Version 0.24.10 change log:
* input
- cache: fix deadlock bug
* decoder
- sidplay: support millisecond-precision time stamps
- sidplay: support libsidplayfp version 3
* database
- upnp: allow building with libupnp 1.14.30 which has fixed the API breakage
* Windows
- work around build failure due to zlib bug
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
There is no CVE assigned with the vendor name "cesenta".
The CPE ID introduced in [1], correctly reference "cesanta" as a CPE
vendor but introduced a typo while writing the vendor metadata in
`mongoose.mk`.
[1] 3d632c941f package/mongoose: add MONGOOSE_CPE_ID_VENDOR
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since the last version bump in commit [1] python-sdbus-modemmanager
install step miss-behave following the switch to poetry (as reported
by [2]).
The sdbus-modemmanager python module is intalled in a second
"modemmanager" subdirectory:
$(TARGET_DIR)/lib/python3.14/site-packages/sdbus_block/modemmanager/modemmanager/
This break existing python script using:
from sdbus_block.modemmanager import MMBearer
Fix tool.poetry install step by removing one "modemmanager".
[1] 7c30b1e522
[2] https://github.com/zhanglongqi/python-sdbus-modemmanager/issues/24
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904075359
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- CVE-2026-32853:
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e)
contain a heap out-of-bounds read vulnerability in the UltraZip
encoding handler that allows a malicious VNC server to cause
information disclosure or application crash. Attackers can exploit
improper bounds checking in the HandleUltraZipBPP() function by
manipulating subrectangle header counts to read beyond the allocated
heap buffer.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32853
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
- 009008e2f4
- CVE-2026-32854:
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee)
contain null pointer dereference vulnerabilities in the HTTP proxy
handlers within httpProcessInput() in httpd.c that allow remote
attackers to cause a denial of service by sending specially crafted
HTTP requests. Attackers can exploit missing validation of strchr()
return values in the CONNECT and GET proxy handling paths to trigger
null pointer dereferences and crash the server when httpd and proxy
features are enabled.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32854
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
- dc78dee51a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit [1] updated the Kernel for this test, but forgot to
add the "arm/" prefix for the dtb path. Since Linux 6.5, .dts files
have been moved to "arch/arm/boot/dts/" and the test was not able to
find the file anymore, which caused the build to fail.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14297955524
[1] 74e7e07f83
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Julien: reword commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This reverts commit 51365ff063.
This breaks u-boot < v2025.10 builds using binman, so revert it for now
given that v2025.10 is a quite recent release.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/14249332016
And many more.
Longer term we either want to upgrade all the defconfigs (which will not fix
the issue for external users) or find a way to patch older u-boot versions.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
https://www.python.org/downloads/release/python-3145/https://docs.python.org/release/3.14.5/whatsnew/changelog.html
This release includes various security fixes:
gh-148178: Hardened _remote_debugging by validating remote debug offset
tables before using them to size memory reads or interpret remote
layouts.
gh-149254: Update Android and iOS installer to use OpenSSL 3.0.20.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-90309: Base64-encode values when embedding cookies to JavaScript
using the http.cookies.BaseCookie.js_output() method to avoid injection
and escaping.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor,
bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory
allocation fails with MemoryError, which could let a subsequent
decompress() call read or write through a stale pointer to the already-
released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to
pass the dash-prefix safety check.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser
option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration
line with many whitespace characters could cause excessive CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the
HTTPConnection.set_tunnel() method.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix TDA4VM Starter-Kit defconfig pointing to TD4VM EVM instead of SK R5 and uboot
defconfigs.
The starter kit board boots just fine with the evm defconfigs, but it is more accurate
to use the start kit defconfigs for the starter kit board.
Note: those defconfigs have been present upstream since uboot v2024.10:
c9507f07a1
Signed-off-by: Sofiane HAMAM <sofiane.hamam@smile.fr>
[Julien: add note in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
go1.25.10 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
compiler, the linker, the runtime, and the crypto/fips140, go/types, and os
packages.
https://go.dev/doc/devel/release#go1.25.10
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
go1.26.3 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
go fix command, the compiler, the linker, the runtime, and the
crypto/fips140, crypto/tls, go/types, and os packages.
https://go.dev/doc/devel/release#go1.26.3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following vulnerability:
CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()
libXpm uses a number of internal helper functions to parse the XPM file
format.
One of these internal functions, xpmNextString(), checks for the NULL
terminator when looking for the end of the current string but not when
looking for the beginning of the next string.
A small XPM file with a malformed color table definition may cause the
function xpmNextWord(), called from xpmParseColors() following a call to
xpmNextString(), to start past the actual end of the file, causing an
out-of-bound read.
Advisory:
https://lists.x.org/archives/xorg-announce/2026-April/003690.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport 2 patches from upstream maintenance branch. Same fixes as
required for gcc-14.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport two patches from upstream gcc-14 maintenance branch. Requires
one more patch on top of the fix for gcc-15.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport patch that was applied upstream to the gcc-15 maintenance
branch.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.
Security Fixes:
* CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass ASGI requests with a missing
or understated Content-Length header could bypass the
FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server
level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.
This issue has severity “low” according to the Django security policy
* CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Response headers did not vary on cookies if a session was not modified,
but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a
user’s session after that user visits a cached public page.
This issue has severity “low” according to the Django security policy.
* CVE-2026-6907: Potential exposure of private data due to incorrect
handling of Vary: * in UpdateCacheMiddleware
Previously, UpdateCacheMiddleware would erroneously cache requests where
the Vary header contained an asterisk ('*'). This could lead to private
data being stored and served.
This issue has severity “low” according to the Django security policy.
Bugfixes:
* Fixed a misplaced </div> in the
django/contrib/admin/templates/admin/change_list.html template added
in Django 6.0 that could be problematic when overriding the pagination
block (#37029).
* Fixed a bug in Django 6.0 where deprecation warnings incorrectly
skipped lines from third-party packages prefixed with “django”
(#37067).
Release notes: https://docs.djangoproject.com/en/6.0/releases/6.0.5/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
