mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity
81,440 Commits 6 Branches 483 Tags
76db7e8a107598823de9656f77edbbcd10c00add
Commit Graph

81440 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Thomas Perale
76db7e8a10 package/unzip: import patches from Debian 
In Buildroot there are multiple way to apply patches on a package [1]

- Adding `.patch` file in the package directory.
- Define `<pkg>_PATCH` variable with the location of the patch tar.gz.
  It used to download Debian patches tarball.
- Implement custom patching logic with `PRE`/`POST` patches hooks.

To make the CycloneDX SBOM generation not dependant on downloading the
packages, the two last options have the downside of not appearing on the
generated SBOM.

The unzip package is downloading a tarball from the Debian mirror with
the `<pkg>_PATCH` method [2].

To improve the tracking of the patched vulnerabilities for the unzip
package this commit import the patches previously downloaded with the
`_PATCH` variable in the Buildroot tree.
This allows to add the `CVE:` trailer [3] on the patches that fix
vulnerabilities to better track which patch is fixing the vulnerability.

[1] https://buildroot.org/downloads/manual/manual.html#patch-policy
[2] https://snapshot.debian.org/archive/debian/20250311T215724Z/pool/main/u/unzip/unzip_6.0-29.debian.tar.xz
[3] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fb8958e3dc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:53:45 +02:00
Waldemar Brodkorb
336e7a3ef1 package/asterisk: security bump to 22.9.0 
See here for a changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22-current.html

Pjsip was updated to 2.16.

Fixes some security issues in pjsip:

Author: Mike Bradeen Date: 2026-03-23
Address the following pjproject security vulnerabilities

GHSA-j29p-pvh2-pvqp - Buffer overflow in ICE with long username
GHSA-8fj4-fv9f-hjpc - Heap use-after-free in PJSIP presense subscription termination header
GHSA-g88q-c2hm-q7p7 - ICE session use-after-free race conditions
GHSA-x5pq-qrp4-fmrj - Out-of-bounds read in SIP multipart parsing

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6add6e3cd8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:45:00 +02:00
Peter Korsgaard
974176d512 package/radvd: security bump to version 2.21 
Fixes the following vulnerability:

CVE-2026-48715: Stack Buffer Overflow in radvdump Route Information Option
Parser

https://github.com/radvd-project/radvd/security/advisories/GHSA-52px-gh9p-m379

Release notes:
https://github.com/radvd-project/radvd/releases/tag/v2.21

The release is now done on github, and a .tar.xz version is available so use
that. Notice that we cannot use the github macro.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f560174011)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:31:54 +02:00
Bernd Kuhls
1c16c1ed7e package/libde265: security bump version to 1.1.0 
https://github.com/strukturag/libde265/releases/tag/v1.1.0

"Security fixes

- CVE TBD (GHSA-g2rg-wj66-w594) - Out-of-bounds write in
 process_reference_picture_set via predicted short-term RPS
- CVE TBD (GHSA-vv8h-932h-7r86) - Heap buffer overflow in
 de265_image_get_buffer via SPS dimension integer overflow
- CVE TBD (GHSA-g5hj-rf9f-7vxm) - Unbounded memory accumulation via
 orphaned slice headers in read_slice_NAL
- (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL parser
 (remove_stuffing_bytes, resize)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b280053180)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:30:58 +02:00
Bernd Kuhls
b362fa37e3 package/libde265: disable neon support for armv7m 
Buildroot commit d4b8a42fb2 bumped the
package from 1.0.16 to 1.0.18.
Upstream added optional neon support in version 1.0.17:
f22cf00a86

The configure check detects neon support:

-- Performing Test HAVE_NEON
-- Performing Test HAVE_NEON - Success

but causes a build error at linking stage:

[100%] Linking CXX executable dec265
/builds/bkuhls/buildroot/br-test-pkg/bootlin-armv7m-uclibc/host/opt/ext-toolchain/arm-buildroot-uclinux-uclibcgnueabi/bin/ld.real:
 error: ../libde265/libde265.a(hevcdsp_qpel_neon.S.o):
 conflicting architecture profiles A/M

so we add a configure option to disable neon support.

The build error was not yet detected by the autobuilders but can be
reproduced using this defconfig:

BR2_arm=y
BR2_cortex_m4=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7M_UCLIBC_STABLE=y
BR2_PACKAGE_LIBDE265=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f51769b7e9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:30:21 +02:00
Bernd Kuhls
3b435a1bab package/libde265: link with libatomic if needed 
Buildroot commit d4b8a42fb2 bumped the
package to version 1.0.18 which introduced build errors on sparc:

/home/autobuild/autobuild/instance-21/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/15.2.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 ../libde265/libde265.so.0.1.12: undefined reference to
 `__atomic_fetch_add_4'

Fixes:
https://autobuild.buildroot.net/results/605/605dc19e86f113662cc35fe055c64c52698d70b4/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 38358daba9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:28:56 +02:00
Bernd Kuhls
0c465e005f package/libheif: security bump version to 1.22.2 
https://github.com/strukturag/libheif/releases/tag/v1.22.2
"Fixes missing heif_image_get_bayer_pattern_size() function."

https://github.com/strukturag/libheif/releases/tag/v1.22.1
"Security
- CVE TBD (GHSA-r7qj-cg5r-r6vf) - Wrapped icef compressed-unit range
 check causes out-of-bounds read in uncompressed HEIF decoder
 - (GHSA-5hqq-636x-r3cr) - Out-of-bounds write in inline mask region API
                           when source mask exceeds declared region"

Removed patch which is included in version 1.22.1.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 08f3757b0f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:23:23 +02:00
Peter Korsgaard
66066ece80 package/python-urllib3: security bump to version 2.7.0 
Fixes the following security issues:

CVE-2026-44431: Sensitive headers forwarded across origins in proxied
low-level redirects

https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc

CVE-2026-44432: Decompression-bomb safeguards bypassed in parts of the
streaming API

https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j

For more details, see the release notes:
https://urllib3.readthedocs.io/en/stable/changelog.html#id1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8b606d9074)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:22:43 +02:00
Bernd Kuhls
7ce09a9a71 package/nginx: security bump version to 1.30.2 
https://nginx.org/en/CHANGES-1.30

https://nginx.org/en/security_advisories.html

1.30.2: Fixes CVE-2026-9256
1.30.1: Fixes CVE-2026-42926 (only from 1.29.4), CVE-2026-42945,
CVE-2026-42946, CVE-2026-42934, CVE-2026-40460 & CVE-2026-40701.

Updated license hash due to copyright year bump:
7fa941a55e

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Peter: clarify CVE-2026-42926]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0455e2571d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-04 10:21:47 +02:00
Titouan Christophe
3e66f293f3 package/samba4: security bump to v4.23.8 
See the release notes:
- https://www.samba.org/samba/history/samba-4.23.7.html
- https://www.samba.org/samba/history/samba-4.23.8.html

This fixes the following vulnerabilities:
- CVE-2026-1933
- CVE-2026-2340
- CVE-2026-3012
- CVE-2026-3238
- CVE-2026-4408
- CVE-2026-4480

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 46a4dcd0e1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-06-03 14:02:00 +02:00
Joseph Kogut
6775bfd749 package/wpewebkit: fix stale libepoxy dependency comments 
wpewebkit depends directly on OpenGL ES and EGL support, but those
dependencies are not imposed by libepoxy itself. Update the inline
comments so they describe the actual dependency source before relaxing
libepoxy's package-level EGL/GL dependency.

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit a4b761f395)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 16:45:10 +02:00
James Hilliard
815e765c1a package/python-aiodns: bump to version 4.0.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9c60c5675)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:27:12 +02:00
Titouan Christophe
d40bb72793 {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 6.18.x series 
Update the latest kernel releases to:
 - 6.12.90 -> 6.12.91
 - 6.6.140 -> 6.6.141
 - 6.1.173 -> 6.1.174
 - 5.15.207 -> 5.15.208
 - 5.10.256 -> 5.10.257
 - 6.18.32 -> 6.18.33

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
 2026-05-29 10:27:10 +02:00
Bernd Kuhls
6c722cafd2 package/unbound: security bump version to 1.25.1 
https://nlnetlabs.nl/projects/unbound/download/

Used new signing key to verify the source tarball:
https://nlnetlabs.nl/signing-keys/

Fixes CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792,
CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923,
CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 74aed5e861)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:27:08 +02:00
Bernd Kuhls
7b9cb42f23 package/mariadb: security bump version to 10.11.17 
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17
https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.17

Fixes CVE-2026-44168, CVE-2026-44169, CVE-2026-44170, CVE-2026-44171,
CVE-2026-44172 & CVE-2026-44173.

https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16
https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.16

Fixes CVE-2026-3494 & CVE-2026-34303.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3ddacc46e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:27:05 +02:00
Viacheslav Bocharov
d119b1f979 DEVELOPERS: update entry for Viacheslav Bocharov 
- Update email address to v@baodeep.com.
- Take over maintainership of package/amlogic-boot-fip.

Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9d4d79f9ae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:27:03 +02:00
Bernd Kuhls
1981320594 package/kexec: fix powerpc build 
Added two upstream commits to fix build errors on powerpc.

The build error also occurs with kexec 2.0.30 on the 2025.02.x branch
so a backport to LTS branches should be considered:
https://autobuild.buildroot.net/results/2ec/2ec0d85c658f8264fcc4eef2deb6c67671e3e7ae/

Fixes:
https://autobuild.buildroot.net/results/53b/53bafc454533aeafc21116a99d87391b3049e12a/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8181bc6e06)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:27:01 +02:00
Bernd Kuhls
af42bd7679 package/putty: security bump version to 0.84 
https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html

Updated license hash due to copyright year bump in upstream commit
995b63a82bac4f6985958cb92943e807a9f35736. A link to this commit can not
be provided due to the shutdown of the upstream gitweb interface:
https://git.tartarus.org/?p=simon/putty.git

Switched URLs to https.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7418ff1389)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:59 +02:00
Bernd Kuhls
979aa00de4 package/haveged: security bump version to 1.9.21 
https://github.com/jirka-h/haveged/blob/v1.9.21/ChangeLog

Fixes CVE-2026-41054: https://seclists.org/oss-sec/2026/q2/575
"The bug was added in 1.9.3."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9e36ce805)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:57 +02:00
Joseph Kogut
cc6ace8158 package/weston: add EGL dependency for XWayland 
BR2_PACKAGE_WESTON_XWAYLAND currently depends on BR2_PACKAGE_LIBEPOXY,
which implicitly requires either libGL or libEGL. However, the XWayland
glamor support uses libepoxy with EGL, so express that dependency
directly. With only libGL and no libEGL, it fails to build. E.g.,

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_ETNAVIV=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XWAYLAND=y
BR2_PACKAGE_LIBEPOXY=y

fails with:

In file included from ../glamor/glamor_priv.h:73,
from ../glamor/glamor_composite_glyphs.c:25:
../glamor/glamor_context.h:27:10: fatal error: epoxy/egl.h: No such file or directory
27 | #include <epoxy/egl.h>
   |          ^~~~~~~~~~~~~

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 701f8bb31c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:55 +02:00
Bernd Kuhls
afcf84e5a8 package/memcached: security bump version to 1.6.42 
https://github.com/memcached/memcached/wiki/ReleaseNotes1642

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit d08416a5a2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:53 +02:00
Giulio Benetti
2896d8fcc4 package/bind: security bump to version 9.18.49 
Release notes:
https://ftp.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.49/doc/arm/html/changelog.html

Fixes CVE-2026-3592, CVE-2026-3039, CVE-2026-5946, CVE-2026-5950.

Fixes bugs:
GL #5804
https://gitlab.isc.org/isc-projects/bind9/-/issues/5804
GL #3589
https://gitlab.isc.org/isc-projects/bind9/-/issues/3589

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 5528e00b10)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:51 +02:00
Bernd Kuhls
f210a8ce1e package/rsync: security bump version to 3.4.3 
https://download.samba.org/pub/rsync/NEWS#3.4.3

Fixes CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620 & CVE-2026-45232.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 47b5cbb1ca)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:49 +02:00
Bernd Kuhls
55d58669b5 package/imagemagick: security bump version to 7.1.2-23 
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-23---2026-05-17

Fixes the following CVEs:
CVE-2026-42326, CVE-2026-45031, CVE-2026-45358, CVE-2026-45359,
CVE-2026-45624, CVE-2026-45664, CVE-2026-46520, CVE-2026-46521,
CVE-2026-46522, CVE-2026-46523, CVE-2026-46557 & CVE-2026-46559.
[copied list of CVEs from
 https://www.news.de/technik/859626214/imagemagick-gefaehrdet-it-sicherheitshinweis-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/]

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4e14863c94)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:46 +02:00
Bernd Kuhls
ca9d847951 package/libde265: security bump version to 1.0.19 
https://github.com/strukturag/libde265/releases/tag/v1.0.19

Fixes CVE-2026-45382 & CVE-2026-45383.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 0d3d25bcc9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:44 +02:00
Bernd Kuhls
d6ea7821f2 package/libheif: security bump version to 1.22.0 
https://github.com/strukturag/libheif/releases/tag/v1.22.0

Fixes the following CVEs/advisories:

CVE-2026-32738 (GHSA-7f2h-cmpf-v9ww) : Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc
CVE-2026-32739 (GHSA-j9g7-q9hv-gq8c) : Infinite Loop DoS in stts Sample Duration Lookup
CVE-2026-32740 (GHSA-frfr-f3vg-2g6j) : Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing
CVE-2026-32741 (GHSA-j3w5-7whq-p37q) : heap buffer overflow in decode_mask_image()
CVE-2026-32814 (GHSA-4m8r-34pg-rvwc) : Uninitialized Heap Memory Information Leak via Failed Grid Tiles
CVE-2026-32882 (GHSA-hg7q-rjr2-8x46) : Heap Buffer OOB Read in overlay compositing due to wrong alpha stride
CVE-2026-41069 (GHSA-p82x-fpmv-576r) : Out-of-bounds vector access leading to invalid dereference
CVE-2026-41071 (GHSA-xj92-xjff-h8w3) : Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count
CVE-2026-47178 (GHSA-5x55-x5pf-9c6g) : Heap Out Of Bounds Write in unci subsystem
CVE-2026-47247 (GHSA-2vh6-whr3-cmq3) : Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
CVE-2026-47251 (GHSA-p6q9-fhf2-vj9v) : Incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
CVE-2026-47254 (GHSA-wqjg-4x9g-6cvg) : Heap Buffer Overflow in Track::get_next_sample_raw_data() -- OOB Chunk Vector Access
CVE-2026-47709 (GHSA-4h72-vqgp-9376) : NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
CVE-2026-47714 (GHSA-h4wm-6wwf-qvhx) : Integer overflow in inline mask size calculation causes undersized buffer allocation
CVE TBD (GHSA-6x5f-qchq-cxqv) : heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
(GHSA-95jx-g5vf-cpp8) : Integer Overflow in SampleAuxInfoReader Offset Calculation
(GHSA-p4r6-6972-g26m) : Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass
(GHSA-jh2w-m72q-q595) : Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload
(GHSA-9h96-c44j-jpq9) : Heap buffer overflow via uint32_t stride overflow in image plane allocation

Added upstream commit to fix build error with imagemagick which would
be introduced by this bump.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 944f41e9e2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:42 +02:00
Bernd Kuhls
73492e71da package/libheif: bump version to 1.21.2 
https://github.com/strukturag/libheif/releases/tag/v1.21.2

Use sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4ed5af5288)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:40 +02:00
Andreas Mohr
b6169edea5 package/libargon2: fix pkgconfig version string 
Current build generated pkgconfig/libargon2.pc has wrong version string.
    Version: ZERO

Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 1ef471a61d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:38 +02:00
Bernd Kuhls
347d2116fa package/gnupg2: security bump version to 2.5.20 
https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000505.html
"This release adds two features to gpgsm and fixes a some minor security
 bugs."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b28aeeab1f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:36 +02:00
Bernd Kuhls
01a6c31a68 package/gnupg2: bump version to 2.5.19 
https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 77aeabb8b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:34 +02:00
Julien Olivain
83b09ce2a3 package/gnupg2: bump to version 2.5.18 
For release notes, see:
https://dev.gnupg.org/T7999

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2078ff1c32)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:32 +02:00
Julien Olivain
18dd343da4 package/tzdata: bump to 2026b 
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit b2e3521685)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:30 +02:00
Julien Olivain
5712f79b87 package/zic: bump to 2026b 
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 721a44f935)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:27 +02:00
Giulio Benetti
6728e1d284 package/zlib-ng: fix build failure for PowerPC soft-float 
As suggested in this review[1], when building for PowerPC with soft-float
enabled, let's also disable both WITH_POWER8/9 that in order disables
all the possible PowerPC acceleration instructions.

Fixes:
https://autobuild.buildroot.org/results/a0fa5a175c546993d818371a0de93b2e9845a183/

[1]: https://github.com/zlib-ng/zlib-ng/pull/2151/changes#r2803264882

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 668b47bdab)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:25 +02:00
Michael Nosthoff
3afe2535b9 package/supertux: fix build with gcc > 11 
Fixes:
 "missing #include <memory>" when building with GCC > 11.

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 56ff67b50b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:23 +02:00
Bernd Kuhls
79acbb383d package/postgresql: security bump version to 18.4 
https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/

Fixes CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9fb64dfc24)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:21 +02:00
Julien Olivain
2ebb05124c package/libabseil-cpp: add patch to fix build with gcc <= 12 
libabseil-cpp headers can break some packages build, like protobuf,
when compiled with gcc 12. See [1] [2]. The issue has been reported
in protobuf upstream, in [3].

The issue is due to gcc <= 12 not supporting the mix of standard
C++ attributes with GNU attributes. See [4].

Gcc 12 has been removed from Buildroot internal toolchains in
commit [5], but gcc 12 can still be present in external toolchains
or on the host. This is currently the case of the Buildroot Docker
reference image, based on Debian 12 (Bookworm).

This commit fixes the issue by adding a package patch.

Fixes:
- [1] [2] and many more.

[1] https://gitlab.com/buildroot.org/buildroot/-/jobs/13904066346
[2] https://autobuild.buildroot.org/results/33f6cfd37cb48c15a53b3e7123d5ce8388a0f2ab
[3] https://github.com/protocolbuffers/protobuf/issues/26383
[4] https://gcc.gnu.org/PR69585
[5] 58cf7c51da
[6] https://github.com/abseil/abseil-cpp/pull/2044

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 955fb2f7c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:19 +02:00
Bernd Kuhls
843b2dffcb package/libks: select BR2_PACKAGE_LIBOPENSSL_ENGINES 
libks makes use of ERR_* functions defined in openssl/err.h which are
included by openssl/engine.h resulting in a build failure when
!BR2_PACKAGE_LIBOPENSSL_ENGINES since commit
623d3bbe43:

/home/buildroot/instance-0/output-1/build/libks-2.0.5/src/ks_ssl.c:111:17:
 error: implicit declaration of function 'ERR_free_strings'; did you mean
 'ERR_load_EC_strings'? [-Wimplicit-function-declaration]
  111 |                 ERR_free_strings();

Fixes:
https://autobuild.buildroot.net/results/aac/aac25e5c584ede962cac95c353afd64bf720199c/

The oldest build error on the master branch dates back to Feb 2025:
https://autobuild.buildroot.net/results/83a/83a207bee796afbc619b62c5ecf89c662484170f/
so a backport to LTS branches should be considered.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 40e9341b0b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:17 +02:00
Dario Binacchi
4de77652d6 package/libgphoto2: fix build with gcc >= 14 
The commit adds an upstream patch to fix the following build failure:

jl2005c/jl2005bcd_decompress.c: In function 'jl2005bcd_decompress':
jl2005c/jl2005bcd_decompress.c:161:46: error: passing argument 3 of 'jpeg_mem_dest' from incompatible pointer type [-Wincompatible-pointer-types]
  161 |         jpeg_mem_dest (&cinfo, &jpeg_header, &jpeg_header_size);
      |                                              ^~~~~~~~~~~~~~~~~
      |                                              |
      |                                              long unsigned int *

Fixes:
- https://autobuild.buildroot.org/results/cb983d9ad90170aa8d7f2b9a5dfc30055d83b5de

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Tested-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit d2ad5b8833)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:14 +02:00
Giulio Benetti
33ec270f8a package/libnss: fix Makefile ifndef FREEBL_NO_DEPEND 
NSS Makefile build system is pretty weak if used with parallel build. In
this case what happens is that 'ifndef FREEBL_NO_DEPEND' appears in
lib/freebl/manifest.mn and coreconf/Linux.mk. When parallel building
variable FREEBL_NO_DEPEND gets defined if not defined to 1, but in the
2 occurences we end up having on variable set to 1 and 1 still not
defined. This results in:
`
/home/giuliobenetti/br-reproduce/3e046c996825447f48377f7c4361b5db26b84f95/output/host/lib/gcc/arm-buildroot-linux-musleabi/14.3.0/../../../../arm-buildroot-linux-musleabi/bin/ld: Linux2.6_arm_arm-buildroot-linux-musleabi-gcc.br_real_glibc_PTH_DBG.OBJ/Linux_SINGLE_SHLIB/lowhash_vector.o: in function `loader_GetOriginalPathname':
lowhash_vector.c:(.text.loader_GetOriginalPathname+0x68): undefined reference to `PR_SetError'
collect2: error: ld returned 1 exit status
`
So let's pass FREEBL_NO_DEPEND=1 when building to define that variable
instead to let NSS Makefile to calculate it.

Fixes:
https://autobuild.buildroot.net/results/ad4/ad40536728303c56d1d0968e38ac36da12cca416//

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 6d3cc38ec0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:12 +02:00
Bernd Kuhls
66127b61bb package/sed: security bump version to 4.10 
https://lists.gnu.org/archive/html/sed-devel/2026-04/msg00027.html
"'sed --follow-symlinks -i' no longer has a TOCTOU race [...]"

Fixes CVE-2026-5958: https://cert.pl/en/posts/2026/04/CVE-2026-5958/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit eb496bd63e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:10 +02:00
Bernd Kuhls
3c502cc273 package/intel-microcode: security bump version to 20260512 
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260512

Fixes CVE-2025-35979:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01420.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3dfde73b67)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:08 +02:00
Bernd Kuhls
6d5e591cdf package/intel-microcode: bump version to 20260227 
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260227

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f489b40190)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:06 +02:00
Thomas Perale
726c6f9591 package/python-cbor2: add CPE ID 
The "cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:*" is a valid CPE
[1][2] for this package.

[1] https://nvd.nist.gov/products/cpe/detail/C9CB66BA-6D92-430D-B3A8-D20C43E0655C
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-26209

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 140d618567)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:03 +02:00
Thomas Perale
b2d223c9fc package/mongoose: fix typo in CPE vendor 
There is no CVE assigned with the vendor name "cesenta".

The CPE ID introduced in [1], correctly reference "cesanta" as a CPE
vendor but introduced a typo while writing the vendor metadata in
`mongoose.mk`.

[1] 3d632c941f package/mongoose: add MONGOOSE_CPE_ID_VENDOR

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit de4044a0c9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:26:01 +02:00
Thomas Perale
9bedf714a0 package/libvncserver: patch CVE-2026-3285{3, 4} 
- CVE-2026-32853:
    LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e)
    contain a heap out-of-bounds read vulnerability in the UltraZip
    encoding handler that allows a malicious VNC server to cause
    information disclosure or application crash. Attackers can exploit
    improper bounds checking in the HandleUltraZipBPP() function by
    manipulating subrectangle header counts to read beyond the allocated
    heap buffer.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-32853
  - https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
  - 009008e2f4

- CVE-2026-32854:
    LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee)
    contain null pointer dereference vulnerabilities in the HTTP proxy
    handlers within httpProcessInput() in httpd.c that allow remote
    attackers to cause a denial of service by sending specially crafted
    HTTP requests. Attackers can exploit missing validation of strchr()
    return values in the CONNECT and GET proxy handling paths to trigger
    null pointer dereferences and crash the server when httpd and proxy
    features are enabled.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-32854
  - https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
  - dc78dee51a

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 258128aefe)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:25:59 +02:00
Bernd Kuhls
483dcc9be8 package/libmodsecurity: security bump version to 3.0.15 
https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.15/CHANGES

Fixes CVE-2026-42268 & CVE-2026-30923.

Rebased patch 0001 due to upstream commit
f38b5b7296

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e00d34dcc9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:25:57 +02:00
Bernd Kuhls
f01bf75c6b package/liburiparser: security bump version to 1.0.2 
https://github.com/uriparser/uriparser/blob/uriparser-1.0.2/ChangeLog

Fixes CVE-2026-44927 & CVE-2026-44928.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f328822cf1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:25:55 +02:00
Shubham Chakraborty
efee1ec453 package/dos2unix: update upstream URLs 
The old upstream page [1] is being deprecated. It currently shows:
"""
This page will go offline on 1 July 2026. Go to the new page at
https://waterlander.net/dos2unix/
"""

This commit updates the homepage, download site and hash file URL
to the new upstream location [2].

[1] http://waterlan.home.xs4all.nl/dos2unix.html
[2] https://waterlander.net/dos2unix/

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 44f60e9f70)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:25:53 +02:00
Bernd Kuhls
b09763e6d9 package/dnsmasq: security bump version to 2.92rel2 
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
https://thekelleys.org.uk/dnsmasq/CVE/

Fixes CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893 & CVE-2026-5172.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6be9c7e9cf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 2026-05-29 10:25:51 +02:00