Fixes the following security vulnerability:
CVE-2024-10573: An out-of-bounds write flaw was found in mpg123 when
handling crafted streams. When decoding PCM, the libmpg123 may write past
the end of a heap-located buffer. Consequently, heap corruption may happen,
and arbitrary code execution is not discarded. The complexity required to
exploit this flaw is considered high as the payload must be validated by the
MPEG decoder and the PCM synth before execution. Additionally, to
successfully execute the attack, the user must scan through the stream,
making web live stream content (such as web radios) a very unlikely attack
vector.
https://www.openwall.com/lists/oss-security/2024/10/30/2
Release notes:
https://sourceforge.net/p/mpg123/mailman/message/58834094/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 35d2880e33)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerability:
CVE-2024-8508: A vulnerability has been discovered in Unbound when handling
replies with very large RRsets that Unbound needs to perform name
compression for.
https://nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: update pgp key id in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f98b643fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerability:
CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET
https://lists.gnu.org/archive/html/help-libtasn1/2025-02/msg00001.html
Adjust the license files after upstream moved the license clarification to
README.md and moved the COPYING* files top the top level directory /
slightly updated the COPYING* files (http->https) with:
73cc886c3f
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2867f4be42)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When building host-fakeroot on host with large number of CPUs,
compilation can randomly fail. Failures are observed on hosts
with 24 CPUs or more.
Build logs show errors such as:
make -j$(nproc)
...
awk -f ./wrapawk < ./wrapfunc.inp
awk -f ./wrapawk < ./wrapfunc.inp
...
In file included from libfakeroot.c:265:
wraptmpf.h:607: error: unterminated #ifdef
607 | #ifdef __APPLE__
|
wraptmpf.h:601: error: unterminated #ifdef
601 | #ifdef HAVE_FTS_CHILDREN
|
wraptmpf.h:2: error: unterminated #ifndef
2 | #ifndef WRAPTMPF_H
|
...
This commit fixes the issue by adding a package patch.
Fixes:
- https://gitlab.com/buildroot.org/buildroot/-/jobs/9085451831
- https://gitlab.com/buildroot.org/buildroot/-/jobs/9085451244
- https://gitlab.com/buildroot.org/buildroot/-/jobs/9085451198
- and many more...
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 45c13bf249)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The commit b4006287f8 "package/go: security bump to version 1.23.6"
removed the go source from the go-bin package `.hash` file.
Since that commit, a number of autobuild errors for the host-go-bin
package started spawning during the 'legal-info' step.
Because the package 'go-bin' defines the '_ACTUAL_SOURCE_TARBALL'
variable the source hash is still required for the legal-info.
Similarly to the 'nodejs' package, the hash files for both the `go-bin`
and `go-src` package are shared in the `package/go` directory with the
help of a symbolic link used to make the subdirectories point to that
common `.hash` file.
Fixes:
https://autobuild.buildroot.org/results/337/33763441a065ddb07e944e26ad8f1f6d43b68592
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 8b79823577)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The error was introduced by the libcurl bump to 8.12.0 with buildroot
commit 2da031c2e5.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e85cd58fc5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 52154e5206 (package/zstd: build multithreaded library if
supported) added an override of a previously defined variable, so an
explicit check-package exception was added in 0f0e913f10
(package/zstd: rework build and install). Eventually, in 253a951c4f
(package/zstd: fix build without threads) the variable override was
removed.
However, the check-package exception was left out during the rework in
253a951c4f, so it now excludes nothing.
Drop this exception now.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ad25dd6159)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As pointed out by shellcheck, the exit code of the start/stop/restart/reload
command is clobbered by the 'echo "FAIL'" statement:
In package/mdnsd/S50mdnsd line 52:
exit $?
^-- SC2320 (warning): This $? refers to echo/printf, not a previous command. Assign to variable to avoid it being overwritten.
So introduce a $status variable to keep track of it, similar to how it is
done in S40iwd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit be20c12e15)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As host-heimdal is only used by samba4, and samba4 already depends on
host-flex and host-bison, the build issue fixed by this commit is not
directly visible, but can be reproduced by doing "make host-heimdal"
for example in our official Buildroot Docker container:
/home/thomas/projets/buildroot/outputs/foo/build/host-heimdal-f4faaeaba371fff3f8d1bc14389f5e6d70ca8e17/missing: line 81: flex: command not found
WARNING: 'flex' is missing on your system.
You should only need it if you modified a '.l' file.
You may want to install the Fast Lexical Analyzer package:
<https://github.com/westes/flex>
make[4]: *** [Makefile:753: lex.c] Error 127
[...]
updating lex.yylex.c
../../ylwrap: line 176: -d: command not found
make[4]: *** [Makefile:756: parse.c] Error 127
Fix this by adding the missing dependencies.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 44e739d031)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot fails to build Linux kernel configurations where BTF support
is enabled together with zstd compression of debugging information.
The reason is in host-elfutils zstd support being explicitly disabled.
So enable zstd support in host-elfutils by default to fix such builds.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 315672feec)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Chris email address at boundarydevices is bouncing:
Chris Dimich is no longer with Ezurio. Please contact Gary Bisson by
email at Gary.Bisson@ezurio.com. Thank you!"
Move his package to Gary Bisson as suggested.
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 892d1ae27f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since commit [1], test_atf is failing. See [2].
Passing -no-pie to ld does not produce the bl31.elf file (and does not
generate an error). TF-A 2.11 reworked its makefiles and switched to
gcc to link files. This commit fixes this failing test by updating to
this newer TF-A version.
Fixes: [2].
[1] 248c2d045e
[2] https://gitlab.com/buildroot.org/buildroot/-/jobs/8609307891
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit b0ff88423f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes http://autobuild.buildroot.net/results/b24a96b999676990995a466686fe1eacf6cddfef
Some of the optional packages in swipl are written in C++, so CMake thinks a
C++ compiler is needed even though we build with -DSWIPL_PACKAGES=OFF since
the bump to 9.2.6 in commit 33d45b9c67 ("package/swipl: bump version to
9.2.6").
Add -DCMAKE_CXX_COMPILER=true to satisfy this check even in setups without
C++:
-- Check for working CXX compiler: /usr/bin/true
-- Check for working CXX compiler: /usr/bin/true - works
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 868f2dd183)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit [1] introduced the BR2_BROKEN hidden symbol. The intent of
this symbol is to temporarily mark a configuration known to be broken.
This commit was added to fix an undefined usage of the symbol, in a
previous commit [2].
With this somewhat special symbol, it is also perfectly normal to
have no use of it.
Running the command "utils/check-symbols" in a state there is no usage
of the BR2_BROKEN, the script fails with output:
Config.in:15: BR2_BROKEN defined but not referenced
This commit adds an exception for this symbol, allowing it to be
unused in the whole Buildroot tree.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/8925433382
[1] 2ddc5808cd
[2] 11a8cdd2bb
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit fa98239074)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The k3-am62a7-sk.dts describes an I2C PMIC TPS659312 which features a
number of regulators. One of them, ldo1, is used as power supply for the
SD card host controller regulator. When the rootfs is on the SD
card (like with this configuration), we need support for these three
components (Regulator driver, I2C PMIC glue and PMIC MFD driver) to be
built-in in order to avoid boot failures.
Tested on an AM62A LP SK.
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Bryan Brattlof <bb@ti.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 8ba6459ac1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
ARC support was added in 0.10.0 by
4997efa59a
so drop the architecture dependency on !BR2_arc.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 99140408b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since Buildroot commit [1], util-linux libuuid is failing to build
with uclibc toolchains, when there is no thread support
(that is, when BR2_PTHREADS_NONE=y).
Builds are failing with error:
libuuid/src/gen_uuid.c:83:10: fatal error: pthread.h: No such file or directory
83 | #include <pthread.h>
| ^~~~~~~~~~~
This failure is due to the upstream commit [2], which introduced the
pthread dependency.
This commit fixes the issue by adding package patches, disabling
the uuidd cache in case the libptread (or the pthread_atfork function)
is not available.
Fixes:
https://autobuild.buildroot.org/results/e5856cf6f3b8512ededa17d20db2b330a478dd8e/
[1] f14929c657
[2] 25bd5396ab
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8489cb0932)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When glibc was bumped from 2.39 to 2.40 in commit
74cb378aff ("package/{glibc, localdef}:
bump to version 2.40"), the IGNORE_CVES entries should have been
dropped, as they were applicable to the 2.39 branch. Drop them now.
We did verify the pkg-stats output, and those CVEs don't show up as
affecting glibc even after this change, as expected.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4b133efbd3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Take a patch from meta-riscv, which was submitted upstream by Khem Raj
to fix a build issue on RISC-V 32-bit musl configurations. This issue
has been discussed with musl developers who believe this is a Busybox
issue. The patch from Khem works around the issue by making it a
runtime failure just affecting hwclock on RISC-V 32-bit musl instead
of a build failure. The correct fix is not really clear, as there
seems to be a disagreement between Busybox people and musl people on
what the C library settimeofday() function should do, and that's why
Busybox is bypassing settimeofday() on musl by making a direct system
call, except this system call doesn't exist on RISC-V 32-bit.
In the mean time, this patch fixes the long standing Gitlab CI issue:
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslStable
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291684
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslBleedingEdge
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291683
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a956eeb96b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit adds patches, which were all backported from upstream, or
submitted upstream, and that fix various CVEs. To facilitate the
backporting work, we took the backports from openembedded-core.
CVE-2021-42380: this one is not marked by NVD as affecting 1.36.1, but
its fix was merged after 1.36.1, so it seems like the NVD data is
incorrect. Therefore, no need for a BUSYBOX_IGNORE_CVES entry. Patch
is upstream, backport taken from openembedded-core.
CVE-2023-42363, CVE-2023-42364, CVE-2023-42365: patches are upstream,
backports taken from openembedded-core.
CVE-2023-42366: patch has been submitted upstream but not merged,
patch taken from openembedded-core.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 75c594d446)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cuserid is deprecated and breaks the compilation on some new toolchains.
This patch fixes this issue.
Fixes:
#81
Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a141b117e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It fixes an arbitrary file overwrite vulnerability in the readline.sh.
(CVE-2024-54661)
see - http://www.dest-unreach.org/socat/contrib/socat-secadv9.html
README hash changed due to version update.
Note: Buildroot is not impacted by this vulnerability as the
readline.sh is not installed on target.
Quoting changelog [1]:
Mitigating factors: readline.sh is usually neither installed in a bin
directory nor is it documented. Major Linux distributions install it in
examples/ or doc/; however it is invoked by test.sh script.
[1] https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.0.2:/CHANGES
Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
[Julien: add note that Buildroot is not impacted in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d70df3ab44)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
7.2.6:
- (CVE-2024-31449) Lua library commands may lead to stack overflow and
potential RCE
- (CVE-2024-31227) Potential Denial-of-service due to malformed ACL
selectors
- (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern
matching
7.2.7:
- (CVE-2024-46981) Lua script commands may lead to remote code execution
- (CVE-2024-51741) Denial-of-service due to malformed ACL selectors
https://github.com/redis/redis/releases/tag/7.2.6https://github.com/redis/redis/releases/tag/7.2.7
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f3e99436ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
