Commit Graph

47141 Commits

Author SHA1 Message Date
Yann E. MORIN
2bbc011dfe package/unscd: bump version to 0.53
Version 0.53 has a fix for INVALIDATE and SHUTDOWN requests being
ignored.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Doug Kehn <rdkehn@yahoo.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2de1289282)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-30 09:55:07 +01:00
Paulo Matos
c436cce868 package/qemu: fix qemu 3.1.1.1 to build with glibc-2.29
These patches are already in qemu upstream under:
- 184943d827ce09375284e6fbb9fd5eeb9e369529
- 71ba74f67eaca21b0cc9d96f534ad3b9a7161400

They rename gettid() to sys_gettid() to avoid clash with glibc

Signed-off-by: Paulo Matos <pmatos@igalia.com>
Tested-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9dcca3ae40)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-30 09:20:51 +01:00
Carlos Santos
771511f638 package/qemu: move patch 3 to the 3.1.1.1 subdir
Required since the bump from 3.1.1.

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1ef6d39565)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-30 09:20:24 +01:00
Carlos Santos
64060bffc2 package/qemu: fix crash with uClibc-ng
On uClibc-ng sysconf(_SC_LEVEL1_{I,D}CACHE_LINESIZE) returns -1, which
is a valid result, meaning that the limit is indeterminate. Add a patch
that handles this situation using fallback values instead of crashing
due to an assertion failure.

Upstream status:
   https://lists.nongnu.org/archive/html/qemu-devel/2019-10/msg04115.html

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5e968678fd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-30 09:20:19 +01:00
Alexey Brodkin
605903062a package/qemu: bump to hot-fix release 3.1.1.1
Fixes a couple of important things and among other things the build of
pvrdma code:

----------------------->8---------------------
  In function 'create_qp':
  hw/rdma/vmw/pvrdma_cmd.c:517:16: error: 'rc' undeclared
----------------------->8---------------------

Bumped into this build problem while building vanilla
qemu_arm_versatile_defconfig.

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Alexander Dahl <post@lespocky.de>
Cc: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4bed6dbec9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 14:25:42 +01:00
Peter Korsgaard
1490c89421 DEVELOPERS: add Peter Korsgaard for wireguard
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e440f7d86c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 14:24:07 +01:00
James Hilliard
7d569e03b9 package/intel-microcode: bump to version 20190918
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 62dbc17ef4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 11:59:31 +01:00
Jörg Krause
a345573ebb package/fdk-aac: bump to version 2.0.1
This version is a minor update with a number of crash/fuzz fixes only.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4dc4317e35)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 11:54:39 +01:00
Baruch Siach
d30bd54847 package/tcpdump: security bump to version 4.9.3
CHANGES summary:

    Fix buffer overflow/overread vulnerabilities:
      CVE-2017-16808 (AoE)
      CVE-2018-14468 (FrameRelay)
      CVE-2018-14469 (IKEv1)
      CVE-2018-14470 (BABEL)
      CVE-2018-14466 (AFS/RX)
      CVE-2018-14461 (LDP)
      CVE-2018-14462 (ICMP)
      CVE-2018-14465 (RSVP)
      CVE-2018-14881 (BGP)
      CVE-2018-14464 (LMP)
      CVE-2018-14463 (VRRP)
      CVE-2018-14467 (BGP)
      CVE-2018-10103 (SMB - partially fixed, but SMB printing disabled)
      CVE-2018-10105 (SMB - too unreliably reproduced, SMB printing disabled)
      CVE-2018-14880 (OSPF6)
      CVE-2018-16451 (SMB)
      CVE-2018-14882 (RPL)
      CVE-2018-16227 (802.11)
      CVE-2018-16229 (DCCP)
      CVE-2018-16301 (was fixed in libpcap)
      CVE-2018-16230 (BGP)
      CVE-2018-16452 (SMB)
      CVE-2018-16300 (BGP)
      CVE-2018-16228 (HNCP)
      CVE-2019-15166 (LMP)
      CVE-2019-15167 (VRRP)
    Fix for cmdline argument/local issues:
      CVE-2018-14879 (tcpdump -V)

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d4d17e52d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 11:51:54 +01:00
Baruch Siach
0b27a19768 package/sudo: security bump to version 1.8.28
Fixes CVE-2019-14287: a sudo user may be able to run a command as root
when the Runas specification explicitly disallows root access as long as
the ALL keyword is listed first.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4a96d62749)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 11:48:53 +01:00
Pierre-Jean Texier
ae2a108326 package/mongoose: security bump to version 6.16
Fixes the following security vulnerability:

CVE-2019-13503: mq_parse_http in mongoose.c in Mongoose 6.15
has a heap-based buffer over-read.

See https://github.com/cesanta/mongoose/releases/tag/6.16

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit aeee0b9bd7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 11:38:14 +01:00
Bernd Kuhls
244e9055c0 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{2, 3}.x series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 32042f42cb)
[Peter: drop 5.3.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 09:51:17 +01:00
Charlie Turner
5719bf4bf5 package/gstreamer1: gl enabled when either GL or GLES2 is present
When building gst1-plugins-base with GL support on the rpi3 (which
supports only GLES2, not full desktop GL), GStreamer was being asked to
disable its GL support completely. This isn't correct since it can be
used with either GL or GLES2. There is already a Config.in symbol to
indicate that either of them is enabled:
BR2_PACKAGE_GST1_PLUGINS_BASE_LIB_OPENGL_HAS_API. So use that to
determine if gl should be enabled or disabled.

While we're at it, also move the GL/GLES handling under the same API
condition. This makes it clearer that they belong together.

Signed-off-by: Charlie Turner <cturner@igalia.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
[Arnout: refactor using
BR2_PACKAGE_GST1_PLUGINS_BASE_LIB_OPENGL_HAS_API]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4164d31e05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 09:02:53 +01:00
Thomas Petazzoni
08c7ad11b8 docs/manual: fix Config.in option that cargo packages must depend on
Back in commit 025b863e6f, the option
BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS was introduced, to
separate the option that host packages needing Rust should depend on
(BR2_PACKAGE_HOST_RUSTC_ARCH_SUPPORTS) from the option that target
packages needing Rust should depend on
(BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS).

Since the example in the manual is showing a target package, we must
use BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Sam Voss <sam.voss@gmail.com>
Cc: Eric Le Bihan <eric.le.bihan.dev@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit edee45b843)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 17:38:04 +01:00
Heiko Thiery
cf61da4748 utils/test-pkg: ensure to exit with an error upon failure
This commit modifies the main() function so that it returns the sum of
build and legal errors, making sure the overall test-pkg script exists
with a non-zero error code upon failure.

Signed-off-by: Heiko Thiery <heiko.thiery@kontron.com>
[Thomas: improved commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5093435f66)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 17:33:23 +01:00
Fabio Estevam
a7bca3f0f7 board/freescale/imx6-sabresd: improve Qt5 Cinematic Demo instructions
QT_QPA_EGLFS_ALWAYS_SET_MODE=1 needs to be exported, otherwise the Qt5
Cinematic demo throws a storm of the following messages:

Could not queue DRM page flip on screen LVDS1 (Invalid argument)

Improve the instructions by mentioning such requirement.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d9ccd8f0fc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:24:45 +01:00
Fabrice Fontaine
43a79b9643 package/sdl_mixer: disable parallel build
Build sometimes fails on:
Fatal error: can't create build/load_aiff.o: No such file or directory

Fixes:
 - http://autobuild.buildroot.org/results/c800ef60d8af0cd76f2f1de9aff573120ebd8ada

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fcc22749e8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:21:25 +01:00
Fabrice Fontaine
216c668a36 package/vtun: fix static linking with atomic
Fixes:
 - http://autobuild.buildroot.org/results/908707cdd16c5b89197c226a3e259f8943a5474e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cff14017f9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:13:53 +01:00
Bernd Kuhls
2c0f064ff7 package/wireshark: security bump to version 3.0.5
Fixes the following security vulnerabilities (3.0.4):
- CVE-2019-16319: Gryphon dissector infinite loop
  https://www.wireshark.org/security/wnpa-sec-2019-21

Added upstream sha1 hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1218a2be41)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:06:22 +01:00
Bernd Kuhls
2750b41e4e package/libva: fix mesa3d glx support
https://git.buildroot.net/buildroot/commit/package/mesa3d?id=5cb821d5635626b7327d5d704555c412e5ed5a1f

added a new option to enable GLX support.

This patch adjusts libva to use the new logic.

Fixes:
http://autobuild.buildroot.net/results/797/79776104e681402c24160be15789fe67bb69f833/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Reviewed-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 196e3d2b33)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:02:53 +01:00
Fabrice Fontaine
0689e268e7 package/nbd: add host-pkgconf to dependencies
pkg-config is used to find libglib2 since version 3.17 and
ef86bbd9da

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Acked-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d630ed2dcf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 13:59:04 +01:00
Asaf Kahlon
55c0c09fe4 package/python-pysnmp-apps: update license to BSD-2-Clause
The license file for this application is BSD-2-Clause and not
BSD-3-Clause as we currently state in the _LICENSE variable.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1eb8252cce)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 13:57:31 +01:00
Vivien Didelot
0df86310f8 DEVELOPERS: change Ash Charles' email address
Ash is no longer working at Savoir-faire Linux. Update his email
address in the DEVELOPERS file.

Signed-off-by: Vivien Didelot <vivien.didelot@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e32e92233f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 13:50:14 +01:00
Francois Perrad
444135d7c0 package/lua-sdl2: fix install path
WITH_LUAVER must be set with a value depending of Lua interpreter,
by this way, the module is installed in the correct location

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Tested-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f2d1ec39e4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:56:30 +01:00
Thomas Petazzoni
982a350aaa DEVELOPERS: remove Morgan Delestre
Morgan's e-mail is bouncing:

"""
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  m.delestre@sinters.fr
    retry timeout exceeded
"""

And I was confirmed by CORJON Julien <CORJON.J@ecagroup.com> that
Morgan is no longer at ECA/Sinters.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6015b46865)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:55:31 +01:00
Thomas Petazzoni
96db73f054 DEVELOPERS: remove Jonathan Liu
In a private e-mail answering one of our notifications about packages
being outdated, Jonathan replied:

"""
I switched from Buildroot to OpenEmbedded in 2013 so am no longer actively
involved with Buildroot.
Please unsubscribe me from outdated package notifications.
"""

So let's remove him from the DEVELOPERS file.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 175c3f8b2d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:54:17 +01:00
Arnout Vandecappelle (Essensium/Mind)
47649b2a1c package/python-tornado: only available for Python 3
Since the bump to 6.0.1, python-tornado has dropped support for Python 2
and now needs Python >= 3.5 (cfr. setup.cfg).

Apparently this is not checked by setuptools, and apparently
byte-compile is not done in the autobuilders, so there's not autobuild
failure.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Asaf Kahlon <asafka7@gmail.com>
Cc: Ryan Barnett <ryan.barnett@rockwellcollins.com>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 69c787de04)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:49:22 +01:00
Bernd Kuhls
b6733ae2ad package/libpcap: security bump version to 1.9.1
Removed patch applied upstream.

Changelog: https://www.tcpdump.org/libpcap-changes.txt

Quoting changelog:
"Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164,
 CVE-2019-15165
 Fixes for CVE-2018-16301, errors in pcapng reading."

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7df3dfee55)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:43:13 +01:00
James Hilliard
e91b9bb66a package/nfs-utils: fix nfs-utils_env.sh path
Per upstream commit bf12e1fa9f48e8ee91a2869e69484c70595b5160
https://cdn.kernel.org/pub/linux/utils/nfs-utils/1.3.4/1.3.4-Changelog

Currently nfs-utils_env.sh is installed in a
directory that is own by systemd. They requested
via https://bugzilla.redhat.com/show_bug.cgi?id=1303113
to move the script into /usr/libexec/nfs-utils

As such we must update the installation path for nfs-utils_env.sh.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Tested-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 74aab4ae06)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:38:08 +01:00
Peter Seiderer
770680cd92 package/icu: fix double conversion compile for microblaze
Fixes [1]:

  In file included from double-conversion.h:42:0,
                   from number_decimalquantity.cpp:19:
  double-conversion-utils.h:120:2: error: #error Target architecture was not detected as supported by Double-Conversion.
   #error Target architecture was not detected as supported by Double-Conversion.

Apply the same fix as previously for qt5base ([2], already sent upstream [3],
but seems to be lost while merging [4]).

[1] http://autobuild.buildroot.net/results/24005bc54cbc742decee221fb09bca19ee70502c
[2] https://git.buildroot.net/buildroot/commit/?id=530668ddb709cf27aa6694e00f44cf58af858b0b
[3] https://github.com/google/double-conversion/issues/73
[4] 768a445f0c

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0e9eaf7d57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:31:00 +01:00
Romain Naour
f975b39baf DEVELOPERS: add Romain Naour for clang, clinfo, libclc and llvm packages
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7fe2e9e48b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:28:32 +01:00
Bernd Kuhls
b4fffad781 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{2, 3}.x series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Peter: drop 5.3.x bump]
(cherry picked from commit 17ec040ff5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 09:41:47 +01:00
Fabrice Fontaine
b1d3234ff9 package/suricata: fix build without geoip
Fixes:
 - http://autobuild.buildroot.org/results/a7a34f760ae5fe0922fdb720b8234dbcd85ed222

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9bab165ccb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 00:16:45 +01:00
Fabrice Fontaine
edc680caaa package/suricata: security bump to version 4.1.5
- Drop second patch (already in version)
- Add libmaxminddb optional dependency and use --disable-libgeoip to prefer
  maxminddb over geoip, see:
  d29072647f
  c55226b712
- Disable sphinx-build (to avoid a build failure)
- This release fixes a number of issues found in the 4.1 branch. Some of
  the issues are security issues, so upgrading is highly recommended.
  See https://suricata-ids.org/2019/09/24/suricata-4-1-5-released

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 37be55a5db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 00:16:29 +01:00
Peter Korsgaard
c5d3437e84 package/ruby: security bump to version 2.4.9
Fixes the following security vulnerability:

(Bundled jquery)
- CVE-2012-6708: jQuery before 1.9.0 is vulnerable to Cross-site Scripting
  (XSS) attacks.  The jQuery(strInput) function does not differentiate
  selectors from HTML in a reliable fashion.  In vulnerable versions, jQuery
  determined whether the input was HTML by looking for the '<' character
  anywhere in the string, giving attackers more flexibility when attempting
  to construct a malicious payload.  In fixed versions, jQuery only deems
  the input to be HTML if it explicitly starts with the '<' character,
  limiting exploitability only to attackers who can control the beginning of
  a string, which is far less common.

- CVE-2015-9251: jQuery before 3.0.0 is vulnerable to Cross-site Scripting
  (XSS) attacks when a cross-domain Ajax request is performed without the
  dataType option, causing text/javascript responses to be executed.

https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/

- CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test

https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/

- CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)

https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/

- CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?

https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/

- CVE-2019-16201: Regular Expression Denial of Service vulnerability of
  WEBrick's Digest access authentication

https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/

2.4.9 fixes a packaging bug in 2.4.8:

https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit dc487302b6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-25 23:46:17 +02:00
Carlos Santos
fe0f841794 package/cups-filters: fix ln -r workaround for older patch versions
0001-install-support-old-ln-versions-without-the-r-option.patch adds a
ln-srf script for older distributions to emulate 'ln -r', but GNU patch <
2.7 does not handle the git patch permission extensions - So ensure it is
executable.

https://savannah.gnu.org/forum/forum.php?forum_id=7361

Fixes:
    http://autobuild.buildroot.net/results/5c88115b92abc1360a979cd46e00332f61c41cb4

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-18 20:54:26 +02:00
Peter Korsgaard
d77f6c1712 Update for 2019.08.1
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019.08.1
2019-10-03 09:12:47 +02:00
Peter Korsgaard
73dad61740 package/mongodb: security bump to version 4.0.12
Fixes the following (low severity) security vulnerabilities:

4.0.9:

- CVE-2019-2386: After user deletion in MongoDB Server the improper
  invalidation of authorization sessions allows an authenticated user's
  session to persist and become conflated with new accounts, if those
  accounts reuse the names of deleted ones
  https://jira.mongodb.org/browse/SERVER-38984

4.0.11:

- CVE-2019-2389: Incorrect scoping of kill operations in MongoDB Server's
  packaged SysV init scripts allow users with write access to the PID file
  to insert arbitrary PIDs to be killed when the root user stops the MongoDB
  process via SysV init
  https://jira.mongodb.org/browse/SERVER-40563

- CVE-2019-2390: An unprivileged user or program on Microsoft Windows which
  can create OpenSSL configuration files in a fixed location may cause
  utility programs shipped with MongoDB server versions less than 4.0.11
  https://jira.mongodb.org/browse/SERVER-42233

Plus a number of other bugfixes. For details, see the release notes:
https://docs.mongodb.com/manual/release-notes/4.0/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 165e9c163c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 21:31:46 +02:00
Bernd Kuhls
b718ed9fab package/putty: security bump version to 0.73
Added upstream-provided sha1 hash.

Changelog:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 71d2911e26)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 18:02:39 +02:00
Peter Korsgaard
668fe091f8 {linux, linux-headers}: bump 4.19.x / 5.{2, 3}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 04e9fdb1c6)
[Peter: drop 5.3.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 17:58:46 +02:00
André Hentschel
efe9840c2a DEVELOPERS: remove myself from azure-iot-sdk-c
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fbc54866a3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 17:48:53 +02:00
Peter Korsgaard
2610ab44be package/go: security bump to version 1.12.10
Fixes the following security vulnerabilities:

- CVE-2019-16276: Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP
  Request Smuggling.
  https://github.com/golang/go/issues/34540

>From the release notes:

go1.12.10 (released 2019/09/25) includes security fixes to the net/http and
net/textproto packages

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bd574c445c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 17:13:54 +02:00
Jagan Teki
30433bc252 package/swupdate: fix typo in BR2_PACKAGE_LIBCURL in the help text
Config.in documented BR2_LIBCURL for swupdate but the actual
package name is BR2_PACKAGE_LIBCURL

Fix by updating the same in Config.in

Cc: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5abe6f2bf7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:45:01 +02:00
Yegor Yefremov
5381d693ef configs/beaglebone_defconfig: use default console device
OMAP kernels use 8250 driver by default. Hence the name of
the console device is not /dev/ttyO0 but /dev/ttyS0.
Use /dev/console in order to handle the console independently
of the selected driver.

Tested in BeagleBone Black board.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 68b5b79b2f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:44:53 +02:00
Bernd Kuhls
3eadf3ccbd {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.2.x series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 80d32c942a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:36:06 +02:00
Carlos Santos
b952431bf3 package/cups-filters: disable Braille embosing filters
Otherwise they are installed even though the Braille support is not
built because it requires liblouis, which is not available.

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3da92264c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:29:34 +02:00
Julien Floret
e818d80f4d DEVELOPERS: remove myself from lldpd developers
Signed-off-by: Julien Floret <julien.floret@6wind.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 686f40c0b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:27:52 +02:00
Bernd Kuhls
e82df41169 package/exim: add upstream security fix
Fixes CVE-2019-16928:
https://lists.exim.org/lurker/message/20190928.003428.2b4c81a7.en.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6c73ef37bd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:25:57 +02:00
Bernd Kuhls
6271eabb12 package/e2fsprogs: security bump version to 1.45.4
Fixes CVE-2019-5094:
http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ff8106a08)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:19:41 +02:00
Shyam Saini
b1a2ad290a DEVELOPERS: Add Jagan Teki as maintainer for olimex A33 olinuxino
I no longer work at Amarula Solutions and neither do I have access to
olimex A33 olinuxino board. So, add Jagan as maintainer of this board.

Signed-off-by: Shyam Saini <mayhs11saini@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 31fb2ac781)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:15:22 +02:00