A new (and hopefully definitive) CPE is to be used for TF-A:
cpe:2.3:o:trustedfirmware:trusted_firmware-a:
as reported in TF-A directly[1]. NVD correctly reports[2] the new CPE
deprecates the "old" one Buildroot was using.
CVEs for projects under the TrustedFirmware umbrella are now seemingly
handled under the CPE vendor "trustedfirmware".
[1] efd7b189fa%5E%21/
[2] https://nvd.nist.gov/products/cpe/detail/2E1BD3E8-DF65-42E3-A0BA-747137D6DEF2
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b7cf802ace)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Changes:
Security and robustness release. Notable cramfsck changes:
* Reject dirent names containing "/", "." or ".." to close a path
traversal during `cramfsck -x` (reported in issue #12).
* Open regular files with O_CREAT|O_EXCL during extraction to
prevent duplicate-dirent attacks from truncating files reached
via a previously-extracted symlink.
* Fix outbuffer NUL termination and a 1-byte overflow in
do_symlink when running with both -v and -x.
* Harden romfs_read against truncated/malformed images by
zero-filling the window buffer and checking lseek/read returns.
* Reject directory entries that extend past their parent's size.
Documentation: README now documents cramfsck and lists all current
mkcramfs options; stale hard-link and endianness claims corrected;
NOTES trimmed of the 25-year-old Future Development section.
(See https://github.com/npitre/cramfs-tools/releases/tag/v2.2)
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2c96a67d9b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 949063f92b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9a7cd39c5d)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 47464cfbe1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 16c5253138)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 19d11b5235)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 55cb1e8eea)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d7f835a4cb)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3eda260ff4)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15c4abfa52)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8f0f84a400)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The Github repository has been renamed from dracut-ng to dracut. The
wiki still exists, but the actual documentation has been moved to
dracut-ng.github.io.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ec8c6e4487)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Bump dracut package source to the newest version of the project,
dracut-ng, release 110.
The original dracut project is now inactive for a long period of time.
Dracut community has transitioned to the dracut-ng fork to continue
development. The migration ensures regular updates for security and bug
fixing, a better support of modern systemd features and kernel
requirements. It also allows alignment with major Linux distributions
(Fedora, Arch Linux, Gentoo), and other open source projects (Yocto).
Changes made :
- dracut.mk: change source to dracut-ng 110
- dracut.hash: adapt hash to dracut-ng 110
- dracut.mk: fix unused systemd symbolic links build error
- Config.in: adapt fs/cpio/Config.in to mention dracut-ng upgrade
- Config.in.host: adapt dracut Config.in.host to mention dracut-ng upgrade
- .checkpackageignore: remove 001-dracut.sh-don-t-unset-LD_PRELOAD.patch
Patch removals and additions :
- Removed 0001-dracut.sh-don-t-unset-LD_PRELOAD.patch:
Upstream dracut-ng removed the 'unset LD_PRELOAD' instruction, making this
patch obsolete.
- Added 0001-fix-functions-prevent-find_binary-from-dropping-last.patch:
Dracut-ng introduced a regression on non-merged-usr architectures.
This was traced down to a bug in find_binary() where a `while read`
loop drops the last PATH element if the string does not end with a colon.
This local patch fixes the Bash EOF read behavior.
Submitted upstream: https://github.com/dracut-ng/dracut-ng/pull/2416
All dracut related runtime tests, including non-merged-usr, have been
locally tested and passed successfully using the reference Buildroot
docker container.
Signed-off-by: Matéo Pourrier <mateo.pourrier@smile.fr>
[Julien: reword commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 90304b7129)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Thanks to the OpenEmbedded community for the patches. This fixes the
following vulnerability:
- CVE-2026-29004:
BusyBox before commit 42202bf contains a heap buffer overflow
vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option
handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent
attackers to trigger memory corruption by sending a crafted DHCPv6
response with a malformed D6_OPT_DNS_SERVERS option. Attackers can
exploit incorrect heap buffer allocation calculations in the
option_to_env() function to cause denial of service or achieve
arbitrary code execution on embedded systems without heap hardening.
https://www.cve.org/CVERecord?id=CVE-2026-29004
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(alternative to commit 5a27004cff)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Based on the work of the OpenEmbedded community. This commit patches the
following vulnerabilities:
- CVE-2026-26157:
A flaw was found in BusyBox. Incomplete path sanitization in its
archive extraction utilities allows an attacker to craft malicious
archives that when extracted, and under specific conditions, may write
to files outside the intended directory. This can lead to arbitrary
file overwrite, potentially enabling code execution through the
modification of sensitive system files.
https://www.cve.org/CVERecord?id=CVE-2026-26157
- CVE-2026-26158:
A flaw was found in BusyBox. This vulnerability allows an attacker to
modify files outside of the intended extraction directory by crafting
a malicious tar archive containing unvalidated hardlink or symlink
entries. If the tar archive is extracted with elevated privileges,
this flaw can lead to privilege escalation, enabling an attacker to
gain unauthorized access to critical system files.
https://www.cve.org/CVERecord?id=CVE-2026-26158
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(alternative to commit 5a27004cff)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The patch `0008-awk.c-fix-CVE-2023-42366-bug-15874.patch` was introduced
in [1]. The IGNORE_CVES entry was removed while the patch is still
present in [2].
Re-introduce this IGNORE_CVES entry.
[1] 75c594d446 package/busybox: fix pending CVEs
[2] f88537c46b package/busybox: drop stale IGNORE_CVES entries
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(alternative to commit 092abbe035)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Localedef is built from the glibc source code, so license information
is the same.
(alternative to commit 187d329d1d)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
This commit patches the following vulnerability:
- CVE-2026-41989:
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow
and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
https://www.cve.org/CVERecord?id=CVE-2026-41989
This has already been addressed on the master branch by the package bump
[1].
[1] 93f486ac56 package/libgcrypt: bump version to 1.12.2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
- CVE-2026-11822:
SQLite before 3.53.2 contains memory corruption vulnerabilities in the
FTS5 full-text search extension that allow attackers to cause process
crashes, memory exhaustion, or arbitrary code execution by supplying a
crafted database with malformed FTS5 page data. Attackers can trigger
an out-of-bounds read in fts5LeafSeek() via an attacker-controlled
loop bound and a heap buffer overflow write in fts5ChunkIterate()
through a crafted continuation page causing an integer underflow,
exploitable when an FTS5 MATCH query is executed against the malicious
database.
- CVE-2026-11824:
SQLite before 3.53.2 contains a heap-based buffer overflow
vulnerability in the FTS5 full-text search extension that allows
attackers to cause a crash or execute arbitrary code by supplying a
crafted database with malicious continuation page metadata specifying
a szLeaf value smaller than 4. Attackers can trigger an integer
underflow in fts5ChunkIterate() causing an inflated remaining byte
count during FTS5 MATCH query processing, leading to a heap buffer
overflow of attacker-controlled data in applications compiled with
SQLITE_ENABLE_FTS5.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-11822
- https://www.cve.org/CVERecord?id=CVE-2026-11824
- https://sqlite.org/src/info/061febcf41ca
- e0b995b2a6
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
- CVE-2026-13595:
A flaw was found in the libblkid library of util-linux. During nested
partition probing, the BSD, Minix, Solaris x86, and UnixWare partition
probers cache a raw pointer to a parent partition entry in a
dynamically allocated array. When subsequent partition additions cause
the array to be reallocated, this pointer becomes stale, leading to a
heap use-after-free read. An attacker who can present a crafted block
device image (for example, via USB insertion or a loop-mounted disk
image) can trigger this flaw without user interaction, as libblkid is
invoked automatically by udev/udisks as root on block-device hot-plug
events. This could lead to limited information disclosure or denial of
service.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-13595
- c0186f14fb
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Commit on master [1] fixed a number of vulnerabilities but the 2025.02.x
branch is still on OpenSSH v9.9p2.
This commit fixes the following vulnerabilities by backporting upstream
patches:
- CVE-2026-59995:
sftp in OpenSSH before 10.4 does not properly constrain the location
of downloaded files when "sftp server:/path ." is used with an
attacker-controlled server.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-59995
- 1b39f39657
- CVE-2026-59996:
scp in OpenSSH before 10.4 may place a file in the parent directory of
an intended directory when the copy occurs between two remote
destinations.
For more information, see:
- 36480181fa
- https://www.cve.org/CVERecord?id=CVE-2026-59996
- CVE-2026-59997:
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first
9 command-line arguments, which can be important if a later command-
line argument would have helped to ensure the intended security
properties of an SFTP connection.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-59997
- e9916c44c1
- CVE-2026-59999:
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to
take precedence over PermitTunnel=yes, but did not.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-59999
- c805b97b67
- CVE-2026-60000:
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial
of service (resource consumption from excessive authentication
attempts) because MaxAuthTries was mishandled for
GSSAPIAuthentication.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-60000
- 5d04ca6af7
- CVE-2026-60001:
sshd in OpenSSH before 10.4 does not always honor the minimum
authentication delay.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-60001
- d43ba60c91
- CVE-2026-60002:
ssh in OpenSSH before 10.4 can have a use-after-free when a server
changes its host key during a key re-exchange. (This outcome occurs
only on the client side.)
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-60002
- e8bdfb151a
The CVE-2026-59998 is windows specific and thus ignored.
[1] 90add0c09e package/openssh: security bump to version 10.4p1
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(alternative to commit 90add0c09e)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Fixes following CVE's:
CVE-2026-70368: Fixed an out-of-bounds memory
access triggered by logging attacker-controlled protocol messages longer
than 1,024 bytes (thanks to AISLE Research and Clemens Lang).
CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
destination filter using alternate local-address encodings and
interface-scoped IPv6 destinations (thanks to AISLE Research and Clemens
Lang).
Complete Changelog is here:
https://www.stunnel.org/NEWS.html
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8b6eea299b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
- Update BOTAN_VERSION to 3.11.1
- Remove 0001-Add-more-value-barriers-to-avoid-compiler-induced-side-channels.patch
as it is already integrated upstream in this version.
Fixed in 3.11.1:
- CVE-2026-34580: Resolve certificate verification bypass bug introduced
in 3.11.0 (GH #5500)
- CVE-2026-34582: Resolve TLS 1.3 client authentication bypass (GH #5599)
Fixed in 3.11.0:
- CVE-2026-32877: Fix a heap over-read during SM2 decryption (GH #5450)
- CVE-2026-32883: Fix an OCSP response forgery vulnerability (GH #5449)
- CVE-2026-32884: Fix a name constraints bypass for DNS names (GH #5448)
- Remove the --disable-altivec configuration option as it has been removed
from the Botan build system in version 3.x
- Optimize the --disable-neon logic using the yx pattern.
In Botan 3.x, the --disable-neon flag is specifically targeted at the
arm32 architecture. Furthermore, Buildroot's BR2_ARM_CPU_HAS_NEON
variable is only defined for 32-bit ARM, which previously caused a
false-positive --disable-neon flag to be passed on AArch64 builds
- Update license.txt hash in botan.hash due to the copyright year update
to 2026
https://botan.randombit.net/news.html#version-3-11-1-2026-03-31
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: fix CVE numbers in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 402c94c2d7)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
