Fixes the following security vulnerability:
CVE-2024-10573: An out-of-bounds write flaw was found in mpg123 when
handling crafted streams. When decoding PCM, the libmpg123 may write past
the end of a heap-located buffer. Consequently, heap corruption may happen,
and arbitrary code execution is not discarded. The complexity required to
exploit this flaw is considered high as the payload must be validated by the
MPEG decoder and the PCM synth before execution. Additionally, to
successfully execute the attack, the user must scan through the stream,
making web live stream content (such as web radios) a very unlikely attack
vector.
https://www.openwall.com/lists/oss-security/2024/10/30/2
Release notes:
https://sourceforge.net/p/mpg123/mailman/message/58834094/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 35d2880e33)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerability:
CVE-2024-8508: A vulnerability has been discovered in Unbound when handling
replies with very large RRsets that Unbound needs to perform name
compression for.
https://nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: update pgp key id in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f98b643fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerability:
CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET
https://lists.gnu.org/archive/html/help-libtasn1/2025-02/msg00001.html
Adjust the license files after upstream moved the license clarification to
README.md and moved the COPYING* files top the top level directory /
slightly updated the COPYING* files (http->https) with:
73cc886c3f
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2867f4be42)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The error was introduced by the libcurl bump to 8.12.0 with buildroot
commit 2da031c2e5.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e85cd58fc5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 52154e5206 (package/zstd: build multithreaded library if
supported) added an override of a previously defined variable, so an
explicit check-package exception was added in 0f0e913f10
(package/zstd: rework build and install). Eventually, in 253a951c4f
(package/zstd: fix build without threads) the variable override was
removed.
However, the check-package exception was left out during the rework in
253a951c4f, so it now excludes nothing.
Drop this exception now.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ad25dd6159)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As pointed out by shellcheck, the exit code of the start/stop/restart/reload
command is clobbered by the 'echo "FAIL'" statement:
In package/mdnsd/S50mdnsd line 52:
exit $?
^-- SC2320 (warning): This $? refers to echo/printf, not a previous command. Assign to variable to avoid it being overwritten.
So introduce a $status variable to keep track of it, similar to how it is
done in S40iwd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit be20c12e15)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As host-heimdal is only used by samba4, and samba4 already depends on
host-flex and host-bison, the build issue fixed by this commit is not
directly visible, but can be reproduced by doing "make host-heimdal"
for example in our official Buildroot Docker container:
/home/thomas/projets/buildroot/outputs/foo/build/host-heimdal-f4faaeaba371fff3f8d1bc14389f5e6d70ca8e17/missing: line 81: flex: command not found
WARNING: 'flex' is missing on your system.
You should only need it if you modified a '.l' file.
You may want to install the Fast Lexical Analyzer package:
<https://github.com/westes/flex>
make[4]: *** [Makefile:753: lex.c] Error 127
[...]
updating lex.yylex.c
../../ylwrap: line 176: -d: command not found
make[4]: *** [Makefile:756: parse.c] Error 127
Fix this by adding the missing dependencies.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 44e739d031)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot fails to build Linux kernel configurations where BTF support
is enabled together with zstd compression of debugging information.
The reason is in host-elfutils zstd support being explicitly disabled.
So enable zstd support in host-elfutils by default to fix such builds.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 315672feec)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Chris email address at boundarydevices is bouncing:
Chris Dimich is no longer with Ezurio. Please contact Gary Bisson by
email at Gary.Bisson@ezurio.com. Thank you!"
Move his package to Gary Bisson as suggested.
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 892d1ae27f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
go1.22.12 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler and the go
command.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
ARC support was added in 0.10.0 by
4997efa59a
so drop the architecture dependency on !BR2_arc.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 99140408b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Take a patch from meta-riscv, which was submitted upstream by Khem Raj
to fix a build issue on RISC-V 32-bit musl configurations. This issue
has been discussed with musl developers who believe this is a Busybox
issue. The patch from Khem works around the issue by making it a
runtime failure just affecting hwclock on RISC-V 32-bit musl instead
of a build failure. The correct fix is not really clear, as there
seems to be a disagreement between Busybox people and musl people on
what the C library settimeofday() function should do, and that's why
Busybox is bypassing settimeofday() on musl by making a direct system
call, except this system call doesn't exist on RISC-V 32-bit.
In the mean time, this patch fixes the long standing Gitlab CI issue:
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslStable
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291684
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslBleedingEdge
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291683
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a956eeb96b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit adds patches, which were all backported from upstream, or
submitted upstream, and that fix various CVEs. To facilitate the
backporting work, we took the backports from openembedded-core.
CVE-2021-42380: this one is not marked by NVD as affecting 1.36.1, but
its fix was merged after 1.36.1, so it seems like the NVD data is
incorrect. Therefore, no need for a BUSYBOX_IGNORE_CVES entry. Patch
is upstream, backport taken from openembedded-core.
CVE-2023-42363, CVE-2023-42364, CVE-2023-42365: patches are upstream,
backports taken from openembedded-core.
CVE-2023-42366: patch has been submitted upstream but not merged,
patch taken from openembedded-core.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 75c594d446)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cuserid is deprecated and breaks the compilation on some new toolchains.
This patch fixes this issue.
Fixes:
#81
Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a141b117e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It fixes an arbitrary file overwrite vulnerability in the readline.sh.
(CVE-2024-54661)
see - http://www.dest-unreach.org/socat/contrib/socat-secadv9.html
README hash changed due to version update.
Note: Buildroot is not impacted by this vulnerability as the
readline.sh is not installed on target.
Quoting changelog [1]:
Mitigating factors: readline.sh is usually neither installed in a bin
directory nor is it documented. Major Linux distributions install it in
examples/ or doc/; however it is invoked by test.sh script.
[1] https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.0.2:/CHANGES
Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
[Julien: add note that Buildroot is not impacted in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d70df3ab44)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
7.2.6:
- (CVE-2024-31449) Lua library commands may lead to stack overflow and
potential RCE
- (CVE-2024-31227) Potential Denial-of-service due to malformed ACL
selectors
- (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern
matching
7.2.7:
- (CVE-2024-46981) Lua script commands may lead to remote code execution
- (CVE-2024-51741) Denial-of-service due to malformed ACL selectors
https://github.com/redis/redis/releases/tag/7.2.6https://github.com/redis/redis/releases/tag/7.2.7
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f3e99436ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
go1.22.11 (released 2025-01-16) includes security fixes to the crypto/x509
and net/http packages, as well as bug fixes to the compiler, the runtime,
and the net package.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerabilities:
Worker permission bypass via InternalWorker leak in diagnostics
(CVE-2025-23083) - (high)
With the aid of the diagnostics_channel utility, an event can be hooked into
whenever a worker thread is created. This is not limited only to workers
but also exposes internal workers, where an instance of them can be fetched,
and its constructor can be grabbed and reinstated for malicious usage.
This vulnerability affects Permission Model users (--permission) on Node.js
v20, v22, and v23.
GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
A memory leak could occur when a remote peer abruptly closes the socket
without sending a GOAWAY notification. Additionally, if an invalid header
was detected by nghttp2, causing the connection to be terminated by the
peer, the same leak was triggered. This flaw could lead to increased memory
consumption and potential denial of service under certain conditions.
This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
For more details, see the announcement:
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Update the LICENSE hash for a reformatting and removal of the highlight.js license:
6ca0cfc6021dfd238781
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
- CVE-2024-56826: A flaw was found in the OpenJPEG project. A heap buffer
overflow condition may be triggered when certain options are specified
while using the opj_decompress utility. This can lead to an application
crash or other undefined behavior.
https://access.redhat.com/security/cve/CVE-2024-56826
- CVE-2024-56827: A flaw was found in the OpenJPEG project. A heap buffer
overflow condition may be triggered when certain options are specified
while using the opj_decompress utility. This can lead to an application
crash or other undefined behavior.
https://access.redhat.com/security/cve/CVE-2024-56827
Release notes: https://github.com/uclouvain/openjpeg/blob/v2.5.3/NEWS.md
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3bfa5ebcbf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When the Xen tools are built, a number of init scripts are installed to
the target.
Some of those Xen scripts require bash to run:
- /etc/init.d/S50xencommons
- /etc/init.d/S50xen-watchdog
- /etc/init.d/S60xendomains
- /etc/xen/scripts/launch-xenstore
- /usr/lib/xen/bin/xendomains
Make sure to select bash when the Xen tools are selected (we need to
select "busybox show others" for that, too).
Suggested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Alistair Francis <alistair@alistair23.me>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bf18fd4cd1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For change log since 20240927, see:
https://github.com/user-attachments/files/18117996/changes.txt
Note: the change log mention "Fix 2 critical CVE addressing memory
leaks" without providing actual CVE numbers. For reference, the
upstream commits for those security fixes are [1] and [2]. From the log
of those commits, it seems those memory leaks can only happen in old
Kernels <= 4.9 (which is end-of-life since January 2023). Technically
those leaks could happen in any program embedding the apcica code
files. The impact seems very low, if any, on the acpica standalone
tools.
[1] 987a3b5cf7
[2] 8829e70e13
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 892e1608f5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
