- Fix CVE-2021-43306: An exponential ReDoS (Regular Expression Denial
of Service) can be triggered in the jquery-validation npm package,
when an attacker is able to supply arbitrary input to the url2 method
- Fix CVE-2022-31147: The jQuery Validation Plugin (jquery-validation)
provides drop-in validation for forms. Versions of jquery-validation
prior to 1.19.5 are vulnerable to regular expression denial of service
(ReDoS) when an attacker is able to supply arbitrary input to the url2
method. This is due to an incomplete fix for CVE-2021-43306. Users
should upgrade to version 1.19.5 to receive a patch.
- Use LICENSE.md instead of README.md which is available since version
1.14.0 and
96b7036eb4https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.4https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.5
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b0f825f448)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a
denial of service (or application crash). This only applies when lxml is
used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and
earlier are not affected. It allows triggering crashes through forged
input data, given a vulnerable code sequence in the application. The
vulnerability is caused by the iterwalk function (also used by the
canonicalize function). Such code shouldn't be in wide-spread use, given
that parsing + iterwalk would usually be replaced with the more
efficient iterparse function. However, an XML converter that serialises
to C14N would also be vulnerable, for example, and there are legitimate
use cases for this code sequence. If untrusted input is received (also
remotely) and processed via iterwalk function, a crash can be
triggered.
https://github.com/lxml/lxml/blob/lxml-4.9.1/CHANGES.txt
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ff3b5ca2c1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It might be necessary for some packages to define environment variables when calling waf build and waf install.
This is done the same way as the others package types, by defining $(PKG)_MAKE_ENV in .mk.
Signed-off-by: David GOUARIN <david.gouarin@thalesgroup.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 95ea6664cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
We used to have a BR2_TOOLCHAIN_HAS_THREADS dependency at the
top-level BR2_PACKAGE_GLSLSANDBOX_PLAYER option to make sure that at
least one of them windowing system was selectable.
However, thanks to the recent introduction of the support for the null
windowing system, we now have a windowing system that doesn't require
any special feature, so we can drop this dependency from the top-level
option.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 624f2e658d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This nullws doesn't need any extra dependency other than the EGL/GLES
ones, which will help simplify the glslsandbox-player package.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 81ad39d62f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure without libexecinfo raised since commit
66d7d3bec3:
CMake Error: The following variables are used in this project, but they are set to NOTFOUND.
Please set them or make sure they are set and tested correctly in the CMake files:
EXECINFO_LIBRARY
linked by target "vcos" in directory /home/buildroot/autobuild/run/instance-1/output-1/build/rpi-userland-14b90ff9d9f031391a299e6e006965d02bfd1bb1/interface/vcos/pthreads
Fixes:
- http://autobuild.buildroot.org/results/0b4b20e4eed1ed5120f22d29fc24038f268e6cc6
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit dd524a6e96)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
There are two extra ending parentheses to be removed.
They are present from the beggining of TF-A package. I suppose extra
ending parenthese does not bring any issue, but it seems relevant to
remove them.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 0829c09527)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following xephyr build failure with kdrive raised since commit
eedbd6f97d:
checking for XEPHYR... no
configure: error: Package requirements (xau xdmcp xcb xcb-shape xcb-render xcb-renderutil xcb-aux xcb-image xcb-icccm xcb-shm >= 1.9.3 xcb-keysyms xcb-randr xcb-xkb xcb-xv) were not met:
Package 'xcb-renderutil', required by 'virtual:world', not found
Package 'xcb-aux', required by 'virtual:world', not found
Package 'xcb-image', required by 'virtual:world', not found
Package 'xcb-icccm', required by 'virtual:world', not found
Package 'xcb-keysyms', required by 'virtual:world', not found
Fixes:
- http://autobuild.buildroot.org/results/baba218c879b67bfbadc9c25d34313abc76397bc
- http://autobuild.buildroot.org/results/9471b77db9aefa2fd0e5be61ea84709183511623
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 90a6572e10)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Though the code compiles with a big endian toolchain, the kvm-unit-tests
do not work at all in big endian mode on ARM. Until someone steps up to
fix this, disable the package completely on big endian ARM targets.
Signed-off-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b4f8c41b5e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following sh4aeb build failure:
In file included from nlist.c:44:
nlist.c: In function '__elf_is_okay__':
local-elf.h:223:25: error: 'ELFDATA2LMSB' undeclared (first use in this function); did you mean 'ELFDATA2LSB'?
223 | #define ELF_TARG_DATA ELFDATA2LMSB
| ^~~~~~~~~~~~
Fixes:
- http://autobuild.buildroot.org/results/2980fb79c208454195d77383f1ece9afbd7f981b
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit bb2e5e2f76)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Pass LDFLAGS (which will contain -static) to fix the following static
build failure with uclibc:
/nvmedata/autobuild/instance-15/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/10.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld: /nvmedata/autobuild/instance-15/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/10.3.0/libgcc.a(unwind-dw2-fde-dip.o): in function `_Unwind_Find_FDE':
/nvmedata/autobuild/instance-15/output-1/build/host-gcc-final-10.3.0/build/sparc-buildroot-linux-uclibc/libgcc/../../../libgcc/unwind-dw2-fde-dip.c:469: undefined reference to `dl_iterate_phdr'
Fixes:
- http://autobuild.buildroot.org/results/168202f65d168acc55b4d946c2e2416bf890c32c
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7b29d6dc77)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The NOTICE file contains a long list of licenses. A few of them are MIT,
BSD-2-Clause, BSD-3-Clause, or BSD-4-Clause. And then there are many
that are somewhat similar but not exactly.
Mention all the "known" licenses in LIBKRB5_LICENSE, and add "others" to
indicate that there is more.
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3cffd1d68b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
shadowsocks-libev builds a number of static libraries, which end up
being used in a shared library. Unfortunately, the code of those
static libraries is built without fPIC due to a bogus usage of
libtool.
This commit adds a patch that fixes how libtool is used, to make sure
its produce correct convenience libraries, than can in-turn be linked
into shared libraries.
Fixes:
http://autobuild.buildroot.net/results/75ca164903b8d47fa67343a4c2df11ce3f91d2bd/
and many similar other build failures
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 380d9ad503)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The --enable option was added to CONF_ENV instead of CONF_OPTS. For this
defconfig
BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_LINUX_KERNEL=y
BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
BR2_PACKAGE_ZFS=y
BR2_PACKAGE_LINUX_PAM=y
this yields
/bin/sh: line 1: --enable-pam=yes: command not found
While we're at it, also remove the =yes which we usually don't add.
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8f79ab8f1e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
- Fix CVE-2022-33070: Protobuf-c v1.4.0 was discovered to contain an
invalid arithmetic shift via the function parse_tag_and_wiretype in
protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause
a Denial of Service (DoS) via unspecified vectors.
- Use official tarball (and so drop autoreconf)
- Update hash of COPYING (year updated with
471aaa5f6d)
https://github.com/protobuf-c/protobuf-c/releases/tag/v1.4.1
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit cbbd2dae9e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2022-34265: An issue was discovered in Django 3.2 before 3.2.14
and 4.0 before 4.0.6. The Trunc() and Extract() database functions are
subject to SQL injection if untrusted data is used as a kind/lookup_name
value. Applications that constrain the lookup name and kind choice to a
known safe list are unaffected.
https://www.djangoproject.com/weblog/2022/jul/04/security-releases
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3e4f6e1b20)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Through mstpd version 0.1.0, the bridge-stp script uses the '-c'
option to the pidof command. Busybox does not support this option, so
mstpd does not work.
This has been fixed in the main development branch of mstpd, but it is
unclear when the next release will be. In the meantime, apply the fix
here so that mstpd will be useable until the next version release.
Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e19051a1a1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When building with the DRM support, it can happen that the libgbm library
is not yet built by the provider of this lib (specified by
BR2_PACKAGE_PROVIDES_LIBGBM).
The docs in cog `docs/platform-drm.md` specify this dep-list:
- **WPEBackend-fdo**:
- **Wayland**:
- **libdrm**:
- **libgbm**:
- **libinput**:
- **libudev**:
libgbm needs to be added.
Adding libegl as well.
Updated package/cog/Config.in to define the dependencies (for DRM)
according to libegl & libgbm.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 1d207e4c3c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure with uclibc:
core/bootloader.c: In function 'register_bootloader':
core/bootloader.c:28:15: warning: implicit declaration of function 'reallocarray' [-Wimplicit-function-declaration]
28 | entry *tmp = reallocarray(available, num_available + 1, sizeof(entry));
| ^~~~~~~~~~~~
core/bootloader.c:28:15: warning: initialization of 'entry *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
[...]
.../arm-buildroot-linux-uclibcgnueabi/bin/ld: core/built-in.o: in function `register_bootloader':
(.text.register_bootloader+0x2c): undefined reference to `reallocarray'
Fixes:
http://autobuild.buildroot.net/results/46dc484759549162ec246e0bff2647995c307ab5/
Signed-off-by: Ben Hutchings <ben.hutchings@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2e766f73c4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Contains various fixes some of which may effect pthread fork handling.
Add patch reverting a commit breaking builds.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8d6e07e525)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add libmaxminddb optional dependency (which is enabled by default), two
options must be used to enable/disable this dependency:
[pairwise: --enable-geoip --with-maxminddb=auto, --enable-geoip --with-maxminddb=yes, --disable-geoip]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 25eea4424f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
wine unconditionally uses pthread_attr_setstack resulting in the
following build failure without NPTL:
/home/buildroot/autobuild/instance-3/output-1/host/lib/gcc/i586-buildroot-linux-uclibc/11.3.0/../../../../i586-buildroot-linux-uclibc/bin/ld: dlls/ntdll/unix/thread.o: in function `NtCreateThreadEx':
thread.c:(.text+0x61b): undefined reference to `pthread_attr_setstack'
Fixes:
- http://autobuild.buildroot.org/results/a866d65cda97845a8c829acad2c057bab00cde08
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 14c093d258)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
ZeroMQ added SO_PRIORITY in version 4.3.4, SO_BINDTODEVICE in 4.2.3, and
O_CLOEXEC since before 2.1.11. Checks for these feature are incompatible
with cross compilation. Linux supports SO_PRIORITY, and SO_BINDTODEVICE
since before 2.6. O_CLOEXEC is supported since 2.6.23. Keep them always
enabled.
Cc: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3d4a5a77e5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
