Commit Graph

75759 Commits

Author SHA1 Message Date
Julien Olivain
1e84c22867 configs/ls1028ardb: linux needs host-openssl
Since Buildroot commit [1] updating the defconfig to use Kernel 6.6.x
series, the build can fail with error:

    certs/extract-cert.c:21:10: fatal error: openssl/bio.h: No such file or directory

The issue is generally masked by the build order, as
arm-trusted-firmware selects BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP=y
which requires host-openssl.

The issue can be reproduced in the Buildroot Docker reference image,
using the commands:

    utils/docker-run
    make ls1028ardb_defconfig
    make linux

This commit fixes the issue by explicitly adding
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y to the defconfig.

[1] 7cbc240ac2

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d0ec3b6a4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:26 +02:00
Dario Binacchi
1b62d196cc DEVELOPERS: add Dario Binacchi for ti-k3-boot-firmware
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a6a2cbae53)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:23 +02:00
Thomas Perale
e1a65c261d package/libarchive: security bump to version 3.7.9
Fixes the following security issues:

- CVE-2024-57970: libarchive through 3.7.7 has a heap-based buffer
    over-read in header_gnu_longlink in archive_read_support_format_tar.c
    via a TAR archive because it mishandles truncation in the middle of a
    GNU long linkname.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-57970
  - 8291210321

- CVE-2025-1632: This affects the function list of the file bsdunzip.c.
    The manipulation leads to null pointer dereference. It is possible
    to launch the attack on the local host.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-1632
  - c9bc934e7e

- CVE-2025-25724: list_item_verbose in tar/util.c in libarchive through 3.7.7
    does not check an strftime return value, which can lead to a denial of
    service or unspecified other impact via a crafted TAR archive that is read
    with a verbose value of 2.
    For example, the 100-byte buffer may not be sufficient for a custom locale.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-25724
  - c9bc934e7e

The patch added in [1] are still needed for this version bump.

For more details on the version bump, see the release notes:
  - https://github.com/libarchive/libarchive/releases/tag/v3.7.8
  - https://github.com/libarchive/libarchive/releases/tag/v3.7.9

[1] 9ac63a3360 package/libarchive: fix uclibc build with libiconv (again)

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fde0b3fe1c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:21 +02:00
Thomas Perale
4cbce8e3d1 package/augeas: add upstream security fix for CVE-2025-2588
Fixes the following security issue:

- CVE-2025-2588: This vulnerability affects the function
    re_case_expand of the file src/fa.c. The manipulation of the
    argument re leads to null pointer dereference

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-2588
  - af2aa88ab3

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: add patch name in comment near _IGNORE_CVES]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c497e5fcc7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:19 +02:00
Thomas Perale
eed3298732 package/libcoap: bump version to 4.3.5
The patch introduced in [1] that fixed the CVE-2024-0962 is now
available upstream in the 4.3.5 release [2].

This commit also updates the LICENSE file hash, after adding reference
to wolfSSL in [3].

For more details see the release note:
https://github.com/obgm/libcoap/blob/v4.3.5/ChangeLog

[1] 9002b818be package/libcoap: fix CVE-2024-0962
[2] 2b28d8b0e9
[3] e3a662a934

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix LICENSE file hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4df4d1d312)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:16 +02:00
Marcus Hoffmann
da7d91df29 package/libndp: security bump to version 1.9
Fixes: CVE-2024-5564 [1][2]

[1] https://www.cve.org/CVERecord?id=CVE-2024-5564
[2] 05e4ba7b0d

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 49c73215d3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:14 +02:00
Giulio Benetti
553b89d895 package/mali-driver: bump to version 2025-04-06
This version builds up to Linux version 6.13.

Fixes:
https://autobuild.buildroot.org/results/e71/e71a5b46affe5948c16a0c83534d8f56f69b6e91/
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9e7e255a09)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:12 +02:00
Dario Binacchi
3e10b465be package/apr: bump to version 1.7.5
Release notes:
https://downloads.apache.org/apr/CHANGES-APR-1.7

Note: the upstream release note mention v1.7.5 is a security update.
The package patch 0004-Merge-r1920082-from-1.8.x.patch in Buildroot
was already fixing this security issue. This is why this commit is
not marked as a security bump.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 051392a878)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-16 10:51:09 +02:00
Thomas Perale
3c6df76adf package/dillo: remove trailing slash in _SITE url
Commit f2a862fe60 (package/dillo: move to github) changed the source
site for the Dillo package. This change introduced a trailing slash at
the end of the URL.

This cause an error when running `make show-info` with `BR2_PACKAGE_DILLO=y`:

```
package/dillo/dillo.mk:46: *** DILLO_SITE (https://github.com/dillo-browser/dillo/releases/download/v3.0.5/) cannot have a trailing slash.  Stop.
```

This commit removes the trailing slash.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a3b4ae2eac)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:48 +02:00
Thomas Petazzoni
ed5c6f3625 package/glibc: disable on RISC-V ilp32f and lp64f, not supported
glibc fails to build on RISC-V 32-bit with the ilp32f ABI and on
RISC-V 64-bit with the lp64f: both use single-point precision floating
point, which glibc doesn't support, failing during the configure step
with:

  configure: error: glibc does not yet support the single floating-point ABI

Fix that by disabling glibc support on those configurations.

Fixes:

  https://autobuild.buildroot.org/results/fe8d569cab507992978ef0da649278dd3a9e0b23/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8292b8fb89)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:47 +02:00
Romain Naour
e2d0b5b9bf support/download/svn: use 'svn info' whith LC_ALL=C
Use the 'C' locale when retrieving the date of the last change using
'svn info' since the svn download helper script expect
"Last Changed Date" string.

If another locale is used, the 'date' is empty so the generated
archive (by mk_tar_gz) will not match the expected hash since
the file timestamp is not set properly.

If LANG=fr_FR.UTF-8 is defined in the host system, svn print some
"French encrypted" text:

  eval svn --non-interactive --config-option servers:global:http-timeout=10 info ''\''https://svn.code.sf.net/p/xmlrpc-c/code/advanced@r3176'\'''
  ...
  Date de la dernière modification: 2023-09-02 19:13:35 +0200 (sam. 02 sept. 2023)

diffoscope confirm that the file timestamp is not set correctly
in the generated archive:

$ diffoscope NOK/libxmlrpc-r3176-svn5.tar.gz OK/libxmlrpc-r3176-svn5.tar.gz

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8d3b1781f6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:46 +02:00
Gilles Bardoux
0800072403 package/python-twisted: fix cpe id vendor
twistedmatrix is deprecated, twisted is the current cpe id vendor
for python-twisted.

See:
https://nvd.nist.gov/products/cpe/detail/A38171CB-8F75-4CE2-8C00-229D4A8F1C0E

Signed-off-by: Gilles Bardoux <gilles.bardoux@sagemcom.com>
[Julien: reformat patch and add nvd link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1747ebf29b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:45 +02:00
Gilles Bardoux
ee7c227b16 package/python-fastapi: fix cpe id vendor
fastapi_project is deprecated, tiangolo is the current cpe id vendor
for python-fastapi.

See:
https://nvd.nist.gov/products/cpe/detail/4339522D-F85C-4C37-966F-A5CFF72D1D04

Signed-off-by: Gilles Bardoux <gilles.bardoux@sagemcom.com>
[Julien: reformat patch and add nvd link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6a1eca91b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:44 +02:00
Arnout Vandecappelle
d1f9d9ca5f DEVELOPERS: change arnout's address
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e6418ecad4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:43 +02:00
Matheus Tavares Bernardino
cdde0b563c linux: fix broken mailing list link (404)
Signed-off-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4ba51914e9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:42 +02:00
Thomas Devoogdt
9d3872edea package/cairo: bump to 1.18.4
News:
- https://www.cairographics.org/news/cairo-1.18.4/

Other changes:
- 0001-cairo-ft-private.h-fix-missing-FT_Color-error.patch
  has been dropped because it's upstream. [1]

- c_std=gnu11 override has been dropped because
  it's upstream. [2]

- Use the new 'lzo' option. [3]

[1] 9607e19a9e
[2] b60f47dfd5
[3] c1748e79f0

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 90bbe4f469)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:40 +02:00
Thomas Devoogdt
c76f11bffe package/libsoup3: bump to 3.6.5
News:
- https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.3.news
- https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.4.news
- https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.5.news

Also drop the krb5_config, which was dropped in commit
123eb029bf.

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b896dca532)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:39 +02:00
Bernd Kuhls
66273b5e10 package/freeswitch: fix build with GCC 14.x
Fixes:
https://autobuild.buildroot.org/results/33c/33c41d8da8190933d863ed6f75e5d586d1c22a2f/

Build error is also present on the 2024.11.x branch:
https://autobuild.buildroot.org/results/7eef69e6587783307cd9231abdc4a2fee60c075f/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8c439db4a1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:38 +02:00
Yann E. MORIN
ed273e241f package/freerdp: bump to latest commit on legacy stable branch
FreeRDP fails to build on newer gcc:

    /freerdp-2.11.7/libfreerdp/core/info.c:88:39: error: initialization of 'const WCHAR *' {aka 'const short unsigned int *'} from incompatible pointer type 'BYTE *' {aka 'unsigned char *'} [-Wincompatible-pointer-types]
       88 |                 const WCHAR* domain = Stream_Pointer(s);
          |                                       ^~~~~~~~~~~~~~

There is a patch upstream [0] to fix that one, but then another similar
build failure triggers, which is also fixed upstream, but then a third
failre triggers, again fixed upstream [2], but then...

FreeRDP 2.x has been kinda discontinued, and the new stable is 3.x.
However, bumping to 3.x looks like a huge leap.

So, rather than backport, just bump to the latest commit on the
stable-2.0 branch, which carries 12 non-merge commits with build fixes:
    562ae3588 [winpr,pubsub] add NULL parameter checks
    68c7c21b9 X11 client: ignore grab related LeaveNotify events
    a9deecc99 fix [core]: 'invalid hHandle' errors
    052c525e0 [core] eliminate rdpRdp::instance
    be23ed4ba [server,proxy] deactivate capture module
    5b2b53b15 [warnings] fix -Wincompatible-pointer-types
    67818bddb [client,wayland] fix const correctness
    d2b6771c7 X11: fix pointer/integer type mismatch
[2] 7894a7dfc redirection: Fix incompatible pointer type
[1] f3ed1f1ac redirection: Fix incompatible pointer type
[0] 4f411197d info: Fix incompatible pointer type
    a383740a2 next-dev-2.11.8-dev

Fixes:
    http://autobuild.buildroot.org/results/e1b/e1b95b4fb0005d4e933b027b508cec9ad510bd73/
    http://autobuild.buildroot.org/results/ba0/ba0beae13e1be2573878ee50b1566f4427b269a3/
    ...

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15f15cfe01)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:37 +02:00
Peter Seiderer
cd29193cc1 package/v4l2loopback: fix v4l2loopback-ctl compile/install
Since upstream commit [1] the original v4l2loopback-ctl bash script was
replaced by a C version, so add a proper compile step (and remove bash
runtime dependency) to fix '[help] v4l2loopback package build fails for
raspberrypi5' [2].

The issue can be reproduced with the commands:

    cat <<EOF >.config
    BR2_aarch64=y
    BR2_TOOLCHAIN_EXTERNAL=y
    BR2_LINUX_KERNEL=y
    BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
    BR2_PACKAGE_V4L2LOOPBACK=y
    BR2_PACKAGE_V4L2LOOPBACK_UTILS=y
    EOF
    make olddefconfig
    make v4l2loopback

Note: upstream commit [1] was introduced in version v0.13.0.
Buildroot bumped v4l2loopback to v0.13.2 in [3].

Fixes:

  /usr/bin/install: cannot stat
  '.../build/v4l2loopback-0.13.2/utils/v4l2loopback-ctl':
  No such file or directory

[1] 33922fa4e9
[2] https://lists.busybox.net/pipermail/buildroot/2025-March/775911.html
[3] 02540771bc

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[Julien:
 - add commands to reproduce the issue
 - add reference to buildroot commit introducing the issue
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d85d23e16)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:36 +02:00
Bernd Kuhls
1211e4125e package/tor: bump version to 0.4.8.16
Release notes:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
https://forum.torproject.org/t/stable-release-0-4-8-16/18062

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fed4ccb181)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:35 +02:00
Peter Korsgaard
03dd684279 package/mbedtls: security bump to version 2.8.10
Fixes the following security issues:

- CVE-2025-27809: Note that TLS clients should generally call
  mbedtls_ssl_set_hostname() if they use certificate authentication (i.e.
  not pre-shared keys).  Otherwise, in many scenarios, the server could be
  impersonated.  The library will now prevent the handshake and return
  MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if
  mbedtls_ssl_set_hostname() has not been called.

  https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/

- CVE-2025-27810: Zeroize temporary heap buffers used in PSA operations.
  Fix a vulnerability in the TLS 1.2 handshake.  If memory allocation
  failed or there was a cryptographic hardware failure when calculating the
  Finished message, it could be calculated incorrectly.  This would break
  the security guarantees of the TLS handshake.

  https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/

For more details, see the release notes:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 91bfce113e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:34 +02:00
Bernd Kuhls
1f129b9382 package/exim: security bump version to 4.98.2
Fixes CVE-2025-30232:
https://lists.exim.org/lurker/message/20250326.140105.6b97555b.en.html
https://exim.org/static/doc/security/CVE-2025-30232.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e242a5908c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:33 +02:00
Peter Korsgaard
1d7229cfb8 package/xserver_xorg-server: security bump to version 21.1.16
21.1.14 fixes the following security issues:

1) CVE-2024-9632: Heap-based buffer overflow privilege escalation in
_XkbSetCompatMap

Introduced in: xorg-server-1.1.1 (2006)
Fixed in: xorg-server-21.1.14 and xwayland-24.1.4
Fix:
85b7765714
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.

However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.

This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).

xorg-server-21.1.14 and xwayland-24.1.4 have been patched to fix this issue.

https://lists.x.org/archives/xorg-announce/2024-October/003545.html
https://lists.x.org/archives/xorg-announce/2024-October/003546.html

21.1.16 fixes the following security issues:

1) CVE-2025-26594: Use-after-free of the root cursor

Introduced in: Unknown - Prior to X11R6.6 Xorg baseline
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The root cursor is referenced in the xserver as a global variable. If
a client manages to free the root cursor, the internal reference points
to freed memory and causes a use-after-free.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

2) CVE-2025-26595: Buffer overflow in XkbVModMaskText()

Introduced in: Prior to X11R6.1
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The code in XkbVModMaskText() allocates a fixed sized buffer on the
stack and copies the names of the virtual modifiers to that buffer.

The code however fails to check the bounds of the buffer correctly and
would copy the data regardless of the size, which may lead to a buffer
overflow.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

3) CVE-2025-26596: Heap overflow in XkbWriteKeySyms()

Introduced in: initial version of xc/programs/Xserver/xkb/xkb.c in X11R6
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The computation of the length in XkbSizeKeySyms() differs from what is
actually written in XkbWriteKeySyms(), which may lead to a heap based
buffer overflow.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

4) CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey()

Introduced in: X11R6.1
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

If XkbChangeTypesOfKey() is called with 0 group, it will resize the key
symbols table to 0 but leave the key actions unchanged.

If later, the same function is called with a non-zero value of groups,
this will cause a buffer overflow because the key actions are of the wrong
size.

5) CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()

Introduced in: xorg-server-1.14.0
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The function GetBarrierDevice() searches for the pointer device based on
its device id and returns the matching value, or supposedly NULL if no
match was found.

However the code will return the last element of the list if no matching
device id was found which can lead to out of bounds memory access.

6) CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()

Introduced in: Xorg 6.8.0.
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The function compCheckRedirect() may fail if it cannot allocate the backing
pixmap. In that case, compRedirectWindow() will return a BadAlloc error
without the validation of the window tree marked just before, which leaves
the validate data partly initialized, and the use of an uninitialized pointer
later.

7) CVE-2025-26600: Use-after-free in PlayReleasedEvents()

Introduced in: X11R5
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed and replaying the events
will cause a use after free.

8) CVE-2025-26601: Use-after-free in SyncInitTrigger()

Introduced in: X11R6
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

When changing an alarm, the values of the change mask are evaluated one
after the other, changing the trigger values as requested and eventually,
SyncInitTrigger() is called.
If one of the changes triggers an error, the function will return early,
not adding the new sync object.
This can be used to cause a use after free when the alarm eventually
triggers.

https://lists.x.org/archives/xorg-announce/2025-February/003584.html
https://lists.x.org/archives/xorg-announce/2025-February/003585.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 65be2c6ac0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:32 +02:00
Bernd Kuhls
b60166acf1 {linux, linux-headers}: bump 6.6.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7491f5fabc)
[Thomas: don't update 6.{12,13}.x, not in 2024.11.x]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:31 +02:00
Bernd Kuhls
1c2bf818aa package/tinyxml2: security bump version to 11.0.0
Release notes:
https://github.com/leethomason/tinyxml2/releases/tag/10.1.0
https://github.com/leethomason/tinyxml2/releases/tag/11.0.0

Fixes CVE-2024-50615: https://github.com/advisories/GHSA-884x-p7qm-gq3f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4087461203)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:29 +02:00
Bernd Kuhls
7578af8def package/mc: bump version to 4.8.33
Changelog: https://github.com/MidnightCommander/mc/blob/master/doc/NEWS

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9494da280d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:28 +02:00
Fiona Klute (WIWA)
611c49acf3 package/mesa3d-demos: fix build failure on musl
Patch has been on upstream main for close to 2 years.

The "uint" use was introduced with [1] and [2], released with
mesa3d-demos 9.0.0 from March 2023, and added to Buildroot with commit
80304d9911 "package/mesa3d-demos: bump version to 9.0.0". The affected
code is built only if Wayland and Vulkan support are enabled, that is:

BR2_PACKAGE_LIBDECOR=y
BR2_PACKAGE_VULKAN_LOADER=y
BR2_PACKAGE_WAYLAND=y

[1] 813ebef767
[2] 5aaa7faeb4

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cf4f2f858d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:27 +02:00
Fiona Klute (WIWA)
68feea01df package/mesa3d-demos: depend on vulkan-loader if enabled
Vulkan support in mesa3d-demos requires vulkan-loader. Without an
explicit config flag it is autodetected, and may or may not be enabled
depending on build order, leading to unpredictable results.

Fix this by explicitly enabling Vulkan support and depending on
vulkan-loader if BR2_PACKAGE_VULKAN_LOADER=y, and disabling Vulkan
support otherwise.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7a55e82cb8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:26 +02:00
Bernd Kuhls
1723303a62 package/tor: bump version to 0.4.8.15
Release notes:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
https://forum.torproject.org/t/stable-release-0-4-8-15/17998

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f9a02e7b80)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:25 +02:00
Niklas Cassel
79494bba29 package/linux-tools: selftests: Add path containing BPF binary to _BIN_ARCH_EXCLUDE
Enabling BR2_PACKAGE_LINUX_TOOLS_SELFTESTS (on rock5b_defconfig,
which uses kernel 6.12 at the time of writing), results in:

make[1]: Leaving directory '/br/output/build/linux-endpoint-test/tools/testing/selftests'
ERROR: architecture for "/usr/lib/kselftests/tc-testing/action-ebpf" is "Linux BPF", should be "AArch64"
make: *** [package/pkg-generic.mk:402: /br/output/build/linux-tools/.stamp_installed] Error 1

To solve this, add /usr/lib/kselftests/tc-testing/ to
LINUX_TOOLS_BIN_ARCH_EXCLUDE.

Signed-off-by: Niklas Cassel <cassel@kernel.org>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a03cb2ad6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:24 +02:00
Niklas Cassel
8cb5263d38 package/linux-tools: perf: Fix _BIN_ARCH_EXCLUDE
support/scripts/check-bin-arch has an option -i to exclude a path
(or many paths by using -i multiple times).

This was implemented in commit 01d90f0d09 ("spport/check-bin-arch:
accept arbitrary per-package ignore paths").

Looking at this feature (which hasn't changed since being added),
we can see that check-bin-arch automatically adds a trailing slash
to all entries specified using -i.

Thus, specifying a path to a file, e.g.
"/usr/libexec/perf-core/tests/pe-file.exe" will cause check-bin-arch
to add "/usr/libexec/perf-core/tests/pe-file.exe/" to the IGNORES array.

When running the main loop, the file
"/usr/libexec/perf-core/tests/pe-file.exe" will thus not be ignored,
since it will not trigger a match the pattern that was added to the
IGNORES array ("/usr/libexec/perf-core/tests/pe-file.exe/").

This means that the -i option in check-bin-arch only supports directories
and not files.

Fix the LINUX_TOOLS_BIN_ARCH_EXCLUDE in
package/linux-tools/linux-tool-perf.mk.in to specify a directory, as the
existing LINUX_TOOLS_BIN_ARCH_EXCLUDE can never have actually worked.

Fixes: a7ad781626 ("package/linux-tools: Exclude checking PE binaries from perf test")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4d7292675a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:23 +02:00
Sébastien Szymanski
fee4b78429 support/kconfig: handle backspace (^H) key
This is in the mainline kernel since v5.1-rc3:
9c38f1f04408 ("kconfig/[mn]conf: handle backspace (^H) key")

Quoting the commit's log:

"
Backspace is not working on some terminal emulators which do not send the
key code defined by terminfo. Terminals either send '^H' (8) or '^?' (127).
But currently only '^?' is handled. Let's also handle '^H' for those
terminals.
"

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d65c10c20a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:22 +02:00
Colin Evrard
6dd9b8c196 package/libmodsecurity: security bump to 3.0.14
The project has been updated, including
security fixes to issues present in version 3.0.13.

- Fixes:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27110

- For a full changelog, visit:
  https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.14/CHANGES

Signed-off-by: Colin Evrard <colin.evrard@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29cf86b8d0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:21 +02:00
Frank Vanbever
42a08ee3a5 package/libmodsecurity: bump to version 3.0.13
For release note, see:
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.13

- Drop 0001-configure.ac-drop-usage-of-git-at-configure-time.patch
  The package originally had to be reconfigured to patch in uclinux
  support. The fix has been merged upstream [1]. We no longer need to
  reconfigure the package so we can drop this patch.

[1] https://github.com/owasp-modsecurity/ModSecurity/pull/2235

Signed-off-by: Frank Vanbever <frank.vanbever@mind.be>
[Julien:
 - add link to release note
 - update .checkpackageignore to fix check-package errors
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0748e761e2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:20 +02:00
Peter Korsgaard
8fdf9ed8d2 Update for 2024.11.3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024.11.3
2025-03-24 17:43:27 +01:00
Yann E. MORIN
324856a3a4 package/libopenssl do not build in parallel
With highly parallel builds on a heavily loaded machine, the libopenssl
build often (about half of the time) fails with spurious missing rules
in its Makefile:

    >>> host-libopenssl 3.4.1 Installing to host directory
    [...] /usr/bin/make  -C [...]/build/host-libopenssl-3.4.1 install
    "/usr/bin/make" depend && "/usr/bin/make" _build_libs
    "/usr/bin/make" depend && "/usr/bin/make" _build_modules
    "/usr/bin/make" depend && "/usr/bin/make" _build_programs
    [...]
    make[3]: *** No rule to make target '_build_modules'.  Stop.
    make[2]: *** [Makefile:3159: build_modules] Error 2
    make[2]: *** Waiting for unfinished jobs....
    make[3]: Nothing to be done for '_build_programs'.
    make[3]: Nothing to be done for '_build_libs'.
    make[1]: *** [package/pkg-generic.mk:283: [...]/build/host-libopenssl-3.4.1/.stamp_host_installed] Error 2
    make[1]: *** Waiting for unfinished jobs....
    [...]
    make: *** [Makefile:23: _all] Error 2

Ideally, we'd like to fix the issue. However, the Nakefile is generated
by the Configure script, written in perl, from the template in
Configurations/unix-Makefile.tmpl, which also uses some kind of special
(perl-related, probably) templating language. That makes it pretty
difficult to see what is going on, though, and nigh impossible to fix
without a deep understanding of the openssl buildsystem.

So, we can only disable parallel builds until the issue is fixed
upstream [0]. Add a comment to both build commands (host and target) to
reference the upstream issue report.

Note that the issue has mostly been observed in the build of the host
variant so far, but there is no reason why it can't happen in the build
of the target variant.

[0] https://github.com/openssl/openssl/issues/27074

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 27ab880ebb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 13:13:26 +01:00
Waldemar Brodkorb
98a01c9aca package/expat: security update to 2.7.0
Fixes CVE-2024-8176.

For more details, see:
https://blog.hartwork.org/posts/expat-2-7-0-released/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dcd6bea6ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 13:12:35 +01:00
Peter Korsgaard
5b357927f0 package/rauc: needs libopenssl, not libressl
Fixes http://autobuild.buildroot.net/results/6efc1275d3aac9f0a4c000f3d0911b5a880e495d/

Rauc uses X509_PURPOSE_get_by_id() since rauc-1.3 with commit 375dbb16dd94
("src/signature: add support for codesigning certificate purpose"):

../src/signature.c: In function 'signature_init':
../src/signature.c:97:13: warning: implicit declaration of function 'X509_PURPOSE_get_by_id'; did you mean 'X509_PURPOSE_get_id'? [-Wimplicit-function-declaration]
   97 |         if (X509_PURPOSE_get_by_id(id) >= 0) {

Which is not provided by LibreSSL:

nm -D target/usr/lib/libcrypto.so | grep X509_PURPOSE_
00000000001377b0 T X509_PURPOSE_get0
0000000000137850 T X509_PURPOSE_get0_name
0000000000137860 T X509_PURPOSE_get0_sname
00000000001377d0 T X509_PURPOSE_get_by_sname
00000000001377a0 T X509_PURPOSE_get_count
0000000000137840 T X509_PURPOSE_get_id

So force the use of libopenssl.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9679ddbcd0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 11:25:28 +01:00
Alex Bennée
4085ca3069 package/fio: explicitly control libnfs dependency
The upstream uses pkg-config to detect and enable libnfs usage if it
is found [1]. This can get confused by the host configuration so at the
least we should disable detection if we are not planning to build with
it.

Note: the fio configure script accept both --enable-libnfs
and --disable-libnfs since upstream commit [2], first included
in fio v3.31. In Buildroot, this is supported since [3].

[1] https://github.com/axboe/fio/blob/fio-3.38/configure#L2360
[2] 98ab12629c
[3] 256395d8e5

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[Julien: add extra info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fc690631ca)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 11:05:28 +01:00
Bernd Kuhls
c1d85f148a {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a79c862fa1)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 10:59:03 +01:00
Bernd Kuhls
7379a1e451 package/php: security bump version to 8.3.19
Changelog: https://www.php.net/ChangeLog-8.php#PHP_8_3

Release notes: https://news-web.php.net/php.announce/455
"(The 8.3.18 release was skipped due to the erroneous omission of a
non-security related patch.)"

Fixes CVE-2024-11235, CVE-2025-1219, CVE-2025-1736, CVE-2025-1861,
CVE-2025-1734, and CVE-2025-1217.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit befd90b765)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-22 14:00:31 +01:00
Yevhen Babiichuk (DustDFG)
48505536f6 package/llvm-project/compiler-rt: remove duplicate parameter
The COMPILER_RT_STANDALONE_BUILD parameter was passed twice.  One time as
FALSE and immediately after as TRUE which overrides previous value, so drop
the first one.

Signed-off-by: Yevhen Babiichuk (DustDFG) <dfgdust@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit acc7ce7262)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-22 08:37:23 +01:00
Yevhen Babiichuk (DustDFG)
6dd33c2779 package/{odb,sdbusplus}: use "host <foo>" prompt
For consistency with the other host packages.

Signed-off-by: Yevhen Babiichuk (DustDFG) <dfgdust@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6979ee5db0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-22 08:37:07 +01:00
Thomas Devoogdt
d3c48508b2 package/webkitgtk: bump to 2.46.4
Stable release to the 2.46 series.

Release notes:

  https://webkitgtk.org/2024/09/17/webkitgtk2.46.0-released.html
  https://webkitgtk.org/2024/09/30/webkitgtk2.46.1-released.html
  https://webkitgtk.org/2024/10/21/webkitgtk2.46.2-released.html
  https://webkitgtk.org/2024/10/30/webkitgtk2.46.3-released.html
  https://webkitgtk.org/2024/11/27/webkitgtk2.46.4-released.html

Added BR2_PACKAGE_WEBP_MUX to fix this error:

-- The following WebP libraries were not found:
--  mux (required)

Added USE_SYSTEM_SYSPROF_CAPTURE=OFF to fix this error:

-- Checking for module 'sysprof-capture-4'
--   Package 'sysprof-capture-4', required by 'virtual:world', not found
-- Could NOT find SysProfCapture (missing: SysProfCapture_LIBRARY SysProfCapture_INCLUDE_DIR)

For now, use USE_SKIA=OFF which is the replacement for cairo.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a199751e5b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-21 22:20:58 +01:00
Daniel Palmer
3c1c7d5179 package/musl: Add upstream patch to fix building strace on m68k
Fixes:
http://autobuild.buildroot.net/results/ec3de790a66373f270f731519e2ef51c293ba683/

Currently it's not possible to build strace on m68k when using
musl because the version of musl in buildroot doesn't have the
m68k specific definitions of POLLWRNORM and POLLWRBAND.

This is already fixed upstream so manually apply the patch
until the next release.

Signed-off-by: Daniel Palmer <daniel@0x0f.com>
[Peter: add autobuilder ref and upstream link / s-o-b in patch description]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3e88ba41a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-21 15:59:40 +01:00
Bernd Kuhls
fdd59f82c0 {linux, linux-headers}: bump 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a3c3c2cc3b)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:30:55 +01:00
Quentin Schulz
1dda0987a0 package/libcamera: force-disable qcam for now
Fixes:
http://autobuild.buildroot.net/results/5b0dc8acd491f1d7b20f5b5f065b28212b9d4912/
http://autobuild.buildroot.net/results/61e4bce00a2aff3f531de6c1896d4dc1f92ba5e3/

qcam is based on Qt6 since commit 71aa3ceec30b ("apps: qcam: Port to Qt
6") which is part of the v0.3.1 release.

qcam being enabled when BR2_PACKAGE_QT5BASE_WIDGETS symbol is defined
breaks the build as it's missing the qt6 dependencies.

The migration to Qt 6 for the Buildroot package isn't straightforward
though as we're hitting a meson bug[1].

For now, let's just always disable qcam until we can get everything
fixed and migrated properly.

[1] https://github.com/mesonbuild/meson/issues/13018

Fixes: 72757d111a ("package/libcamera: bump to version 0.3.2")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1c653dd19f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:24:51 +01:00
Daniel Palmer
4d779a7d2d package/prboom: Fix big endian fix up
The hack to force big endian support when building
for a big endian machine doesn't work as there is
some whitespace between "#" and "undef" in config.h.

Add a wildcard between those two so that the target
line matches and the replacement is done.

Allows me to play DOOM on my LC475.

Signed-off-by: Daniel Palmer <daniel@0x0f.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ebcd82198f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:23:59 +01:00
Julien Olivain
e33e8a43a3 package/libjxl: security bump to version 0.11.1
For release notes since v0.11.0, see:
https://github.com/libjxl/libjxl/releases/tag/v0.11.1

Fixes:
https://www.cve.org/cverecord?id=CVE-2024-11403
https://www.cve.org/cverecord?id=CVE-2024-11498

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5dab98d721)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:10:38 +01:00