mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity
56,333 Commits 6 Branches 483 Tags
88beade8dffcb11813339a90f30c4fa70c812912
Commit Graph

56333 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Fabrice Fontaine
88beade8df package/domoticz: drop first patch 
Patch not needed since commit 37f197f863
which bumped host-cmake dependency from 3.10 to 3.15

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8a46b41b4a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 11:50:54 +02:00
Michael Nosthoff
ab35658b2c package/libgpiod: bump to version 1.6.3 
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8d51ee7c79)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 11:49:25 +02:00
Bernd Kuhls
ee78156d10 package/libcurl: bump version to 7.76.1 
Bugfix release.  For details, see the changelog:
https://curl.se/changes.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cffe295259)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 11:46:23 +02:00
Fabrice Fontaine
a5755b2c11 package/m4: fix build with glibc 2.34 
m4 fails to build with glibc 2.34 because SIGSTKSZ is now a run-time
variable since
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=6c57d320484988e87e446e2e60ce42816bf51d53

So backport an upstream patch from gnulib, see:
https://lists.gnu.org/archive/html/bug-m4/2021-03/msg00015.html

An other option would have been to apply patch from
https://lists.gnu.org/archive/html/bug-m4/2021-03/msg00024.html
but no feedback was received on this patch

Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13721

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5a9504831f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 11:45:36 +02:00
Thomas Petazzoni
89297fc9ee support/scripts/cve.py: use proper CPE ID version when available 
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d06bf96097)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 11:42:24 +02:00
Sergio Prado
534c912f3c package/tio: disable for sparc and sparc64 architectures 
tio fails to build on sparc and sparc64 architectures with a
redefinition of 'struct termio' error, with no proper fix or workaround
for now. See discussions in [1] and [2] and picocom source code in [3].

[1] http://patchwork.ozlabs.org/project/buildroot/patch/20191227204520.1500501-1-fontaine.fabrice@gmail.com/
[2] http://patchwork.ozlabs.org/project/buildroot/patch/20200511142602.46170-1-vadim4j@gmail.com/
[3] https://github.com/npat-efault/picocom/blob/master/termbits2.h#L37

So let's disable it for now on sparc and sparc64 architectures.

Fixes:
http://autobuild.buildroot.org/results/e041dde522e2a774f528d4377f67ca0a8a99461c
http://autobuild.buildroot.org/results/6e1f9fe47e8b2cfdf5effcb7bbc697189f54ff2c
http://autobuild.buildroot.org/results/49708fe6f404fea6761f102af854e98d6a1d43c1
Many more...

Signed-off-by: Sergio Prado <sergio.prado@e-labworks.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5e37992132)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 09:10:03 +02:00
Peter Korsgaard
19cd3886c8 support/scripts/cve.py: use fast ijson backend if available on old ijson versions 
ijson < 2.5 (as available in Debian 10) use the slow python backend by
default instead of the most efficient one available like modern ijson
versions, significantly slowing down cve checking. E.G.:

time ./support/scripts/pkg-stats --nvd-path ~/.nvd -p avahi --html foobar.html

Goes from
174,44s user 2,11s system 99% cpu 2:58,04 total

To
93,53s user 2,00s system 98% cpu 1:36,65 total

E.G. almost 2x as fast.

As a workaround, detect when the python backend is used and try to use a
more efficient one instead.  Use the yajl2_cffi backend as recommended by
upstream, as it is most likely to work, and print a warning (and continue)
if we fail to load it.

The detection is slightly complicated by the fact that ijson.backends used
to be a reference to a backend module, but is nowadays a string (without the
ijson.backends prefix).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f31227e628)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 09:09:04 +02:00
Michael Nosthoff
aa649c0f96 package/systemd: fix homed dependency warning 
Fixes:

showing "enable home daemon"
and "homed support needs a toolchain w/ threads, dynamic library, kernel headers >= 4.12"
when BR2_TOOLCHAIN_HEADERS_AT_LEAST_4_12

introduced by fa62b5165c

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5d4dc98c58)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 09:08:26 +02:00
James Hilliard
283e4e52b9 package/libdrm: fix man page disabling option 
Commit 841c695468 (libdrm: change to meson build system) converted the
autotools --disable-manpages to the neson -Dmanpages=false. However, the
actual option is 'man-pages':

    WARNING: Unknown options: "manpages"

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: tweak commit log as per Peter's review]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 56fd68b688)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 09:07:24 +02:00
Fabrice Fontaine
92b2bac969 package/libcgroup: add LIBCGROUP_CPE_ID_VENDOR 
cpe:2.3:a:libcgroup_project:libcgroup is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alibcgroup_project%3Alibcgroup

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6333d5d1dc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 08:59:24 +02:00
Bernd Kuhls
f8170a9da3 package/x11r7/xserver_xorg-server: remove unused configure option --disable-xsdl 
Upstream removed this configure option:
https://cgit.freedesktop.org/xorg/xserver/commit/configure.ac?h=server-1.20-branch&id=52bc6d944946e66ea2cc685feaeea40bb496ea83

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 51761e0f93)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 08:54:35 +02:00
Bernd Kuhls
299908a058 package/x11r7/xserver_xorg-server: remove optional support for tslib 
Upstream removed support for tslib:
https://cgit.freedesktop.org/xorg/xserver/commit/configure.ac?h=server-1.20-branch&id=5c7ed785e3bdb9f0fbf8fbfdc93b5fdd2b2c7dbf

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 974448aed3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 08:54:20 +02:00
Bernd Kuhls
1f6d61c0ff package/x11r7/xserver_xorg-server: remove evdev input drivers for kdrive 
Upstream removed the evdev driver for kdrive:
https://cgit.freedesktop.org/xorg/xserver/commit/configure.ac?h=server-1.20-branch&id=27819950e4158326e0f83a30f2e8968b932625ef

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 553a123526)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 08:49:49 +02:00
Bernd Kuhls
92027e79d0 package/x11r7/xserver_xorg-server: remove xfbdev 
Upstream removed the kdrive framebuffer device server:
https://cgit.freedesktop.org/xorg/xserver/commit/configure.ac?h=server-1.20-branch&id=feed7e3f982a7ac14f6fe85ed2e1ec4a83700841

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2779de195f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 08:47:37 +02:00
Bernd Kuhls
711b6961bf package/x11r7/xserver_xorg-server: remove non-evdev input drivers for kdrive 
Upstream removed support for non-evdev input drivers for kdrive:
https://cgit.freedesktop.org/xorg/xserver/commit/configure.ac?h=server-1.20-branch&id=e7b8b7b131d8283c96ed0aff4593ab41441b5d3b

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eea0da855b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-26 08:45:03 +02:00
Bernd Kuhls
f7d613f470 package/x11r7/xserver_xorg-server: security bump version to 1.20.11 
Fixes CVE-2021-3472:
https://lists.x.org/archives/xorg-announce/2021-April/003080.html

Release notes:
https://lists.x.org/archives/xorg-announce/2021-April/003081.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d12c8c43fd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 09:46:43 +02:00
Einar Jon Gunnarsson
62fc51d669 package/modem-manager: add support for introspection 
Enable introspection when GObject Introspection is enabled.

Signed-off-by: Einar Jon Gunnarsson <tolvupostur@gmail.com>
Acked-by: Aleksander Morgado <aleksander@aleksander.es>
[yann.morin.1998@free.fr: drop config option, rely on GOI package]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c45accd295)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 09:42:35 +02:00
Peter Korsgaard
a4822f31ca package/genext2fs: add upstream patch to fix permission handling of the root node 
Fixes https://bugs.buildroot.org/show_bug.cgi?id=13741

Patch from upstream repo:
8e4b9ae6f0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 09:36:34 +02:00
Fabrice Fontaine
b3b02e7c94 package/quickjs: disable on nios2 
quickjs unconditionally uses FE_{DOWN,UP}WARD and so fails to build on
nios2 since its addition in commit
5d50793659

Fixes:
 - http://autobuild.buildroot.org/results/69e280a7f478d1b16be989c7bd559f766053134b
 - http://autobuild.buildroot.org/results/f2c3ef7e3bbe30ac24710288336adabebd8b83a6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b147af911a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 09:20:57 +02:00
Fabrice Fontaine
44a17be3e2 package/systemd: fix /etc/resolv.conf link on per-package build 
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13271

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 511fbda0be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 09:03:41 +02:00
Peter Korsgaard
7c5d4b7131 package/docker-engine: add CPE variables 
cpe:2.3:a:docker:docker is a valid CPE identifier for this package:

https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Adocker%3Adocker

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b59ebb66f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 09:00:38 +02:00
Peter Korsgaard
bac683c71d package/docker-cli: add CPE variables 
cpe:2.3:a:docker:docker is a valid CPE identifier for this package:

https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Adocker%3Adocker

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b0b37310b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 09:00:33 +02:00
Romain Naour
fdef161c8f package/gcc: bump to version 10.3 
Remove upstream patch
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=5aeabae7f0cdd8dd3a01103b68b2e7a66a71c685

Rebase the patch: Revert "re PR target/92095 (internal error with -O1 -mcpu=niagara2 -fPIE)"
Add the link to the bug report.

Tested with toolchain-builder:
https://gitlab.com/kubu93/toolchains-builder/-/pipelines/284176939

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 81b0170a59)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:57:49 +02:00
Fabrice Fontaine
25931d53c7 package/python-aioconsole: bump to version 0.3.1 
https://github.com/vxgmichel/aioconsole/releases/tag/v0.3.1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0bc4a7ea6d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:55:19 +02:00
Sergio Prado
996b8ecd1b package/snort: bump version to 2.9.17.1 
This is a bug fix release:

https://www.snort.org/downloads/snort/release_notes_2.9.17.1.txt

Signed-off-by: Sergio Prado <sergio.prado@e-labworks.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8453641c8c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:54:18 +02:00
Fabrice Fontaine
292eb944f3 package/readline: add Signed-off-by and renumber patch 
Add Signed-off-by and while at it, renumber it

Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13731

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 575c60ff9a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:53:05 +02:00
Peter Korsgaard
8fa2da0382 package/i2c-tools: add upstream post-4.2 i2ctransfer fix 
i2c-tools 4.2 contained an invalid check, leading to verbose false-positive
warning messages when the variable length ({r,w}?) option is used:

https://www.spinics.net/lists/linux-i2c/msg50032.html
https://www.spinics.net/lists/linux-i2c/msg50253.html

Unfortunately upstream does not make bugfix releases, instead opting to list
such bugfixes on the wiki:

https://i2c.wiki.kernel.org/index.php/I2C_Tools

So add the patch here.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 535c65594c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:52:47 +02:00
Peter Korsgaard
58055d171a package/clamav: security bump to version 0.103.2 
Fixes the following security issues:

- CVE-2021-1386: Fix for UnRAR DLL load privilege escalation.  Affects
  0.103.1 and prior on Windows only.

- CVE-2021-1252: Fix for Excel XLM parser infinite loop.  Affects 0.103.0
  and 0.103.1 only.

- CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash.
  Affects 0.103.0 and 0.103.1 only.

- CVE-2021-1405: Fix for mail parser NULL-dereference crash.  Affects
  0.103.1 and prior.

- CVE-2021-27506: The ClamAV Engine (Version 0.103.1 and below) embedded in
  Storsmshield Network Security (1.0 to 4.1.5) is subject to DoS in case of
  parsing of malformed png files.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7aee27c2b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:51:52 +02:00
Fabrice Fontaine
ef01448d97 package/python-httplib2: add CPE variables 
cpe:2.3:a:httplib2_project:httplib2 is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ahttplib2_project%3Ahttplib2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 44deddbf82)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:50:45 +02:00
Fabrice Fontaine
6c0c05d6d5 package/python-httplib2: security bump to version 0.19.1 
- Fix CVE-2021-21240: httplib2 is a comprehensive HTTP client library
  for Python. In httplib2 before version 0.19.0, a malicious server
  which responds with long series of "\xa0" characters in the
  "www-authenticate" header may cause Denial of Service (CPU burn while
  parsing header) of the httplib2 client accessing said server. This is
  fixed in version 0.19.0 which contains a new implementation of auth
  headers parsing using the pyparsing library.
- Fix CVE-2020-11078: In httplib2 before version 0.18.0, an attacker
  controlling unescaped part of uri for `httplib2.Http.request()` could
  change request headers and body, send additional hidden requests to
  same server. This vulnerability impacts software that uses httplib2
  with uri constructed by string concatenation, as opposed to proper
  urllib building with escaping. This has been fixed in 0.18.0.
- Use LICENSE file instead of PKG-INFO
- pyparsing is a runtime dependency since version 0.19.0 and
  bd9ee252c8

https://github.com/httplib2/httplib2/blob/v0.19.1/CHANGELOG

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2050b4869d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:50:38 +02:00
Fabrice Fontaine
792a56ddee package/sysdig: add SYSDIG_CPE_ID_VENDOR 
cpe:2.3:a:sysdig:sysdig is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asysdig%3Asysdig

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 16770c8cb9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:47:22 +02:00
Fabrice Fontaine
d6e09cf9a2 package/network-manager: bump to version 1.22.16 
Notice: This fixes a security issue, but in code not used in Buildroot:

ifcfg-rh: handle "802-1x.{,phase2-}ca-path". Otherwise setting this
property silently fails and a profile might accidentally not perform
any authentication (CVE-2020-10754).

Update indentation in hash file (two spaces)

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.22.16/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: Clarify that security issue isn't applicable to Buildroot]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6db751e1e1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-25 08:45:16 +02:00
Fabrice Fontaine
7b47e4d3f1 package/x11r7/xdriver_xf86-video-ati: add missing dependency 
Fix the following build failure which is raised since commit
a3aac6d847:

WARNING: unmet direct dependencies detected for BR2_PACKAGE_MESA3D_DRI_DRIVER_RADEON
  Depends on [n]: BR2_PACKAGE_MESA3D [=y] && (BR2_i386 [=n] || BR2_x86_64 [=n])
  Selected by [y]:
  - BR2_PACKAGE_XDRIVER_XF86_VIDEO_ATI [=y] && BR2_PACKAGE_XORG7 [=y] && BR2_PACKAGE_XSERVER_XORG_SERVER_MODULAR [=y] && BR2_PACKAGE_MESA3D [=y]

Fixes:
 - http://autobuild.buildroot.org/results/36773085f933ab2ee558f53a6c0ae5365077ad5e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6aa602e783)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 16:29:04 +02:00
Bernd Kuhls
049221fd03 package/ffmpeg: security bump to version 4.3.2 
Fixes the following security issues:

- CVE-2020-35964: track_header in libavformat/vividas.c in FFmpeg 4.3.1 has
  an out-of-bounds write because of incorrect extradata packing.

- CVE-2020-35965: decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an
  out-of-bounds write because of errors in calculations of when to perform
  memset zero operations.

Removed patch which was applied upstream:
ca55240b8c

Changelog:
http://git.videolan.org/?p=ffmpeg.git;a=blob;f=Changelog;h=28d79ea1aed0a59f43ee922f5b6efa82dc7e2b18;hb=refs/heads/release/4.3

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2a3cfb2381)
[Peter: mark as security fix, extend commit message]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 16:25:37 +02:00
Fabrice Fontaine
aaf958cb64 package/acl: add ACL_CPE_ID_VENDOR 
cpe:2.3:a:acl_project:acl is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aacl_project%3Aacl

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 678edb144b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 15:03:35 +02:00
Fabrice Fontaine
0dfa158021 package/openldap: bump to version 2.4.58 
Drop fifth patch (already in version)

https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4_58/CHANGES

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1feedcd845)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 15:02:56 +02:00
Fabrice Fontaine
7cb626a622 package/bridge-utils: fix build on musl 
Build on musl is broken since bump to version 1.7.1 in commit
5f2d38df4f

Fixes:
 - http://autobuild.buildroot.org/results/0f080ff6913595ee2732b93206e5001c837c1bcc

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aa75b053ba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 15:01:11 +02:00
Fabrice Fontaine
359aa439a5 package/bridge-utils: bump to version 1.7.1 
Fixes compile warnings with gcc 10.x:
https://git.kernel.org/pub/scm/network/bridge/bridge-utils.git/commit/?h=main&id=a1f20223cfcf7b9eae8c9e7e7a07e7bf1377f65b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5f2d38df4f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 14:59:37 +02:00
Bernd Kuhls
18ddd90fd9 package/x11r7/xlib_libXaw: bump version to 1.0.14 
Release notes:
https://lists.x.org/archives/xorg-announce/2021-March/003077.html

Reformatted hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ad259f06cc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 14:55:45 +02:00
Fabrice Fontaine
fd12eb931d package/python-markdown2: add PYTHON_MARKDOWN2_CPE_ID_VENDOR 
cpe:2.3:a:python-markdown2_project:python-markdown2 is a valid CPE
identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apython-markdown2_project%3Apython-markdown2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aaa96d7887)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-24 14:52:12 +02:00
Peter Korsgaard
09714c8d52 package/tar: add upstream security fix for CVE-2021-20193 
Fixes the following security issue:

- CVE-2021-20193: A flaw was found in the src/list.c of tar 1.33 and
  earlier.  This flaw allows an attacker who can submit a crafted input file
  to tar to cause uncontrolled consumption of memory.  The highest threat
  from this vulnerability is to system availability

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-10 18:40:21 +02:00
Bernd Kuhls
af4bd15ff0 package/tor: do not install systemd service file 
Upstream removed the sample service file for use with systemd:
https://gitweb.torproject.org/tor.git/commit/contrib?h=maint-0.4.5&id=915af1a65bc217fa33490876199bb69f760bea23

Fixes:
http://autobuild.buildroot.net/results/b80/b807f19283528b9f0d0c46250b660ea84695679c/
http://autobuild.buildroot.net/results/de4/de4f1a99b1c524b81579ee804156e26d3f8babe7/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit acd317d907)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-08 09:39:22 +02:00
Dick Olsson
08dc05d123 DEVELOPERS: Add Dick Olsson for all skarnet and s6 packages 
Signed-off-by: Dick Olsson <hi@senzilla.io>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 39763ca74e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-08 09:33:17 +02:00
Peter Korsgaard
df8a5a8eb1 package/avahi: ignore CVE-2021-26720 
CVE-2021-26720 is an issue in avahi-daemon-check-dns.sh, which is part of
the Debian packaging and not part of upstream avahi - So ignore the CVE.

https://security-tracker.debian.org/tracker/CVE-2021-26720

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3eadd76740)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-08 09:31:28 +02:00
Peter Korsgaard
28283f68d6 Revert "package/mender: install dbus authentication file if dbus is selected" 
Fixes:
http://autobuild.buildroot.net/results/841d49ffa0ce275fde088b46845d7c74bd30b82a

This reverts commit 22ca8558a8.

io.mender.AuthenticationManager.conf was only added in mender 2.5.0:
2e233164d5

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-07 20:05:05 +02:00
Peter Korsgaard
6668381363 CHANGES: Add last minute 2021.02.1 updates 
Busybox and python-django have been updated as well.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021.02.1 		2021-04-07 12:20:21 +02:00
Peter Korsgaard
bb10b0dfe6 Update for 2021.02.1 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-07 12:18:44 +02:00
Peter Korsgaard
1dc392a31d package/nodejs: security bump to version 12.22.1 
Fixes the following security issues:

CVE-2020-7774: npm upgrade to 6.14.12 - Update y18n to fix
Prototype-Pollution (High)

This is a vulnerability in the y18n npm module which may be exploited by
prototype pollution.

https://github.com/advisories/GHSA-c4w7-xm78-47vh

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0918d2bf2d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-07 11:21:52 +02:00
Peter Korsgaard
b28cf20fee package/python-django: security bump to version 3.0.14 
Fixes the following security issue:

CVE-2021-28658: Potential directory-traversal via uploaded files

MultiPartParser allowed directory-traversal via uploaded files with suitably crafted file names.

Built-in upload handlers were not affected by this vulnerability.

For more details, see the announcement:
https://www.djangoproject.com/weblog/2021/apr/06/security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cb5bfd63d9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-07 11:17:13 +02:00
Peter Korsgaard
841e1b0336 package/busybox: add upstream gunzip security fix 
Fixes the following security issue:

- CVE-2021-28831: decompress_gunzip.c in BusyBox through 1.32.1 mishandles
  the error bit on the huft_build result pointer, with a resultant invalid
  free or segmentation fault, via malformed gzip data.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0f4ec05ed0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-04-07 11:17:05 +02:00