For more information on the release, see:
- https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18
It fixes the following vulnerabilities:
- CVE-2026-48163:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST
the donor node is interpolating parameters that the joiner sent into
the command line. Not all parameters were properly validated which
could allow a malicious joiner to execute arbitrary shell commands on
the donor side via the rsync SST method. This issue has been patched
in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48163
- CVE-2026-48165:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-
privileged MariaDB user could've used wsrep_sst_receive_address or
wsrep_sst_donor global system variables to execute shell commands as
the uid of the mariadbd process on the galera joiner node. This issue
has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48165
- CVE-2026-49261:
MariaDB server is a community developed fork of MySQL server. Versions
10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through
11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd`
enabled would execute shell commands embedded in the name of the
joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2. As a workaround, anyone who cannot upgrade now should disable
`wsrep_notify_cmd`.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-49261
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c69f28ae5c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
In the precedent patch "support/testing: test_gnupg2.py: use
assertRunNotOk()" [1] a small typo (OK instead of Ok) was introduced
in the test_gnupg2.py file, which caused a runtime failure.
This patch simply replace "self.assertRunNotOK(cmd)" with
"self.assertRunNotOk(cmd)" to correct this typo.
[1] cb791850ad
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Fiona: fix commit message formatting]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit cfd7483a26)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-55200:
libssh2 through 1.11.1, fixed in commit 97acf3df contains an out-of-
bounds write vulnerability in ssh2_transport_read() that fails to
enforce upper bounds on packet_length field. Remote attackers can send
crafted SSH packets with excessively large packet_length values to
corrupt heap memory and achieve remote code execution.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55200
- 97acf3dfda
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c5aa932745)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerability:
- CVE-2026-55199:
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
handler in src/packet.c that allows a malicious SSH server to cause a
client CPU exhaustion loop by sending a crafted extension count value.
A malicious server can set nr_extensions to 0xFFFFFFFF during key
exchange, causing the client to spin in a tight CPU loop for over 60
seconds because return values from _libssh2_get_string() are unchecked
and the session timeout does not apply to CPU-bound loops.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55199
- 17626857d2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 3c8cfad804)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-6192:
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This
impacts the function opj_pi_initialise_encode in the library
src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The
attack must be carried out locally. The exploit is publicly available
and might be used. The identifier of the patch is
839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a
patch to address this issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-6192
- 839936aa33
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 353007cf40)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The sample script would've passed even if the connections list was
empty. Check that there is at least one connection, and that the
sample script can read loopback device information.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f38f5bb593)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
In 11aa1cfa5a the patch was accidentally
moved into a versioned directory with the wrong version (2.82.0
instead of 2.82.4) and thus not applied. However, there have been no
issues reported.
The patch description mentions being needed to fix build errors in
package/atk and package/libnice. It was originally added in
b094f88a4d, and amended for libnice in
2c916b400b. package/atk was removed in
2c3ca7bea1, because atk has been merged
into at-spi2-core. Both at-spi2-core and libnice are Meson packages,
as was atk at the time of its removal.
Both current packages build with the following configuration (tested
using utils/test-pkg):
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_GOBJECT_INTROSPECTION=y
BR2_PACKAGE_LIBNICE=y
BR2_PACKAGE_AT_SPI2_CORE=y
Evidently the patch is no longer needed, presumably because the
correct search path for GIR files is set by other means, and we can
remove it instead of fixing the version number of the patch directory.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9fabfcb9f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Libglib2-bootstrap is only used as dependency to build
gobject-introspection and then libglib2 with GOI support. It should
not be installed to target, even if in practice libglib2 should
overwrite anything it has installed.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 866462e8dd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerabilities:
GLIBC-SA-2026-0009:
===================
scanf %mc off-by-one heap buffer overflow
Calling the scanf family of functions with a %mc (malloc'd character
match) in the GNU C Library version 2.7 to version 2.43 with a format
width specifier with an explicit width greater than 1024 could result in
a one byte heap buffer overflow.
The bug is in the buffer growth formula in __vfscanf_internal, which
under-allocates by one byte during realloc expansion, allowing a
controlled single-byte overwrite past the end of the heap buffer.
The impact is limited by the fact that to execute the overwrite you need
both user controlled input data and a specific choice of maximum width
that yields a smaller than needed allocation. The latter point has to
take into account malloc's particular chunk size rounding process. The
"%[width]mc" format specifier does not appear to have notable use in
major Linux-based OS distributions, due to which the real world impact
may be limited to bespoke use cases.
CVE-Id: CVE-2026-5450
GLIBC-SA-2026-0010:
===================
Potential buffer under-read in ungetwc
Calling the ungetwc function on a FILE stream with wide characters
encoded in a character set that has overlaps between its single byte and
multi-byte character encodings, in the GNU C Library version 2.43 or
earlier, may result in an attempt to read bytes before an allocated
buffer, potentially resulting in unintentional disclosure of neighboring
data in the heap, or a program crash.
A bug in the wide character pushback implementation
(_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate
on the regular character buffer (fp->_IO_read_ptr) instead of the actual
wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program
crash may happen in cases where fp->_IO_read_ptr is not initialized and
hence points to NULL. The buffer under-read requires a special situation
where the input character encoding is such that there are overlaps
between single byte representations and multibyte representations in
that encoding, resulting in spurious matches. The spurious match case
is not possible in the standard Unicode character sets.
CVE-Id: CVE-2026-5928
https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/
git shortlog b676adadbc1f5fb2f31bc484a7628cca89ae6f22..
DJ Delorie (1):
stdio-common: Allow partially-filled %mc buffers [BZ #12701]
Florian Weimer (1):
iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
Maciej W. Rozycki (2):
support: Implement 'xfmemopen' for seamless 'fmemopen' use
stdio-common: Reject insufficient character data in scanf [BZ #12701]
Rocket Ma (2):
libio: Fix ungetwc operating on byte stream [BZ #33998]
stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes CVE-2025-14087: A flaw was found in GLib (Gnome Lib). This
vulnerability allows a remote attacker to cause heap corruption, leading to
a denial of service or potential code execution via a buffer-underflow in
the GVariant parser when processing maliciously crafted input strings.
https://gitlab.gnome.org/GNOME/glib/-/issues/3834
The fixes were applied upstream as part of 2.86.3, so backport them for the
2.82.5 version currently used by Buildroot LTS.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-33526:
Squid is a caching proxy for the Web. Prior to version 7.5, due to
heap Use-After-Free, Squid is vulnerable to Denial of Service when
handling ICP traffic. This problem allows a remote attacker to perform
a reliable and repeatable Denial of Service attack against the Squid
service using ICP protocol. This attack is limited to Squid
deployments that explicitly enable ICP support (i.e. configure non-
zero `icp_port`). This problem _cannot_ be mitigated by denying ICP
queries using `icp_access` rules. Version 7.5 contains a patch.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-33526
- 8138e909d2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-33515:
Squid is a caching proxy for the Web. Prior to version 7.5, due to
improper input validation, Squid is vulnerable to out of bounds read
when handling ICP traffic. This problem allows a remote attacker to
receive small amounts of memory potentially containing sensitive
information when responding with errors to invalid ICP requests. This
attack is limited to Squid deployments that explicitly enable ICP
support (i.e. configure non-zero `icp_port`). This problem cannot be
mitigated by denying ICP queries using `icp_access` rules. Version 7.5
contains a patch.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-33515
- 8138e909d2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-28525:
SWUpdate contains an integer underflow vulnerability in the multipart
upload parser in mongoose_multipart.c that allows unauthenticated
attackers to cause a denial of service by sending a crafted HTTP POST
request to /upload with a malformed multipart boundary and controlled
TCP stream timing. Attackers can trigger an integer underflow in the
mg_http_multipart_continue_wait_for_chunk() function when the buffer
length falls within a specific range, causing an out-of-bounds heap
read past the allocated receive buffer to a local IPC socket.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-28525
- beee2dc0fe
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(cherry picked from commit 0c6595aaac)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-53614
The SUID binary /usr/bin/mount from util-linux trusts the
environment variable LIBMOUNT_FORCE_MOUNT2 via a raw getenv() call
in libmount/src/hook_mount.c. An unprivileged user can set
LIBMOUNT_FORCE_MOUNT2=always to force the mount process to use the
legacy (non-atomic) bind mount path instead of the secure new mount
API path.
In the legacy path, a bind mount is performed in two separate
syscalls: first mount(src, tgt, MS_BIND) which exposes the source
directory without security flags, then mount(tgt,
MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV) which applies the
flags. Between these two syscalls, a brief window exists where the
bind-mounted directory is visible without nosuid/noexec protection.
A concurrent process can execute a SUID binary from the bind target
during this window.
For more information, see:
- https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx
- cc81bbcec5
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-53613
A TOCTOU vulnerability exists in the SUID binary /usr/bin/mount from
util-linux. When processing restricted (non-root) mount requests,
libmount validates the mount target against /etc/fstab entries and
checks user permissions, but the actual mount()/move_mount() syscall
re-resolves the target pathname. An attacker can use
renameat2(RENAME_EXCHANGE) to atomically swap an ancestor directory
of the mount target between the permission check and the mount
syscall, redirecting an authorized user-directory mount to any
root-owned path (e.g., /etc/sudoers.d).
For more information, see:
- https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g
- b639bf5c42
- 0b010025a0
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-53612
A TOCTOU (Time-of-Check-Time-of-Use) vulnerability exists in the
SUID binary /usr/bin/mount from util-linux. The hook_owner.c
post-mount hook performs path-based chmod() and lchown() operations
on the mount target after mount() has completed, without verifying
that the target path still resolves to the same filesystem object.
An unprivileged local user can exploit this race window using
renameat2(RENAME_EXCHANGE) to redirect the chmod()/lchown() to an
arbitrary path, achieving arbitrary permission/ownership
modification on any file or directory.
For more information, see:
- https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh
- d0c5adaeb3
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2025-14104:
A flaw was found in util-linux. This vulnerability allows a heap
buffer overread when processing 256-byte usernames, specifically
within the `setpwnam()` function, affecting SUID (Set User ID) login-
utils utilities writing to the password database.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-14104
- aaa9e718c8
- 9a36d77012
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
As indicated in the release notes:
https://github.com/cesanta/mongoose/releases/tag/7.22
This release includes a substantial number of security fixes,
reflecting increased use of AI-powered security tools and valuable
contributions from the security research community.
Please note that many of the resolved issues have not yet been assigned
CVE identifiers. The assignment process is underway, and these release
notes will be updated as additional CVEs become available.
Given the large number of security fixes included in that release, bump the
version for Buildroot LTS instead of applying individual patches
Along with the version bump:
- Remove patch for a security issue fixed by the version bump
- Update license hash following the update of the copyright year in
1f9e1a38b5
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 8fe41d5506)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit f89ca996b6 fixed the
build of linux-pam with musl in 2020 but did not remove the restric-
tions in place for login/runuser/su which were added earlier with
these commits:
login (2015): 25ecd24579
runuser (2017): 09860f354a
su (2017): c6488923fb
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 91d356ee7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
- CVE-2026-11940:
tarfile.extractall() with the 'data' or 'tar' filter could be
bypassed by a crafted archive where a hardlink references a symlink
stored at a deeper name than the hardlink itself. The extraction
fallback validated the symlink at it's archived location but
recreated it at the hardlink's shallower path, letting a relative
target the filter judged contained escape the destination directory.
This allowed a malicious tar archive to create a symlink pointing
outside the destination, enabling out-of-destination file reads or
writes. This was an incomplete fix of CVE-2025-4330.
https://www.cve.org/CVERecord?id=CVE-2026-11940
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 1a0164ac81)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Libepoxy is a library for handling OpenGL function pointer management.
It has backends for egl/glx, which may at one point have been mandatory
to enable, but the library now builds with none of the above enabled
features, as seen below.
libepoxy 1.5.10
User defined options
Cross files : /home/joseph/br-test-pkg/arm-aarch64/build/libepoxy-1.5.10//buildroot-build/cross-compilation.conf
b_pie : false
b_staticpic : true
buildtype : release
build.cmake_prefix_path: /home/joseph/br-test-pkg/arm-aarch64/host/lib/cmake
default_library : shared
docs : false
egl : no
glx : no
libdir : lib
build.pkg_config_path : /home/joseph/br-test-pkg/arm-aarch64/host/lib/pkgconfig
prefix : /usr
strip : false
tests : false
x11 : false
Removing these dependencies allows for some applications that require it
as a build dependency, but otherwise can run headless or without GL, to
build and function, using other graphics APIs or display pipelines.
Weston, for example, can still use Vulkan and DRM when linked to
libepoxy without GL/EGL/X11 support.
Acked-by: Arnout Vanecappelle <arnout@rnout.be>
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit cd2583ca0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Commit e8c54ffb3d ("utils/generate-cyclonedx: generate vcs
externalReferences for source repos") added externalReferences to the source
code of packages.
This unfortunately causes issues with packages (in br2-external) fetching
from git using the scp-like syntax, E.G.:
FOO_SITE_METHOD = git
FOO_SITE = git@github.com:<project>/<repo>.git
Which ends up in the SBOM as:
[
{
"type": "vcs",
"url": "git@github.com:<project>/<repo>.git",
"comment": "git repository"
}
]
This (correctly) causes Dependency track to reject the SBOM import with:
{
"status": 400,
"title": "The uploaded BOM is invalid",
"detail": "Schema validation failed",
"errors": [
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the regex pattern ^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",
]
}
The CycloneDX spec indeed requires a URI:
The URI (URL or URN) to the external reference. External references are
URIs and therefore can accept any URL scheme including https (RFC-7230),
mailto (RFC-2368), tel (RFC-3966), and dns (RFC-4501)
https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_url
The user@host:project/repo.git is a git-specific shorthand for a git-over-ssh URL. From man git-clone:
Git supports ssh, git, http, and https protocols (in addition, ftp and ftps
can be used for fetching, but this is inefficient and deprecated; do not use
them).
The native transport (i.e. git:// URL) does no authentication and should
be used with caution on unsecured networks.
The following syntaxes may be used with them:
• ssh://[user@]host.xz[:port]/path/to/repo.git/
• git://host.xz[:port]/path/to/repo.git/
• http[s]://host.xz[:port]/path/to/repo.git/
• ftp[s]://host.xz[:port]/path/to/repo.git/
An alternative scp-like syntax may also be used with the ssh protocol:
• [user@]host.xz:path/to/repo.git/
So convert the scp-like syntax to ssh:// URLs in parse_uris() for spec
compliance.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ebcfdb8b0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
