Fixes the following vulnerability:
CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()
libXpm uses a number of internal helper functions to parse the XPM file
format.
One of these internal functions, xpmNextString(), checks for the NULL
terminator when looking for the end of the current string but not when
looking for the beginning of the next string.
A small XPM file with a malformed color table definition may cause the
function xpmNextWord(), called from xpmParseColors() following a call to
xpmNextString(), to start past the actual end of the file, causing an
out-of-bound read.
Advisory:
https://lists.x.org/archives/xorg-announce/2026-April/003690.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport 2 patches from upstream maintenance branch. Same fixes as
required for gcc-14.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport two patches from upstream gcc-14 maintenance branch. Requires
one more patch on top of the fix for gcc-15.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport patch that was applied upstream to the gcc-15 maintenance
branch.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.
Security Fixes:
* CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass ASGI requests with a missing
or understated Content-Length header could bypass the
FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server
level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.
This issue has severity “low” according to the Django security policy
* CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Response headers did not vary on cookies if a session was not modified,
but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a
user’s session after that user visits a cached public page.
This issue has severity “low” according to the Django security policy.
* CVE-2026-6907: Potential exposure of private data due to incorrect
handling of Vary: * in UpdateCacheMiddleware
Previously, UpdateCacheMiddleware would erroneously cache requests where
the Vary header contained an asterisk ('*'). This could lead to private
data being stored and served.
This issue has severity “low” according to the Django security policy.
Bugfixes:
* Fixed a misplaced </div> in the
django/contrib/admin/templates/admin/change_list.html template added
in Django 6.0 that could be problematic when overriding the pagination
block (#37029).
* Fixed a bug in Django 6.0 where deprecation warnings incorrectly
skipped lines from third-party packages prefixed with “django”
(#37067).
Release notes: https://docs.djangoproject.com/en/6.0/releases/6.0.5/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The FRR package currently only installs systemv services files. The
upstream package also provides a systemd service file and a service
template file. Install those when systemd is selected as an init
manager.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
And updates the kernel version used for the test_openjdk test to
the last LTS version (6.18.21). instead of 5.10.3, which is quite
old and may not be compatible with the latest OpenJDK versions.
This change was tested by running the openjdk test.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the Device Tree name for the vexpress platform to match the
new directory structure introduced in Linux 6.5.
Since kernel 6.5, the 'arch/arm/boot/dts/' directory was restructured
to avoid having thousands of files in a single folder. Device Trees
for ARM (32-bit) are now organized into subdirectories. For the
Versatile Express platform, the DTS file moved to the 'arm/'
subdirectory.
The build was failing with:
make[3]: *** No rule to make target 'arch/arm/boot/dts/vexpress-v2p-ca9.dtb'. Stop.
Adjust BR2_LINUX_KERNEL_INTREE_DTS_NAME from "vexpress-v2p-ca9" to
"arm/vexpress-v2p-ca9".
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the Device Tree name for the vexpress platform to match the
new directory structure introduced in Linux 6.5.
Since kernel 6.5, the 'arch/arm/boot/dts/' directory was restructured
to avoid having thousands of files in a single folder. Device Trees
for ARM (32-bit) are now organized into subdirectories. For the
Versatile Express platform, the DTS file moved to the 'arm/'
subdirectory.
The build was failing with:
make[3]: *** No rule to make target 'arch/arm/boot/dts/vexpress-v2p-ca9.dtb'. Stop.
Adjust BR2_LINUX_KERNEL_INTREE_DTS_NAME from "vexpress-v2p-ca9" to
"arm/vexpress-v2p-ca9".
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit bump the kernel version of this docker test (5.4->6.18), and thus
fixes several issues preventing the Docker Compose runtime test from
succeeding due to this bump:
Kernel Infrastructure:
The Docker daemon failed to start because the 'nat' table could not
be initialized. This was due to missing legacy Netfilter support.
- Enable CONFIG_NETFILTER_XTABLES_LEGACY to support iptables nat table.
- Enable CONFIG_NAMESPACES and CONFIG_USER_NS for container isolation.
- Enable CONFIG_TUN and CONFIG_VETH for container networking.
- Enable CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC for easier debugging.
Build Fixes:
While building the kernel tools, the libelf header was missing because
objtool was not handled correctly for this kernel version. This resulted
in a fatal error: "gelf.h: No such file or directory".
- Select BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y to build host-libelf.
Resources and Stability:
The previous 512MB of RAM was tight for the stack (Kernel +
Docker + Containerd + Python), potentially leading to Out-Of-Memory kills.
Idem for the disk size for Docker images/layers storage.
- Increase QEMU RAM to 1024MB (-m 1024M).
- Increase rootfs size to 1024MB.
- Switch to EXT4 (BR2_TARGET_ROOTFS_EXT2_4=y) for better stability
and modern feature support required by Docker's storage drivers.
Test Script Adjustments:
- Update rootfs path in the test script to point to rootfs.ext4.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the kernel configuration to support modern storage stacks
required for ISO booting on x86_64.
The transition from 4.19 to 6.18 requires explicit activation of:
- CONFIG_PCI: To discover the emulated IDE/SATA controllers.
- CONFIG_ATA & CONFIG_ATA_PIIX: Modern libATA drivers for QEMU's
chipset (replacing the legacy IDE subsystem).
- CONFIG_SCSI & CONFIG_BLK_DEV_SR: Necessary to handle the CD-ROM
as a SCSI device (/dev/sr0), which is mandatory for ISO9660.
Without these options, the kernel cannot locate or mount the
rootfs from the ISO image.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y :
While building the kernel tools, libelf header is missing because objtools
was not compiled by default on older kernel versions. This results in the following error:
[...]tools/objtool/include/objtool/elf.h:10:10: fatal error: gelf.h: No such file or directory
10 | #include <gelf.h>
That is why BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF was selected to build host-libelf.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Julien: updated kernel to 6.18.21]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Unlike libgpiod2, this version of libgpiod relies on the deprecated GPIO
ABI version 1. This ABI used to be enabled by default. However, since
Linux 7.1-rc1 (commit 7673e4c7f7f9 "Do not enable the v1 uAPI by
default"), this is not the case anymore. Failing to enable the ABI
results in a non-functional libgpiod. For instance:
# gpioinfo
gpioinfo: error creating line iterator: Invalid argument
Fix this by enabling the ABI v1 in LIBGPIOD_LINUX_CONFIG_FIXUPS.
Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The __name__ == '__main__' guard allows importing pkg-stats as a
module using importlib, circumventing the normal module filename
requirements. This in turn makes it possible to test/debug individual
functions.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The file handle can be iterated over directly and each line is used
exactly once, so the only effect of reading all lines into a list
first was higher memory use and complexity.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The filter is supposed to exclude host/target infra from output if the
respective package is not built with the current
configuration.
However, excluding host packages did not work correctly: If keep_host
is False because the host package is not built, the next branch was
checked and included the host infra in output with "target" type if
the target package is built. For a package that support host and
target build, but gets built only for the target, this leads to output
like (Meson example):
meson (target)
host-meson (target)
Skip host infra in the target branch instead. Also include
Package.infra in Package.__str__() result, which was needed for
debugging this bug.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Arnout: add it to the main help text, where it belongs]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Use only one of the classes for "error" or "warning" status so they
look different, and format the error/warning text for both. Do not
make the text a link if the URL is None.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The previous Config.* glob also caught linux/Config.ext.in and
package/php/Config.ext, as well as some backup files created by
editors (e.g. Config.in~ after editing a Config.in file in Emacs),
leading to wrong results depending on directory listing order.
Also use "with" to automatically close the file when the block is
left, even on error.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
I don't use maintain x11vnc in buildroot anymore and can't easily test.
Signed-off-by: Martin Kepplinger-Novaković <martink@posteo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
