https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
Fixes CVEs:
CVE-2026-40684 Possible crash with malicious DNS data when using musl libc
On systems using musl libc (not glibc) due to an oddity in octal printing
it is possible to crash the connection instance when malformed DNS data
is present in PTR records.
CVE-2026-40685 Possible OOB read/write on corrupt JSON in header
configurations using json operators on invalid externally-provided input
could trigger heap corruption.
CVE-2026-40686 Possible OOB read with large UTF8 trailing characters
configurations using utf8 operators on malformed utf8 in headers could
trigger OOB reads and might trigger some data leak if error
messages are required for subsequent emails in the current connection
and similar malformed headers are present.
CVE-2026-40687 Possible OOB read/write with SPA authenticator
in configurations using the SPA authentication driver to a hostile/compromised
external SPA/NTLM connnection it is possible to trigger an OOB read/write
and crash the connection instance or possibly leak heap data to the instance.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f6d37ab9a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This reverts commit 0d81107f02. The bug
the workaround is for was fixed in binutils 2.29.51 (first release
listed in bfd/ChangeLog after the fix), which is by now far older than
any version supported by Buildroot.
Compile tested with qemu_microblazeel_mmu_defconfig plus
BR2_PACKAGE_KMOD=y.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 7653e616f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/OpenSC/OpenSC/blob/0.27.1/NEWS
Switched to sha256 tarball hash provided by upstream.
Removed patch which is included in this release.
Fixes the following CVEs:
* CVE-2025-13763: Several uses of potentially uninitialized memory
detected by fuzzers
* CVE-2025-49010: Possible write beyond buffer bounds during processing
of GET RESPONSE APDU
* CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver
* CVE-2025-66038: Possible read beyond buffer bounds when parsing
historical bytes in PIV driver
* CVE-2025-66037: Possible buffer overrun while parsing SPKI
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit baa0a13653)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
NetworkManager stopped requiring intltool with 1.40:
56b51b98fb/NEWS (L434)
Fixes: e7c20ad548
host-gettext is already an indirect dependency via package/libglib2.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: add reference to commit that updated NM to 1.40]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit c393060c7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
There is no such option, and according to the commit history never
was. If BR2_PACKAGE_HOST_PYTHON3_SSL=y the build adds host-openssl to
HOST_PYTHON3_DEPENDENCIES directly.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 201d6f4937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
GCC 12.x is unsupported upstream but the patches from the gcc-13 release
branch are easy enough to backport. The first one (libcody fix) applies
without changes, the second one only needs to move one header instead of
two for gcc-12.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
eeb65cf0f6 manually backported upstream
util-linux security fix (util-linux: 5e390467b26a3cf3fecc04e1a0d482dff3162fc4)
but didn't account for ul_canonicalize_path being named just canonicalize_path
in 2.40.x. Use the upstream backported patch from the 2.40.x maintenance
branch instead.
Can be reproduced with the following defconfig:
BR2_arm=y
BR2_cortex_a7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_INIT_NONE=y
BR2_SYSTEM_BIN_SH_NONE=y
BR2_PACKAGE_UTIL_LINUX_LOSETUP=y
Fixes: eeb65cf0f6
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[thomas: added defconfig]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.3.news
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c1a34838b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Building this defconfig
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_NEON=y
BR2_PACKAGE_NEON_ZLIB=y
does not build libneon with zlib support, quoting configure log:
configure: zlib not enabled
although the configure parameter
--with-zlib=/home/bernd/buildroot/output/host/x86_64-buildroot-linux-gnu/sysroot
was used.
The reason is the addition of "=$(STAGING_DIR)" to --with-zlib which was
added to buildroot in 2008 with commit
cc6562ff83.
The upstream code, which expects only "yes", all other values lead to
the else-condition, is unchanged since 2004:
https://github.com/notroj/neon/blame/0.37.1/macros/neon.m4#L478
so a backport of this patch to LTS branches should be considered.
With this patch the configure log shows:
checking for zlib.h... yes
checking for inflate in -lz... yes
configure: zlib support enabled, using -lz
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5e917c3a81)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- sources are now hosted on Github
- ficl have its own LICENSE file
- remove one upstreamed patch
- support only static lib
- requires C11
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e7dcf9e5af)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Commit 1c11f9020a removed the patch
changing configure.ac with the bump to 6.10, so it is no longer
needed.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9fd8a1cf49)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes:
https://docs.djangoproject.com/en/5.2/releases/5.2.13/
In addition, update the pypi url to a stable one, which shouldn't change
in each and every release (similar to the url change in commit
60ce218196)
Finally, one hash file has changed because of upstream commit
0ee44c674c
Django 5.2.13 fixes one security issue with severity "moderate",
and four security issues with severity "low":
- CVE-2026-3902:
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and
4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof
headers by exploiting an ambiguous mapping of two header variants
(with hyphens or with underscores) to a single version with
underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x,
and 3.2.x) were not evaluated and may also be affected. Django would
like to thank Tarek Nakkouch for reporting this issue.
https://www.cve.org/CVERecord?id=CVE-2026-3902
- CVE-2026-4277:
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and
4.2 before 4.2.30. Add permissions on inline model instances were not
validated on submission of forged `POST` data in
`GenericInlineModelAdmin`. Earlier, unsupported Django series (such as
5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank N05ec@LZU-DSLab for reporting this issue.
https://www.cve.org/CVERecord?id=CVE-2026-4277
- CVE-2026-4292:
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and
4.2 before 4.2.30. Admin changelist forms using
`ModelAdmin.list_editable` incorrectly allowed new instances to be
created via forged `POST` data. Earlier, unsupported Django series
(such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be
affected. Django would like to thank Cantina for reporting this issue.
https://www.cve.org/CVERecord?id=CVE-2026-4292
- CVE-2026-33033:
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and
4.2 before 4.2.30. `MultiPartParser` allows remote attackers to
degrade performance by submitting multipart uploads with `Content-
Transfer-Encoding: base64` including excessive whitespace. Earlier,
unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not
evaluated and may also be affected. Django would like to thank
Seokchan Yoon for reporting this issue.
https://www.cve.org/CVERecord?id=CVE-2026-33033
- CVE-2026-33034:
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and
4.2 before 4.2.30. ASGI requests with a missing or understated
`Content-Length` header could bypass the
`DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`,
allowing remote attackers to load an unbounded request body into
memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and
3.2.x) were not evaluated and may also be affected. Django would like
to thank Superior for reporting this issue.
https://www.cve.org/CVERecord?id=CVE-2026-33034
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes:
https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst
This fixes 2 security issues:
- CVE-2026-40215:
race condition in TLS handshake that could lead to leaking of packet
data from a previous handshake under specific circumstances
- CVE-2026-35058:
server ASSERT() on receiving a suitably malformed packet with a valid
tls-crypt-v2 key
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 1a4a04fe29)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
For change log, see:
https://logging.apache.org/log4cxx/1.7.0/changelog.html
This fixes the following vulnerability:
- CVE-2026-40023:
Apache Log4cxx's XMLLayout
https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html,
in versions before 1.7.0, fails to sanitize characters forbidden
by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets
in log messages, NDC, and MDC property keys and values, producing
invalid XML output. Conforming XML parsers must reject such
documents with a fatal error, which may cause downstream log
processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this
to suppress individual log records, impairing audit trails and
detection of malicious activity. Users are advised to upgrade to
Apache Log4cxx 1.7.0, which fixes this issue.
https://www.cve.org/CVERecord?id=CVE-2026-40023
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1d5c6d18da)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
commit cf686670b9 introduced a patch that
was later included in a release which made the usage of libesmtp
configurable. Later the switch was moved to the main CMakeLists.mk [0].
while the patch introduced the build flag LOG4CXX_ENABLE_ESMTP the
change to the .mk file used LOG4CXX_ENABLE_LIBESMTP.
So correct this.
Fixes:
CMake Warning:
Manually-specified variables were not used by the project:
LOG4CXX_ENABLE_LIBESMTP
[0] https://github.com/apache/logging-log4cxx/blob/rel/v1.3.1/CMakeLists.txt#L93
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 70a16560b2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-27456: mount(8) TOCTOU symlink attack via loop device. The SUID
mount follows symlinks when resolving loop backing file paths. On
systems where non-root users are permitted to mount loop devices (via
'user' option in fstab), this allows access to arbitrary files.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2026-27456
- 5e390467b2
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit cd52acda14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The host-mkpasswd package needs the <crypt.h> header file installed
on the host. This file was initially provided by the libc headers,
as part of its libcrypt implementation. libcrypt was removed in
glibc 2.39. Most Linux distributions continued to ship a libcrypt
replacement such as libxcrypt in their default installation.
Some mainstream Linux distribution (such as Debian testing) are
now starting to remove this libcrypt and <crypt.h> header from their
default image (of development files).
In that case, host-mkpasswd is failing to build with the error:
/buildroot/output/build/host-mkpasswd/mkpasswd.c:54:10: fatal error: crypt.h: No such file or directory
The issue can be reproduced by adapting the Buildroot Docker file,
by setting "FROM debian:testing-20260316" in [1] and removing
the build of tar.
Note: debian 13 (for example Docker tag trixie-20260316) still
includes the libcrypt-dev package by default, which provides crypt.h.
In Buildroot, there is already the host-heimdal and host-systemd
packages requiring host-libxcrypt. Also, the host-libxcrypt is a
small standalone package. For those reasons, instead of adding
the Buildroot prerequisite on the user host to provide a libcrypt
implementation, this commit simply add the package dependency to
host-libxcrypt, to make sure it will work in all situations.
[1] https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/support/docker/Dockerfile#L11
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit cf26c77280)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
