Commit Graph

68396 Commits

Author SHA1 Message Date
Marcus Hoffmann
30652bd1d5 package/c-ares: bump to version 1.26.0
Changelog: https://c-ares.org/changelog.html#1_26_0

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 43ae599c9e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 23:24:31 +01:00
Fabrice Fontaine
13ffa65376 package/c-ares: bump to version 1.20.1
Update hash of license file (modern MIT license text used since
6d077838f7)

https://c-ares.org/changelog.html#1_20_1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit c26939ea3f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 23:24:14 +01:00
Bernd Kuhls
044f444b58 package/bind: security bump version to 9.16.48
Changelog: https://ftp.isc.org/isc/bind9/9.16.48/CHANGES

Version 9.16.46 fixes
- CVE-2023-4408
- CVE-2023-5517
- CVE-2023-5679
- CVE-2023-6516

Version 9.16.47 fixes CVE-2023-50387.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7ca60941b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 23:21:15 +01:00
Bernd Kuhls
6e5fd94c63 package/unbound: security bump version to 1.19.1
Release notes:
https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/

Fixes CVE-2023-50387 & CVE-2023-50868.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9175bf2649)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 23:20:26 +01:00
Bernd Kuhls
c91e3dac71 DEVELOPERS: add Bernd Kuhls to dnsmasq
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0dab037e14)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 23:19:34 +01:00
Bernd Kuhls
112b3d4df2 package/dnsmasq: security bump version to 2.90
Changelog: https://thekelleys.org.uk/dnsmasq/CHANGELOG

Release notes:
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html

Fixes CVE 2023-50387 and CVE 2023-50868.

Removed patch which is included in this release.
Switched _SITE to https.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 213cfb3435)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 23:19:27 +01:00
Marcus Hoffmann
ef58952a07 package/systemd: needs sulogin for emergency target support
systemd invokes util-linux' sulogin via systemd-sulogin-shell[1] via
emergency.service/emergency.target[2].

[1] https://github.com/systemd/systemd/blob/main/src/sulogin-shell/sulogin-shell.c
[2] https://github.com/systemd/systemd/blob/main/units/emergency.service.in#L23

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[yann.morin.1998@free.fr: drop superfluous dependency comment]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 613c817aef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 22:25:02 +01:00
Nuno Gonçalves
386ee165c1 package/google-breakpad: fix tools option identation in menuconfig
Move comment in Config.in to end of file so that
BR2_PACKAGE_GOOGLE_BREAKPAD_TOOLS is properly idented.

Signed-off-by: Nuno Gonçalves <nunog@fr24.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2c6dc1fed3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 22:21:05 +01:00
Yann E. MORIN
5f687db366 package/sudo: fix build with uClibc
uClibc lacks process_vm_readv(), and sudo fails to build since commit
c87746afef (package/sudo: security bump to version 1.9.15p5), with
errors such as:

    ./exec_ptrace.c: In function ‘ptrace_write_vec’:
    ./exec_ptrace.c:895:9: error: ‘nwritten’ undeclared (first use in this function); did you mean ‘pwrite’?
      895 |         nwritten = ptrace_write_string(pid, strtab, vec[i]);
          |         ^~~~~~~~
          |         pwrite

Backport an upstream commit to fix the issue.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0f0117ad94)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 22:20:35 +01:00
Fabrice Fontaine
e1291e7dd7 package/sudo: security bump to version 1.9.15p5
- Drop patch (already in version) and so also drop autoreconf
- The sudoers plugin has been modified to make it more resilient to
  ROWHAMMER attacks on authentication and policy matching. This
  addresses CVE-2023-42465.

https://www.sudo.ws/releases/stable/#1.9.15p5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c87746afef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 22:20:31 +01:00
Fabrice Fontaine
996f86ef99 package/rsync: fix openssl static build
Fix the following openssl static build raised since commit
80fa5672da:

/home/buildroot/autobuild/instance-0/output-1/host/lib/gcc/aarch64_be-buildroot-linux-uclibc/12.3.0/../../../../aarch64_be-buildroot-linux-uclibc/bin/ld: /home/buildroot/autobuild/instance-0/output-1/host/aarch64_be-buildroot-linux-uclibc/sysroot/lib/../lib64/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block':
c_zlib.c:(.text+0xaec): undefined reference to `uncompress'

Commit b9a062b354 can also be reverted as
pkg-config will also retrieve -latomic to avoid the following build
failure:

/home/autobuild/autobuild/instance-1/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/10.4.0/../../../../sparc-buildroot-linux-uclibc/bin/ld: /home/autobuild/autobuild/instance-1/output-1/host/sparc-buildroot-linux-uclibc/sysroot/usr/lib/libcrypto.a(threads_pthread.o): in function `CRYPTO_atomic_add':
threads_pthread.c:(.text+0x208): undefined reference to `__atomic_is_lock_free'

RSYNC_POST_CONFIGURE_HOOKS must be added to call reconfigure and avoid
the following build failure after autoreconf:

autoconf -o configure.sh
autoheader && touch config.h.in
configure.sh has CHANGED.
config.h.in is unchanged.
You may need to run:
  make reconfigure

Fixes:
 - http://autobuild.buildroot.org/results/6c1636f7556e7370a4c9f6d02c63cf3e20dc985c
 - http://autobuild.buildroot.org/results/49abbaa1eab94b248bff434b40728065d687e278

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e889a1c9e9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 22:08:21 +01:00
Fabrice Fontaine
0f3d4a834b package/botan: disable neon with arm soft float
Disable neon with soft float to fix the following build failure raised
at least since version 2.19.1:

In file included from build/include/botan/internal/simd_32.h:27,
                 from src/lib/block/aes/aes_vperm/aes_vperm.cpp:15:
/home/thomas/autobuild/instance-1/output-1/host/lib/gcc/arm-buildroot-linux-musleabi/10.4.0/include/arm_neon.h:31:2: error: #error "NEON intrinsics not available with the soft-float ABI.  Please use -mfloat-abi=softfp or -mfloat-abi=hard"
   31 | #error "NEON intrinsics not available with the soft-float ABI.  Please use -mfloat-abi=softfp or -mfloat-abi=hard"
      |  ^~~~~

Fixes:
 - http://autobuild.buildroot.org/results/6b311e97484db2b0f8adbda140320d696713b1e0
 - http://autobuild.buildroot.org/results/c309940ea6db0845d8221fb51611d0254222c644

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 48c5053576)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 22:06:59 +01:00
Francois Perrad
3acb4c83fb package/lua-http: fix CVE-2023-4540
see https://nvd.nist.gov/vuln/detail/CVE-2023-4540
  & https://cert.pl/en/posts/2023/09/CVE-2023-4540

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 431c021740)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 22:06:07 +01:00
Julien Olivain
da8de1ec37 package/ghostscript: security bump to version 10.02.1
For release note, see:
https://ghostscript.readthedocs.io/en/gs10.02.1/News.html

For detailed history, see:
https://git.ghostscript.com/?p=ghostpdl.git;a=shortlog;h=refs/tags/ghostpdl-10.02.1

Fixes:
- CVE-2023-46751:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46751

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c456fefb91)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 21:55:48 +01:00
Fabrice Fontaine
25376141ad package/exim: fix libressl build
Fix the following libressl build failure raised since bump to version
4.97 in commit faec3ca30e and
https://git.exim.org/exim.git/commit/6bf0021993572586f031ac7d973ca33358c2dac8:

In file included from tls.c:473:
tls-openssl.c: In function 'tls_client_stapling_cb':
tls-openssl.c:2652:11: error: invalid use of incomplete typedef 'OCSP_BASICRESP' {aka 'struct ocsp_basic_response_st'}
 2652 |         bs->certs
      |           ^~

Fixes: faec3ca30e
 - http://autobuild.buildroot.org/results/869fde62128d7b0c65e0ac596a3a3f69b332583d

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit dc59cbe467)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-16 21:14:53 +01:00
Bernd Kuhls
7048ad3266 {linux, linux-headers}: bump 6.{1, 6}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6e5229c252)
[Peter: drop 6.6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 23:26:03 +01:00
Bernd Kuhls
7eb3a961ac package/clamav: security bump version to 1.0.5
Release notes:
https://blog.clamav.net/2023/11/clamav-130-122-105-released.html

Fixes CVE-2024-20290 & CVE-2024-20328.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e6e54416ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 22:59:03 +01:00
Bernd Kuhls
ad964a3fdf package/clamav: security bump version to 1.0.4
Release notes:
https://blog.clamav.net/2023/10/clamav-121-113-104-010311-patch.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ce7d054878)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 22:58:52 +01:00
Bernd Kuhls
ca6a07d9d0 package/clamav: security bump version to 1.0.3
Release notes:
https://blog.clamav.net/2023/08/clamav-120-feature-version-and-111-102.html

Fixes CVE-2023-40477:
"Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 387d66dc4f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 22:58:44 +01:00
Bernd Kuhls
75bb896ec3 package/clamav: security bump version to 1.0.2
Release notes: https://blog.clamav.net/2023/07/2023-08-16-releases.html

Fixes CVE-2023-20197 & CVE-2023-20212.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c78799639b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 22:58:34 +01:00
Bernd Kuhls
ff1371f643 package/clamav: fix build on mips64el
Fixes:
http://autobuild.buildroot.net/results/b64/b640937f35b11ddb9f1e29f0e44040eda8850f26/
'Could not find specification for target "mips64el-unknown-linux-gnu".'

This patch changes
    -DRUST_COMPILER_TARGET=mips64el-unknown-linux-gnu
to
    -DRUST_COMPILER_TARGET=mips64el-unknown-linux-gnuabi64

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9a560d6aff)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 22:58:28 +01:00
Bernd Kuhls
b28d522e4e package/clamav: bump version to 1.0.1
Removed patch which was applied upstream.
License files were moved to COPYING/

Updated license hash of COPYING.lzma due to upstream commit
6b3b8b2e9d (diff-216b7167897f75c13c7fcfa08956f8f9269af0927024c7e14201683b94ebad8f)
which made no changes to the license text.

Switched build system to cmake, reworked various dependencies.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 203725a46b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 22:58:04 +01:00
James Hilliard
5d99b844a1 package/gst1-python: disable tests
We don't need tests enabled which can also cause build issues.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ae8cb9b2bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-10 22:38:09 +01:00
Yann E. MORIN
7fd91f10ab doc/manual: indent the CVE example the same as the CVE list item
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 949c1a51b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-09 14:37:34 +01:00
Yann E. MORIN
0a4d96a5a6 doc/manual: fixup ordered lists
With recent asiidoc versions (at least 10.2.0 is known to report that),
rendering the manual yields a few warnings related to ordered lists:

    asciidoc: WARNING: customize-quick-guide.adoc: line 13: list item index: expected 2 got 1
    asciidoc: WARNING: customize-quick-guide.adoc: line 15: list item index: expected 3 got 1
    [...]
    asciidoc: WARNING: customize-quick-guide.adoc: line 65: list item index: expected 13 got 1
    asciidoc: WARNING: customize-quick-guide.adoc: line 66: list item index: expected 14 got 1
    asciidoc: WARNING: adding-packages-gettext.adoc: line 30: list item index: expected 2 got 1
    asciidoc: WARNING: adding-packages-gettext.adoc: line 41: list item index: expected 3 got 1

The reason is that we use the same index to tell asciidoc to
automatically number items.

However, the official way to provide an automatic index is to write no
index:

    https://docs.asciidoctor.org/asciidoc/latest/lists/ordered/

    [...] since the numbering is obvious, the AsciiDoc processor will
    insert the numbers for you if you omit them:
    [...]
    If you number the ordered list explicitly, you have to manually keep
    the list numerals sequential. Otherwise, you will get a warning.

So, abide by the documentation, and drop the repeating indices to
ordered lists where we want automatic numbering.

Note that there is another ordered list, in adding-packages-directory.adoc,
but it does use explicit, sequential numbering. For consistency within
the whole document, we also convert it.

To avoid extra useless churn, the indentation of the items is not
changed to match the elided indices.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1c24d83cc8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-09 14:36:53 +01:00
Yann E. MORIN
fdd561b1c2 utils/check-package: use https for the manual URL
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit dfed5acb56)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-09 14:35:48 +01:00
Fabrice Fontaine
d3f3a1864c package/libcurl: fix libpsl static build
Fix the following static build failure with libpsl raised since bump to
version 8.6.0 in commit 5cee6b6be6:

configure:28830: /home/autobuild/autobuild/instance-6/output-1/host/bin/aarch64_be-buildroot-linux-musl-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -g0 -static -Werror-implicit-function-declaration -Wno-system-headers -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -I/home/autobuild/autobuild/instance-6/output-1/host/aarch64_be-buildroot-linux-musl/sysroot/usr/include  -static -L/home/autobuild/autobuild/instance-6/output-1/host/bin/../aarch64_be-buildroot-linux-musl/sysroot/usr/lib  -L/home/autobuild/autobuild/instance-6/output-1/host/aarch64_be-buildroot-linux-musl/sysroot/usr/lib conftest.c -lpsl  -lmbedtls -lmbedx509 -lmbedcrypto -lz  -latomic >&5
/home/autobuild/autobuild/instance-6/output-1/host/lib/gcc/aarch64_be-buildroot-linux-musl/11.4.0/../../../../aarch64_be-buildroot-linux-musl/bin/ld: /home/autobuild/autobuild/instance-6/output-1/host/bin/../aarch64_be-buildroot-linux-musl/sysroot/usr/lib/libpsl.a(psl.c.o): in function `is_public_suffix':
psl.c:(.text+0x2a8): undefined reference to `idn2_lookup_u8'

[...]

checking for library containing psl_builtin... no
configure: error: libpsl was not found

Fixes: 5cee6b6be6
 - http://autobuild.buildroot.org/results/1fb15e1a99472c403d0d3b1a688902f32e78d002

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bedcd1cd39)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 18:53:59 +01:00
Bernd Kuhls
1f5b7fb783 package/libcurl: bump version to 8.6.0
Changelog: https://curl.se/changes.html#8_6_0

Removed patch which was included in upstream release.

Updated license hash due to copyright year bump:
57cc70e559

Added configure options for optional libpsl support due to upstream
commit which throws an error during configure when libpsl is missing and
--without-libpsl was not used:
2998874bb6

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5cee6b6be6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 18:53:56 +01:00
Sen Hastings
f9b38b93c1 DEVELOPERS: update Sen Hastings email
phobosdpl is an old work email I don't really use anymore, so I'm
changing it to my personal email.

Signed-off-by: Sen Hastings <sen@phobosdpl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 622fec1bb3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 15:43:16 +01:00
Peter Korsgaard
c020b922b3 package/python-django: security bump to version 4.2.10
Fixes the following security issue:

- CVE-2024-24680: Potential denial-of-service in intcomma template filter

  The intcomma template filter was subject to a potential denial-of-service
  attack when used with very long strings.

https://www.djangoproject.com/weblog/2024/feb/06/security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 65878ea1a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 15:39:32 +01:00
Adam Duskett
1cf69e2b5b package/python-django: security bump to 4.2.7
- Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate()
   with aggregates referencing expressions containing subqueries (#34798).

 - Restored, following a regression in Django 4.2, creating
   varchar/text_pattern_ops indexes on CharField and TextField with
   deterministic collations on PostgreSQL (#34932).

Tested on Fedora 39 with:
./support/testing/run-tests tests.package.test_python_django

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit be4347c088)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 15:39:12 +01:00
Adam Duskett
bc3b3b46ca package/python-django: bump version to 4.2.6
Tested with tests.package.test_python_django.TestPythonPy3Django.test_run in
Fedora 38 and Debian 11

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bc8d214e98)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 15:38:45 +01:00
Peter Korsgaard
d947e87a91 package/webkitgtk: security bump to version 2.42.5
Fixes the following security issues:

https://webkitgtk.org/security/WSA-2024-0001.html

- CVE-2024-23222: Processing maliciously crafted web content may lead to
  arbitrary code execution.  Apple is aware of a report that this issue may
  have been exploited.  Description: A type confusion issue was addressed
  with improved checks.

- CVE-2024-23206: A maliciously crafted webpage may be able to fingerprint
  the user.  Description: An access issue was addressed with improved access
  restrictions.

- CVE-2024-23213: Processing web content may lead to arbitrary code execution.
  Description: The issue was addressed with improved memory handling.

- CVE-2023-40414: Processing web content may lead to arbitrary code
  execution.  Description: A use-after-free issue was addressed with
  improved memory management.

- CVE-2023-42833: Processing web content may lead to arbitrary code execution.
  Description: A correctness issue was addressed with improved checks.

- CVE-2014-1745: Processing a file may lead to a denial-of-service or
  potentially disclose memory contents.  Description: The issue was
  addressed with improved checks.

https://webkitgtk.org/security/WSA-2023-0012.html

- CVE-2023-42883: Processing a SVG image may lead to a denial-of-service.
  Description: The issue was addressed with improved memory handling.

- CVE-2023-42890: Processing web content may lead to arbitrary code
  execution.  Description: The issue was addressed with improved memory
  handling.

https://webkitgtk.org/security/WSA-2023-0011.html

- CVE-2023-42916: Processing web content may disclose sensitive information.
  Apple is aware of a report that this issue may have been actively
  exploited.  Description: An out-of-bounds read was addressed with improved
  input validation.

- CVE-2023-42917: Processing web content may lead to arbitrary code
  execution.  Apple is aware of a report that this issue may have been
  actively exploited.  Description: A memory corruption vulnerability was
  addressed with improved locking.

Add an upstream post-2.42.5 patch to fix an issue with an invalid backport
causing a build issue.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit de3684f57d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 14:45:02 +01:00
Yann E. MORIN
8294399b94 package/v4l2loopback: drop _CPE_ID_VENDOR
Commit 1edb9d691d (package/v4l2loopback: add
V4L2LOOPBACK_CPE_ID_VENDOR) added that variable, but set to its default
value.

This is however not required to define a valid CPE ID, as it also
defines a non-default CPE_ID_PREFIX.

Drop V4L2LOOPBACK_CPE_ID_VENDOR now.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 74682e07df)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 12:30:58 +01:00
Julien Olivain
0f77312f94 support/testing: gnupg2: increase a timeout
The symmetric encryption test can sometimes take longer than the default
timeout. This commit increase the timeout to 10 seconds for that
command.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f44c0807c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 12:30:03 +01:00
Julien Olivain
4240702548 package/gnupg2: security bump to version 2.4.4
See release announce:
https://lists.gnupg.org/pipermail/gnupg-announce/2024q1/000481.html

For the details about the security advisory for GnuPG created
smartcard keys, see:
https://gnupg.org/blog/20240125-smartcard-backup-key.html

This commit also drops the package patch, which is now included in
this new version.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bdcd5adf39)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 12:29:15 +01:00
Bernd Kuhls
7066c799b4 package/gnupg2: fix build without ldap
Buildroot commit 8f1418b5dd bumped the
version of gnupg2 on the next branch causing a build error:

server.c:(.text+0xbf8): undefined reference to `ks_ldap_help_variables'

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 06702c81d3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 12:29:06 +01:00
Julien Olivain
dba962a7cb package/gnupg2: bump to version 2.4.3
See release announce:
https://lists.gnupg.org/pipermail/gnupg-announce/2023q3/000480.html

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8f1418b5dd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-08 12:28:49 +01:00
Peter Korsgaard
10d272ec99 Update for 2023.02.10
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023.02.10
2024-03-01 17:45:29 +01:00
Fabrice Fontaine
7dac066fc3 package/bayer2rgb-neon: fix aarch64 build with BR2_OPTIMIZE_0
Fix the following build failure with aarch64 and BR2_OPTIMIZE_0 raised
since commit 0512910e49:

src/convert-neon-body-bayer8.inc.h: In function 'bayer2rgb_convert_neon':
src/convert-neon.c:233:17: error: third argument to '__builtin_prefetch' must be a constant
  233 |                 __builtin_prefetch(((void const *)(_addr)) + 64, 0, (_lvl)); \
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/convert-neon-body-bayer8.inc.h:8:9: note: in expansion of macro 'do_prefetch'
    8 |         do_prefetch(&in[+1*stride - 1], (rows_per_loop) < 3 ? 3 : 0);
      |         ^~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/307c1c448becd99dfba3a17b3ef816db0bb5cad6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 13f8df8ed6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 11:53:18 +01:00
Yann E. MORIN
f69c10b4ce package/opencv-contrib: propagate opencv4 dependencies
Commit a7736afaca (package/opencv4-contrib: properly note dependencies
between modules) forgot to propagate the dependencies of selected
symbols, causing unmet dependencies warnings (unfortunately, not
errors), such as:

    $ KCONFIG_SEED=0x9F66F854 make randconfig
    WARNING: unmet direct dependencies detected for BR2_PACKAGE_OPENCV4_LIB_DNN
      Depends on [n]: BR2_PACKAGE_OPENCV4 [=y] && !BR2_TOOLCHAIN_USES_UCLIBC [=y] && BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS [=y]
      Selected by [y]:
      - BR2_PACKAGE_OPENCV4_CONTRIB_LIB_DNN_OBJDETECT [=y] && BR2_PACKAGE_OPENCV4_CONTRIB [=y]

Propagate the dependencies and add associated comments.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Woodrow Douglass <wdouglass@carnegierobotics.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a2e01b23fc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 11:05:49 +01:00
Yann E. MORIN
1149275e7d package/opencv4: propagate internal dependencies
Commit e229943785 (package/opencv4: BR2_PACKAGE_OPENCV4_LIB_OBJDETECT
requires BR2_PACKAGE_OPENCV4_LIB_DNN) forgot to propagate the dependency
to the internal stitching option, and to the contrib options dpm, face,
and xobjdetect, causing unmet dependencies warning (unfortunately, not
errors) such as:

    $ KCONFIG_SEED=0x9F66F854 make randconfig
    WARNING: unmet direct dependencies detected for BR2_PACKAGE_OPENCV4_LIB_OBJDETECT
      Depends on [n]: BR2_PACKAGE_OPENCV4 [=y] && !BR2_TOOLCHAIN_USES_UCLIBC [=y] && BR2_PACKAGE_PROTOBUF_ARCH_SUPPORTS [=y]
      Selected by [y]:
      - BR2_PACKAGE_OPENCV4_LIB_STITCHING [=y] && BR2_PACKAGE_OPENCV4 [=y]
      - BR2_PACKAGE_OPENCV4_CONTRIB_LIB_XOBJDETECT [=y] && BR2_PACKAGE_OPENCV4_CONTRIB [=y]

Propagate the dependencies.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Woodrow Douglass <wdouglass@carnegierobotics.com>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b553c9123b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 11:03:31 +01:00
Fabrice Fontaine
e4fd735260 package/freeradius-server: fix python3 build with -Ofast
Fix the following python3 build failure with -Ofast raised since commit
4513f5198a:

powerpc64-buildroot-linux-gnu-gcc.br_real: error: ast: linker input file not found: No such file or directory

Fixes:
 - http://autobuild.buildroot.org/results/904c43241b99a8d848c1891cb5af132a291311b4

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ef199d3629)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 09:37:13 +01:00
Dario Binacchi
6f9f12165b package/davinci-bootcount: update GitHub URL
The patch updates the GitHub URL, which has recently changed.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f443c7236d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 09:31:10 +01:00
Christian Stewart
3a8d8a6551 package/runc: security bump to version v1.1.12
Fixes the following vulnerabilities:

- CVE-2024-21626: runc vulnerable to container breakout through process.cwd
  trickery and leaked fds
  https://github.com/advisories/GHSA-xr7r-f8xq-vfvv

https://github.com/opencontainers/runc/releases/tag/v1.1.12

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c0b5beea44)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 09:29:48 +01:00
Christian Stewart
98a52c974c package/runc: bump version to v1.1.9
Bugfixes and riscv64 support.

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a78bf295bc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 09:29:41 +01:00
Fabrice Fontaine
ad34e35d54 package/python-lmdb: add CPE variables
cpe:2.3:a:py-lmdb_project:py-lmdb is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/detail/AFE6D0BA-D905-43F6-81FE-308D591A82B8

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5d496d7a21)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 09:26:58 +01:00
Peter Korsgaard
63a51b964a package/go: bump version to 1.20.14
go1.20.14 (released 2024-02-06) includes fixes to the crypto/x509 package.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 07:59:44 +01:00
Fabrice Fontaine
967c346257 package/python-opcua-asyncio: add CPE variables
cpe:2.3:a:freeopcua:opcua-asyncio is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/detail/39E826E8-04D1-465F-AA4E-7A41B387D7CE

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fa44cc4aaa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 07:48:55 +01:00
Fabrice Fontaine
cb7360f760 package/python-esptool: add CPE variables
cpe:2.3:a:espressif:esptool is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/AC284820-5731-4100-91BC-F50FE078848E

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 81fab735ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-02-29 22:59:54 +01:00