Kuhls
83f3a7799e package/python3: security bump version to 3.13.10 
For release notes of this bugfix release, see [1].
While the release notes [1] does not mention any security fixes,
the more detailed change log at [2] has a security section:

- gh-139700: "Check consistency of the zip64 end of central directory
  record." refers to CVE-2025-8291 [3],
- gh-136065: "Fix quadratic complexity in os.path.expandvars()."
  refers to CVE-2025-6075 [4],
- gh-119342: "Fix a potential memory denial of service in the
  plistlib module." refers to CVE-2025-13837 [5].

Fixes:
- [3], [4] and [5].

[1] https://www.python.org/downloads/release/python-31310/
[2] https://docs.python.org/release/3.13.10/whatsnew/changelog.html#security
[3] https://www.cve.org/CVERecord?id=CVE-2025-8291
[4] https://www.cve.org/CVERecord?id=CVE-2025-6075
[5] https://www.cve.org/CVERecord?id=CVE-2025-13837

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add info in commit log about CVEs]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9ae99d19b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:17 +01:00
Peter Korsgaard
67cdf2495f support/scripts/pkg-stats: use an unique HTTP user-agent 
As requested by the gnu.org admins:

"
Since August 2024, we've been under DDoS attacks from common command line
tools.

To fix this, we would need to change the user-agent from "Python/3.11
aiohttp/3.8.4" to "buildroot.org pkg-stats" instead.
"

It indeed probably makes sense to use an unique user-agent string, so rework
the script to do that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0981b4117d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:15 +01:00
Peter Korsgaard
68d8692cec support/scripts/pkg-stats: check_url_status(): use HEAD requests to limit server load 
The gnu.org admins have been blocking the IP address of machines running
pkg-stats as the GET requests for the (many) packages with gnu.org URLs are
seen as abusive.

The resource body is not used, so use a HTTP HEAD request instead of a GET
to limit server load and bandwidth use.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f9f3e6ccc6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:12 +01:00
Bernd Kuhls
8f0bc04e8b package/yaml-cpp: fix build with newer gcc 
Fixes a build error not yet seen by the autobuilders due to other
packages failing before. Seen with defconfig:
https://autobuild.buildroot.net/results/ebf/ebf9a81f7e225ecdab20bbad8ad8daa136fddb46/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0eab434cb0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:10 +01:00
Bernd Kuhls
c6cec9f84a package/woff2: fix build with newer gcc 
Fixes a build error not yet seen by the autobuilders due to other
packages failing before. Seen with defconfig:
https://autobuild.buildroot.net/results/ebf/ebf9a81f7e225ecdab20bbad8ad8daa136fddb46/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 32490ae99f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:08 +01:00
Bernd Kuhls
105d8f9f2e package/time: fix build with newer gcc 
Fixes:
https://autobuild.buildroot.net/results/2d4/2d440a31fc49366d77289f1d21080e1861c6ee21/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 08a638d49f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-11 10:56:06 +01:00
Arnout Vandecappelle
dd1b0c2aaf Makefile: update for 2025.08.3 
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025.08.3 		2025-12-11 09:20:41 +01:00
Arnout Vandecappelle
b338a0ca2f CHANGES: update for 2025.08.3 
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
 2025-12-11 09:18:56 +01:00
Titouan Christophe
3e19283d9b {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 5.4.x series 
Update the latest kernel releases to:
 - 6.12.58 -> 6.12.61
 - 6.6.116 -> 6.6.119
 - 6.1.158 -> 6.1.159
 - 5.15.196 -> 5.15.197
 - 5.10.246 -> 5.10.247
 - 5.4.301 -> 5.4.302

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
 2025-12-08 19:25:02 +01:00
Bernd Kuhls
d61a967887 package/18xx-ti-utils: switch to git repo 
Downloading the snapshot tarball has been unstable in the past so we
switch to git for fetching the source code.

Fixes:
https://autobuild.buildroot.net/results/8b9/8b9b15e578ee13c47bdfe77f8bd79cd34c49de91/
https://autobuild.buildroot.net/results/bfc/bfcfb6e5014e017334604ba8fdcfac2acc65d161/
https://autobuild.buildroot.net/results/6c6/6c69077ea076c3c28d0e8599913cde31ee27b0c5/
https://autobuild.buildroot.net/results/b43/b431fabedd709f660f556a7a6539a0b1e28aeb49/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d8b15b078a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:23:58 +01:00
Bernd Kuhls
bbcb39d46d package/sbc: fix build with gcc-15.x 
Fixes:
https://autobuild.buildroot.net/results/2d1/2d16eb4bb0c7f095d0d52af8553c498f6f9a295c/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b871105790)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:23:20 +01:00
Bernd Kuhls
b4bb9e5072 package/libteam: add upstream patch to fix build with newer gcc 
Fixes:
https://autobuild.buildroot.net/results/a4c/a4c4c4135cffe607269cc0fdb36e4b2c86e7fe33/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fc98cd6b9c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:22:35 +01:00
Bernd Kuhls
c5b0f8c2b3 package/tor: bump version to 0.4.8.21 
Release notes:
https://forum.torproject.org/t/stable-release-0-4-8-21/20817

https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
"This release is a continuation of the previous one and addresses
 additional Conflux-related issues identified through further testing
 and feedback from relay operators.
 We strongly recommend upgrading as soon as possible."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cb1f3579a2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:22:14 +01:00
Bernd Kuhls
06a77553e1 package/pdmenu: fix build with gcc-15.x 
Fixes:
https://autobuild.buildroot.net/results/554/5545162ca0206cacfca1617280f074237e72aec1/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit baaad289ab)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:22:03 +01:00
Bernd Kuhls
c5e54e26dd package/oprofile: add upstream patch to fix build with newer gcc 
Fixes:
https://autobuild.buildroot.net/results/e12/e12de278cb7bb0ecc0d44dd9c69d3832ede946de/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cffb057b90)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:20:59 +01:00
Giulio Benetti
15ac852c82 package/tmux: fix build failure due to type mismatch 
Package tmux fails to build with:
compat/utf8proc.c: In function 'utf8proc_mbtowc':
compat/utf8proc.c:51:39: error: passing argument 3 of 'utf8proc_iterate' from incompatible pointer type [-Wincompatible-pointer-types]
   51 |         slen = utf8proc_iterate(s, n, pwc);
      |                                       ^~~
      |                                       |
      |                                       wchar_t * {aka long int *}

Add local patch already committed upstream to fix it.

Fixes:
https://autobuild.buildroot.net/results/651/6510cfb16d0c3f3772918cd3bde0542d0b59a230/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7cf46f0384)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:14:21 +01:00
Giulio Benetti
e90d5d866e package/sdl: fix build failure due to type mismatch 
Add local patch to fix:
./src/stdlib/SDL_iconv.c: In function 'SDL_iconv':
./src/stdlib/SDL_iconv.c:50:29: error: passing argument 2 of 'iconv' from incompatible pointer type [-Wincompatible-pointer-types]
   50 |         retCode = iconv(cd, inbuf, inbytesleft, outbuf, outbytesleft);
      |                             ^~~~~
      |                             |
      |                             const char **

Fixes:
https://autobuild.buildroot.net/results/cfb/cfb1f9a0137332cf080ce862722e4fe8ad275031/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: add "Upstream:" tag in patch]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 03394b4989)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:13:09 +01:00
Bernd Kuhls
fd1c2db4de package/swipl: bump version to 9.2.9 
For change log since version 9.2.8, see:
https://www.swi-prolog.org/ChangeLog?branch=stable&from=9.2.8&to=9.2.9

Fixes:
https://autobuild.buildroot.net/results/158/1586997a84236b678249ac45b83b4e330e727f39/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to change log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 743bc22135)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:12:55 +01:00
Bernd Kuhls
b72b6047f3 package/{neard, sdbusplus, thermald}: typo fixes 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 559bb4dd7b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:12:31 +01:00
Marcus Hoffmann
b85474755b package/python-starlette: security bump to 0.50.0 
Starlette 0.49.1 fixes the following security issue:
https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8

Other changes:
* https://github.com/Kludex/starlette/releases/tag/0.49.0
* https://github.com/Kludex/starlette/releases/tag/0.49.1 (the security fix)
* https://github.com/Kludex/starlette/releases/tag/0.49.2
* https://github.com/Kludex/starlette/releases/tag/0.49.3
* https://github.com/Kludex/starlette/releases/tag/0.50.0

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 35d8a3a0ca)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:11:49 +01:00
Marcus Hoffmann
60732a6a51 package/python-starlette: bump to 0.48.0 
Release Notes: https://github.com/Kludex/starlette/releases/tag/0.48.0
Github namespace changed, so change the link in Config.in.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 62cfbc1409)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:11:41 +01:00
James Hilliard
db2fee1bb1 package/python-starlette: bump to version 0.47.3 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bb825488db)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-04 13:11:34 +01:00
Julien Olivain
481da6df64 package/gnutls: add patch to fix build with gcc < 11 
Since Buildroot commit [1] (package/gnutls: security bump to
version 3.8.11), gnutls fails to build with gcc or host-gcc
version < 11, with error:

    In file included from audit.h:22,
                     from audit.c:26:
    crau/crau.h:255:23: error: missing binary operator before token "("
         __has_c_attribute (__maybe_unused__)

This commit adds a patch fixing the issue.

[1] 81dbfe1c2a

Reported-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Neal Frager <neal.frager@amd.com>
Tested-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5cd1fe636c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-12-03 17:22:52 +01:00
Bernd Kuhls
e2fd331079 package/gnutls: security bump to version 3.8.11 
Release notes:
https://lists.gnupg.org/pipermail/gnutls-help/2025-November/004906.html

Fixes CVE-2025-9820.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81dbfe1c2a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-27 13:26:56 +01:00
Bernd Kuhls
bc1f6a524e package/libpng: security bump version to 1.6.51 
Release notes:
https://raw.githubusercontent.com/pnggroup/libpng/v1.6.51/ANNOUNCE

Fixes CVE-2025-64505, CVE-2025-64506, CVE-2025-64720 & CVE-2025-65018.

Removed patch which is included in this release.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 08ad91052b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-27 13:25:12 +01:00
Bernd Kuhls
f5e9c1f379 package/open-plc-utils: bump version to git 46c3506453 
Changelog:
1ba7d5a042...46c3506453

Upstream commit
cbf52f68b5
fixes build errors with newer gcc versions.

Instead of adding this patch to buildroot we bump to HEAD which also
includes other bug fixes and documentation updates.

Fixes:
https://autobuild.buildroot.net/results/c74/c74730bbadc9ba20cdccf448dbc508d0afbabf41/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add git commit version in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bf5f1b546b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:45:54 +01:00
Bernd Kuhls
fe97314c2f package/enscript: Fix build with gcc 15.x 
Fixes:
https://autobuild.buildroot.net/results/7fd/7fdda216e2ec57b9bcc1d2613b6546db35a29749/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8ea6c20cec)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:44:40 +01:00
Bernd Kuhls
c0aae487d0 package/nss-pam-ldapd: fix build with gcc >= 15.x 
Fixes:
https://autobuild.buildroot.net/results/c30/c30b29723a2f3db6fed5ad0bf0e06c126a857953/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7c06826342)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:44:34 +01:00
Bernd Kuhls
a9b4636a62 package/sane-backends: fix build with gcc >= 15.x 
Fixes:
https://autobuild.buildroot.net/results/296/2961e7aa23d66e7cf364c2caeafc1c226ccd48d9/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 016993bd9a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:44:22 +01:00
Thomas Perale
e70c5a4f0c docs/manual: add information on CycloneDX 
This patch adds information on how to generate a CycloneDX SBOM in
Buildroot. It also mentions how to track CVEs with that given SBOM.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: reword slightly]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e09bf9e951)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:44:13 +01:00
Thomas Perale
e3b8695301 DEVELOPERS: add Thomas Perale to cve-check & cve.py 
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 51558fa3ea)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:41:42 +01:00
Thomas Perale
5c18a56ffb support/scripts/cve-check: add cve-check script 
Enriches the input CycloneDX SBOM with vulnerability information and
analysis from the NVD database.

The NVD database is cloned using a mirror of it and the content is compared
locally. By default the path 'dl/buildroot-nvd' is used.

Example usage to analyse vulnerabilities of an input CycloneDX SBOM:

$ make show-info | utils/generate-cyclonedx | support/script/cve-check

The 'cve-check' can also be used to only enrich the vulnerabilities
present on the input SBOM with a set metadata (description, cvss,
references, ...) without applying an analysis.

With the following command the vulnerabilities ignored by Buildroot
present in the CycloneDX SBOM are enriched with description, cvss, etc
...

$ make show-info | utils/generate-cyclonedx | support/script/cve-check --enrich-only

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: fix minor flake8 issues]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6762c42e74)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:41:35 +01:00
Thomas Perale
3acf2f71d4 support/scripts/cve.py: don't call download_nvd 
This patch move the 'download_nvd' call to the 'pkg-stats' script
instead of automatically calling 'read_nvd_dir'.

Since the cve.py file can be used as a library it's up to the caller to
decide whether or not to update the NVD database.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 867017e736)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:41:27 +01:00
Bernd Kuhls
5fded1117a package/openvpn: security bump version to 2.6.16 
Fixes CVE-2025-13086.

Release notes:
https://sourceforge.net/p/openvpn/mailman/message/59261309/

Changelog:
https://github.com/OpenVPN/openvpn/blob/release/2.6/ChangeLog
https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 55d1f2825b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:40:57 +01:00
Scott Fan
66f8a5bb3b package/openvpn: bump version to 2.6.15 
Release notes:
https://sourceforge.net/p/openvpn/mailman/message/59238233/

Changelog:
https://github.com/OpenVPN/openvpn/blob/release/2.6/ChangeLog
https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst

The ‎COPYRIGHT.GPL was updated to latest version from FSF.

Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c368b33378)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:40:43 +01:00
Peter Korsgaard
5592874523 package/python-django: security bump to version 5.2.8 
Fixed the following security issues:

CVE-2025-64458: Potential denial-of-service vulnerability in
HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

CVE-2025-64459: Potential SQL injection via _connector keyword argument

https://docs.djangoproject.com/en/5.2/releases/5.2.8/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 779827f765)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:33:40 +01:00
Bernd Kuhls
5efbcec58e DEVELOPERS: remove Julien Corjon, e-mail bounces 
<corjon.j@ecagroup.com>: host ecagroup-com.mail.protection.outlook.com[52.101.166.0]
 said: 550 5.4.1 Recipient address rejected: Access denied.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 88c26c4814)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:32:41 +01:00
Yi Zheng
29db819948 fs/squashfs: correct aarch64 conditional 
BR_aarch64 is not defined. it seems should be BR2_aarch64

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d6d8b5823a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:32:17 +01:00
Bernd Kuhls
f797b2a765 DEVELOPERS: remove Bernd Kuhls from libdecor & libfreeglut 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5db55534af)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:32:07 +01:00
Peter Korsgaard
30c8bd4a51 package/luksmeta: security bump to version 10 
Fixes the following security issue:

CVE-2025-11568: A  data corruption vulnerability has been identified in the
luksmeta utility when used with the LUKS1 disk encryption format.

https://github.com/advisories/GHSA-pvmm-7c2r-wmp4
https://github.com/latchset/luksmeta/releases/tag/v10

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 80764d7208)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:30:46 +01:00
Titouan Christophe
6a878b5990 package/redis: bump to v8.0.5 
See the release notes: https://github.com/redis/redis/releases/tag/8.0.5

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 896e19a5c6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:30:13 +01:00
Thomas Devoogdt
1237472aef package/openjdk{, -bin}: fix wrong version reporting 
Before:

$ java --version
openjdk 17 2024-07-16
OpenJDK Runtime Environment (build 17+17)
OpenJDK 64-Bit Server VM (build 17+17, mixed mode)

After:

$ java --version
openjdk 17.0.12 2024-07-16
OpenJDK Runtime Environment (build 17.0.12+7)
OpenJDK 64-Bit Server VM (build 17.0.12+7, mixed mode)

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8ccee2be22)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:29:00 +01:00
Bernd Kuhls
87f544957e package/libroxml: fix musl build errors 
Fixes:
https://autobuild.buildroot.net/results/0ff/0ff4394319d2014884328c347ef495da327a562e/

Added Upstream tag to patch 0001.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1f973844d1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2025-11-26 09:26:14 +01:00