Commit Graph

78871 Commits

Author SHA1 Message Date
Bernd Kuhls
8a43a66271 package/kodi-inputstream-adaptive: bump version to 21.5.16-Omega
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-10-01 19:25:37 +02:00
Bernd Kuhls
1e7f07c967 package/{mesa3d, mesa3d-headers}: bump version to 25.2.3
Release notes:
https://lists.freedesktop.org/archives/mesa-announce/2025-September/000821.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-10-01 19:23:29 +02:00
Bernd Kuhls
744cdebc55 linux: bump latest version to 6.17
For an overview of changes in 6.17, see:
https://kernelnewbies.org/Linux_6.17

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to kernelnewbies.org overview]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-10-01 18:43:07 +02:00
Bernd Kuhls
76d25d365b {toolchain, linux-headers}: add support for 6.17 headers
And add (and default to) 6.17 to linux-headers.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-10-01 18:43:07 +02:00
Bernd Kuhls
507653a74a {linux, linux-headers}: bump 6.{1, 6, 12, 16}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-10-01 18:43:07 +02:00
Nicolas Cavallari
5e28e8d34d package/linux-firmware: add option for ath12k firmwares
Add options to install the WCN7850 or QCN9274 firmware.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
[Julien:
 - reindent _FIRMWARE_FILES with one tab
 - move ath12k license hashes near ath10k
 - inverse QCN9274/WCN7850 order in Config.in
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 22:21:48 +02:00
Nicolas Cavallari
752fc349a0 package/linux-firmware: fix license file for ath10k firmware
The WHENCE file [1] indicates ath10k's license file is
LICENSE.QualcommAtheros_ath10k license and not LICENCE.atheros_firmware.

[1] https://gitlab.com/kernel-firmware/linux-firmware/-/blob/20250627/WHENCE#L3700

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
[Julien: add link to WHENCE file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 22:13:25 +02:00
Fabio Estevam
ed8318f6ec package/crucible: bump to version 2025.05.28
Bump to version 2025.05.28. See release note:
https://github.com/usbarmory/crucible/releases/tag/v2025.05.28

Signed-off-by: Fabio Estevam <festevam@gmail.com>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 22:03:33 +02:00
James Hilliard
78a8491d81 package/uefisettings: bump to version 149bc92970949d44be641ae1e3e942220d7390e7
For change list, see:
f90aed759b...149bc92970

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add link to change list]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 21:54:14 +02:00
Dario Binacchi
aa8d5d89f7 package/erofs-utils: bump to version 1.8.10
For a change log since 1.8.5, see:
https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/tree/ChangeLog?h=v1.8.10

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 21:41:16 +02:00
Dario Binacchi
03d413ee88 package/evtest: bump version to 1.36
For release note, see:
https://gitlab.freedesktop.org/libevdev/evtest/-/releases/evtest-1.36

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 21:38:22 +02:00
Neal Frager
97ecafec89 boot/xilinx-prebuilt: simplify family logic
Currently, the xilinx-prebuilt package uses an if-then-else statement for
deciding which files need to be installed from the xilinx-prebuilt repo. This
works fine for now because there are really only two options, either versal or
zynqmp/kria.

Starting with the xilinx_v2025.2 release, the versal2 family along with the
vek385 board will be added to Buildroot and thus the xilinx-prebuilt package
as well. In the future, additional families will also probably be added to
this package.

To avoid creating a long if-then-else-then-else statement which will only grow
in complexity over time, simplify the logic of the xilinx-prebuilt package by
giving each xilinx family its own if statement. In the long term, this will
make the xilinx-prebuilt package easier to understand and maintain.

For this reason, this patch moves the zynqmp/kria families from the "else"
statement to having an if statement separate from the versal family.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 21:20:55 +02:00
Kunihiko Hayashi
5acd66ed0b package/qemu: add zstd support
Add optional zstd compression type support for QEMU.

In order to a file compressed with zstd on host to be applied to
target QEMU, zstd on both host and target should be enabled.

Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-29 21:38:04 +02:00
Alex McLain
4a51495d69 package/linux-firmware: add support for Intel 6E Ty architecture
Note:
The first file matching the pattern "iwlwifi-ty-a0-gf-a0*" was
introduced in commit [1], first included in version 20201022.

[1] 4f41e9d643

Signed-off-by: Alex McLain <alex@alexmclain.com>
[Julien: add the note in commit log when the first
  firmware was introduced
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-29 21:28:43 +02:00
Dario Binacchi
65c8f868e4 package/enet: bump to version 1.3.18
See:
https://github.com/lsalzman/enet/blob/v1.3.18/ChangeLog

Update file hash due to update license dates:
2662c0de09

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-29 21:12:52 +02:00
Dario Binacchi
4997495190 DEVELOPERS: add Dario Binacchi for empty
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-29 21:08:27 +02:00
Dario Binacchi
f9dc76a06d package/empty: bump to version 0.6.23d
Update hash of COPYRIGHT (update in year with
bb26b085df/)

Release notes:
https://sourceforge.net/p/empty/code/ci/master/tree/CHANGELOG

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-29 21:07:57 +02:00
Michael Fischer
89af3d53b0 package/sdl2: bump version to 2.32.10
Stable bugfix release:
https://github.com/libsdl-org/SDL/releases/tag/release-2.32.10

Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-29 20:57:07 +02:00
Neal Frager
4e7f03314d board/zynq: correct zed board links
The web link www.zedboard.org is no longer valid as it routes to a generic
avnet.com boards link. Fix this issue by providing direct links to the Avnet
ZedBoard and Tria MicroZed boards.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-29 20:47:28 +02:00
Neal Frager
74dcda2544 board/xilinx: migrate board web links to amd.com
As the xilinx.com website will soon be going away, migrate all xilinx board
web links from xilinx.com to amd.com.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 18:32:55 +02:00
Florian Larysch
f70b83914f package/linuxptp: update default config
Since upstream commit [1] ("Deprecate the slaveOnly option in favor
of clientOnly."), included in v4.0, ptp4l complains about the
"slaveOnly" option being deprecated on startup.

Update the default config to silence this warning.

[1] fe01cc7c96

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 18:10:00 +02:00
Peter Korsgaard
a4bca5d8ad package/rauc: drop uboot-tools select
Users may be building U-Boot outside Buildroot or Build U-Boot but not use
the rauc u-boot bootloader backend (E.G. as using the U-Boot environment is
tricky in secure boot setups) - So replace the selects by a note in the help
text.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 17:10:48 +02:00
Peter Korsgaard
f5e5db4b7e package/axfsutils: drop package
axfsutils is a host-only package, so drop it now that the axfs root
filesystem support has been dropped.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 16:07:35 +02:00
Peter Korsgaard
e7f9f94a50 fs/axfs: drop support
The file system support is not mainline and hasn't been updated since 2019,
so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 16:05:29 +02:00
Thomas Perale
d7a2937550 package/logsurfer: remove package
The logsurfer package has not received updates since 2011 according to
its website [1].

It also fails on the autobuilder when building with GCC14.

Package author did a single contribution to buildroot by adding this
package.

[1] https://crypt.gen.nz/logsurfer/

Fixes: https://autobuild.buildroot.org/results/ed9/ed906670ab7b901d95289b388262d9eded8b2c18
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 14:02:59 +02:00
Thomas Petazzoni
8e9e4feae1 configs/atmel_sama5d3xek: remove defconfig, broken
This defconfig no longer builds:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/11161167647

It is still based on the 4.9 kernel, which was LTS but is no longer
maintained.

There is no DEVELOPERS entry attached to this configuration as well,
and this defconfig has been broken for at least 2 months, probably
more (our Gitlab CI history is only kept for ~2 months). So let's drop
it, unles someone volunteers to resurrect it.

Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: Ludovic Desroches <ludovic.desroches@microchip.com>
Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
Cc: Patrice Vilchez <Patrice.Vilchez@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 13:50:41 +02:00
Thomas Petazzoni
0590ef1a81 configs/at91sam9260eknf: remove defconfig, broken
This defconfig no longer builds:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/11161167596

It is still based on the 4.8.6 kernel, which is not even an LTS
kernel, so we cannot easily update to fix the issues which are most
likely due to the newer gcc/binutils versions we're using now.

There is no DEVELOPERS entry attached to this configuration as well,
and this defconfig has been broken for at least 2 months, probably
more (our Gitlab CI history is only kept for ~2 months). So let's drop
it, unles someone volunteers to resurrect it.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 13:48:27 +02:00
Titouan Christophe
0ad6f18547 package/fbtft: remove package
The fbtft linux extension was only needed for very old kernels (<4.0)
that are no longer available in Buildroot.

Let's therefore remove it.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 13:26:40 +02:00
Julien Olivain
56e4b43301 package/tig: bump to version 2.6.0
For change log since 2.5.12, see:
https://github.com/jonas/tig/releases/tag/tig-2.6.0

Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 12:21:50 +02:00
Raphael Pavlidis
546148d5ac package/sway: bump to version 1.11
Changelog:
https://github.com/swaywm/sway/releases/tag/1.11
Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 12:17:24 +02:00
Raphael Pavlidis
151be15aa8 package/cage: bump to version v0.2.0-15-g2e593fe5a
wlroots 0.19.0 includes API breaking changes.

This commit bump the cage version to include the upstream commit [1]
which updates to this new wlroots API.

[1] 9ad44e4f52

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Julien: change _VERSION to use "git describe --abbrev=40" format]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 12:17:24 +02:00
Raphael Pavlidis
00fb3a57cb package/wlroots: add missing dependency to libgbm
If the render gles2 is enabled then libgbm is required (see [1]).
Therefore, add the dependency to wlroots.

[1]: https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.19/render/meson.build?ref_type=heads#L44

Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 12:17:24 +02:00
Raphael Pavlidis
0b5cb9cd26 package/wlroots: bump to version 0.19.0
Changelog:
https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/0.19.0
Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 12:17:24 +02:00
Adam Duskett
ae33520d99 package/foot: bump version to 1.22.3
- Requires libxkbcommon >= 1.8.0 as of commit 34d3f466
  - Drop upstream 0001-box-drawings-handle-architecture-with-soft-float.patch

Tested by building an image with sway and opening foot with win + return.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 00:12:09 +02:00
Adam Duskett
92ed32439c package/fcft: bump to version 3.3.1
For release notes since version 3.1.8, see:
https://codeberg.org/dnkl/fcft/tags

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 00:12:09 +02:00
Adam Duskett
8abbc307a5 package/libxkbcommon: bump to version 1.9.2
Changes:
  - No longer hosted at https://xkbcommon.org/download. The website points to
    the github repository. As such, change the URL accordingly.

  - The sha256sum is not provided in the mailing list archive, so the sha256sum
    is locally calculated.

  - The license file was reworded as of commit e120807b:
    """Update license notices to SDPX short identifiers + update LICENSE"""

See release notes, since version 1.7.0:
- 1.8.0: https://lists.freedesktop.org/archives/wayland-devel/2025-February/043969.html
- 1.8.1: https://lists.freedesktop.org/archives/wayland-devel/2025-March/044021.html
- 1.9.0: https://lists.freedesktop.org/archives/wayland-devel/2025-April/044160.html
- 1.9.1: https://lists.freedesktop.org/archives/wayland-devel/2025-May/044209.html
- 1.9.2: https://lists.freedesktop.org/archives/wayland-devel/2025-May/044211.html

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien: add links to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 00:12:09 +02:00
Adam Duskett
74b502a54e package/utf8proc: bump version to 2.10.0
Adds unicode 16 support

For release note, see:
https://github.com/JuliaStrings/utf8proc/releases/tag/v2.10.0

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 00:12:09 +02:00
Adam Duskett
696113c2b7 package/dmenu-wayland: remove package
The package has been abandoned for several years. The only package that
previously relied on dmenu-wayland was the swaybar option for the sway package,
and that option now relies on wmenu.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien:
  - add select BR2_LEGACY in legacy option to fix check-package error
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-28 00:12:09 +02:00
Adam Duskett
1c36534664 package/wmenu: new package
wmenu is an efficient dynamic menu for Sway and wlroots based Wayland
compositors. It provides a Wayland-native dmenu replacement which
maintains the look and feel of dmenu.

Furthermore, as of commit [1], sway uses wmenu instead of dmenu-wayland
with the following commit message:

"""
Switch default config to wmenu-run
This removes the last dependency bit on dmenu. No need for
"swaymsg exec" anymore: wmenu-run handles the xdg-activation
shenanigans.
"""

As such, change sway/Config.in to select wmenu instead of dmenu-wayland when
a user selects swaybar.

[1] b44015578a

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-27 22:46:14 +02:00
Scott Fan
dd84d05843 configs/qemu_x86_64_efi_defconfig: new defconfig
This defconfig enables EDK2 UEFI firmware and grub2 x86_64-efi boot
of a Linux Kernel in QEMU virt machine.

Signed-off-by: Scott Fan <fancp2007@gmail.com>
[Julien:
 - add .in suffix to genimage.cfg and grub.cfg template file names
 - change UUID_TMP template variable to %PARTUUID%
 - use human readable partition-type-uuid in genimage.cfg.in
 - break long qemu-system-x86_64 command line in readme.txt
 - add "-serial stdio" in readme.txt qemu command line for CI
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-27 14:52:10 +02:00
Yegor Yefremov
f5a99c4e91 package/libxmlrpc: bump to version 1.67.00
For change log, see:

https://xmlrpc-c.sourceforge.io/change.html

Since version 1.65, Libxml2 was made the default XML parser. Hence,
if libxml2 package is not selected, disable libxml2 support
explicitly.

Remove already upstreamed patch.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-27 13:28:55 +02:00
Serosh Deljam
46a9131263 package/cukinia: bump version to 0.9.0
For release note, see:
https://github.com/savoirfairelinux/cukinia/releases/tag/v0.9.0

Signed-off-by: Serosh Deljam <serosh.deljam@savoirfairelinux.com>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-27 13:22:00 +02:00
Scott Fan
092817421e package/timescaledb: bump version to 2.21.4
Release notes: https://github.com/timescale/timescaledb/blob/2.21.4/CHANGELOG.md

Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-27 13:16:45 +02:00
Giulio Benetti
beee315ae0 package/libblockdev: bump to version 3.4.0
Release notes:
https://github.com/storaged-project/libblockdev/blob/3.4.0/NEWS.rst

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: remove "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-27 13:03:32 +02:00
Dimitrios Siganos
5d497c0956 package/bvi: new package
A visual editor for binary files. Bvi allows the user to edit binary files
with a VI-like interface.

Signed-off-by: Dimitrios Siganos <dimitris@siganos.org>
[Julien:
 - sort DEVELOPERS entries
 - reword commit log title
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 21:57:14 +02:00
Thomas Perale
800dcabe65 package/libssh: security bump to v0.11.3
For more details on the version bump, see:
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=301d0e16dfa8a5cac1cff956b6880ca90eb82864

Fixes the following vulnerabilities:

- CVE-2025-8114

    A flaw was found in libssh, a library that implements the SSH
    protocol. When calculating the session ID during the key exchange
    (KEX) process, an allocation failure in cryptographic functions may
    lead to a NULL pointer dereference. This issue can cause the client
    or server to crash.

For more information, see:
 - https://nvd.nist.gov//vuln/detail/CVE-2025-8114
 - https://www.libssh.org/security/advisories/CVE-2025-8114.txt
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=65f363c9e3a22b90af7f74b5c439a133b1047379

- CVE-2025-8277

    A flaw was found in libssh's handling of key exchange (KEX)
    processes when a client repeatedly sends incorrect KEX guesses. The
    library fails to free memory during these rekey operations, which
    can gradually exhaust system memory. This issue can lead to crashes
    on the client side, particularly when using libgcrypt, which impacts
    application stability and availability.

For more infromation, see:
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=87db2659ec608a977a63eea529f17b9168388d73
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=266174a6d36687b65cf90174f06af90b8b27c65f
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=8e4d67aa9eda455bfad9ac610e54b7a548d0aa08
 - https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=1c763e29d138db87665e98983f468d2dd0f286c1

The v0.11.2 already had a fixed for CVE-2025-5318 but the NVD reference
mentionned wrongly the version 0.11.2.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 21:37:32 +02:00
Thomas Perale
9e67ae519f package/tiff: security bump to v4.7.1
For more details on the version bump, see:
  - https://gitlab.com/libtiff/libtiff/-/releases/v4.7.1

This bump includes the security fix for CVE-2025-8176, CVE-2025-8177
that were addressed in commit [1][2].

Also fixes the following vulnerabilities:

- CVE-2024-13978

    A vulnerability was found in LibTIFF up to 4.7.0. It has been
    declared as problematic. Affected by this vulnerability is the
    function t2p_read_tiff_init of the file tools/tiff2pdf.c of the
    component fax2ps. The manipulation leads to null pointer
    dereference. The attack needs to be approached locally. The
    complexity of an attack is rather high. The exploitation appears to
    be difficult. The patch is named
    2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply
    a patch to fix this issue.

For more information, see:
  - https://nvd.nist.gov//vuln/detail/CVE-2024-13978
  - 2ebfffb0e8

- CVE-2025-8961

    A weakness has been identified in LibTIFF 4.7.0. This affects the
    function main of the file tiffcrop.c of the component tiffcrop.
    Executing manipulation can lead to memory corruption. The attack can
    only be executed locally. The exploit has been made available to the
    public and could be exploited.

For more information, see:
  - https://nvd.nist.gov//vuln/detail/CVE-2025-8961
  - 0ac97aa7a5

- CVE-2025-9165

    A flaw has been found in LibTIFF 4.7.0. This affects the function
    _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the
    file tools/tiffcmp.c of the component tiffcmp. Executing
    manipulation can lead to memory leak. The attack is restricted to
    local execution. The exploit has been published and may be used.
    This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is
    best practice to apply a patch to resolve this issue.

For more information, see:
  - https://nvd.nist.gov//vuln/detail/CVE-2025-9165
  - ed141286a3

This commit also updates the LICENSE.md hash file, which was updated
upstream to include a historical license. See:
a0b623c780

[1] b3974df966 package/tiff: add patches to fix CVE-2025-8176
[2] 3db725d71d package/tiff: add patch to fix CVE-2025-8177

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix license hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 21:25:27 +02:00
Thomas Perale
740412aefc package/tiff: ignore CVE-2025-8851
The CVE-2025-8851 [1] has been fixed in upstream commit [2] that is part
of the v4.7.0 release.

Because the NVD reference includes the version '<2024-08-11' most of CVE
checker will fail to compare it against 4.7.0 and report it as a
positive.

[1] https://nvd.nist.gov//vuln/detail/CVE-2025-8851
[2] 8a7a48d7a6

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 21:16:30 +02:00
Neal Frager
93977c592d boot/xilinx-prebuilt: bump default version to xilinx_v2025.1_update1
Bump the xilinx-prebuilt default version to xilinx_v2025.1_update1, so that
all versal defconfigs use this new release tag.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:20:08 +02:00
Neal Frager
ef400f57ae configs/versal_vek280: bump xilinx-prebuilt to xilinx_v2025.1_update1
Bump the versal_vek280_defconfig to use version xilinx_v2025.1_update1 of the
xilinx-prebuilt boot pacakge.

As part of this update, the vek280 pdi file has been updated and the memory
map has been corrected to match the Linux intree dts memory node, so the
vek280 dts memory node patch is no longer required.

f755d022cd

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:20:08 +02:00