mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity
56,576 Commits 6 Branches 483 Tags
8f8267c78c6d237d77e47a38cc0fb68ba25da170
Commit Graph

56576 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Fabrice Fontaine
0146dd8ba0 package/enscript: add ENSCRIPT_CPE_ID_VENDOR 
cpe:2.3:a:gnu:enscript is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Aenscript

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2ad812a0b3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 21:51:06 +02:00
Fabrice Fontaine
646c83cf5a package/enlightenment: add ENLIGHTENMENT_CPE_ID_VENDOR 
cpe:2.3:a:enlightenment:enlightenment is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aenlightenment%3Aenlightenment

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e7b8832a5e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 21:51:06 +02:00
Fabrice Fontaine
be9602b604 package/terminology: add TERMINOLOGY_CPE_ID_VENDOR 
cpe:2.3:a:enlightenment:terminology is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aenlightenment%3Aterminology

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 05bffd0613)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 21:51:06 +02:00
Arnout Vandecappelle (Essensium/Mind)
ec602113a6 package/mesa3d-headers: remove spurious empty line 
Detected by check-package

Fixes: 7fa481437e

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit dfb045af5b)
 2021-05-19 18:10:09 +02:00
Fabrice Fontaine
1ce7c314c2 package/libidn: add LIBIDN_CPE_ID_VENDOR 
cpe:2.3:a:gnu:libidn is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Alibidn

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8391f7d189)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:40:06 +02:00
Fabrice Fontaine
bbb314eb55 package/libidn2: add LIBIDN2_CPE_ID_VENDOR 
cpe:2.3:a:gnu:libidn2 is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Alibidn2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 981850b353)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:40:01 +02:00
Fabrice Fontaine
e6f62aaa98 package/tinyproxy: add TINYPROXY_CPE_ID_VENDOR 
cpe:2.3:a:tinyproxy_project:tinyproxy is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atinyproxy_project%3Atinyproxy

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ba91be05c2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:39:27 +02:00
Fabrice Fontaine
23a2451933 package/tinyxml2: add TINYXML2_CPE_ID_VENDOR 
cpe:2.3:a:tinyxml2_project:tinyxml2 is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atinyxml2_project%3Atinyxml2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c00a99c292)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:39:19 +02:00
Fabrice Fontaine
0ed1c31c82 package/tini: add TINI_CPE_ID_VENDOR 
cpe:2.3:a:tini_project:tini is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atini_project%3Atini

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5b074ef1f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:39:13 +02:00
Fabrice Fontaine
54cb9e1fa6 package/tclap: add TCLAP_CPE_ID_VENDOR 
cpe:2.3:a:tclap_project:tclap is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atclap_project%3Atclap

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1ffd14f28a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:36:37 +02:00
Fabrice Fontaine
322c96467a package/thermald: add THERMALD_CPE_ID_VENDOR 
cpe:2.3:a:intel:thermald is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aintel%3Athermald

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4e48f5da05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:36:30 +02:00
Fabrice Fontaine
8d42350eb7 package/taglib: add TAGLIB_CPE_ID_VENDOR 
cpe:2.3:a:taglib:taglib is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ataglib%3Ataglib

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eecf0e55d3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:35:48 +02:00
Fabrice Fontaine
83225c36a0 package/qpdf: add QPDF_CPE_ID_VENDOR 
cpe:2.3:a:qpdf_project:qpdf is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aqpdf_project%3Aqpdf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2774a21025)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 17:35:43 +02:00
Fabrice Fontaine
e2008668d0 package/mesa3d{,-headers}: add CPE variables 
cpe:2.3:a:mesa3d:mesa is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amesa3d%3Amesa

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: add to mesa3d-headers too]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7fa481437e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 15:56:51 +02:00
Fabrice Fontaine
7d21104577 package/lvm2: add LVM2_CPE_ID_VENDOR 
cpe:2.3:a:redhat:lvm2 is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aredhat%3Alvm2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d70da0be78)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 15:56:46 +02:00
Fabrice Fontaine
783215a499 package/jquery-validation: security bump to version 1.19.3 
Fix CVE-2021-21252: The jQuery Validation Plugin provides drop-in
validation for your existing forms. It is published as an npm package
"jquery-validation". jquery-validation before version 1.19.3 contains
one or more regular expressions that are vulnerable to ReDoS (Regular
Expression Denial of Service).

Update hash of README.md due to changes not related to license

https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ae79f0f403)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 09:33:42 +02:00
Fabrice Fontaine
76cfcb6fe5 package/jquery-validation: add CPE variables 
cpe:2.3:a:jqueryvalidation:jquery_validation is a valid CPE identifier
for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ajqueryvalidation%3Ajquery_validation

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a5ff2a2828)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-19 09:33:32 +02:00
Peter Korsgaard
c25dd7eda5 {linux, linux-headers}: bump 5.{4, 10, 11, 12}.x series 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ab6dbf1c9f)
[Peter: drop 5.11.x/5.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:35:15 +02:00
Fabrice Fontaine
d8e9f7a663 package/dmalloc: fix static build 
Build of dmalloc is broken since commit
19ec872f16 because --enable-shlib is
unconditionally set

Fixes:
 - http://autobuild.buildroot.org/results/62c9c6aebca60649bd6f635125507bf10d63fc05

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 68b5b3fbf0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:33:02 +02:00
Fabrice Fontaine
07af28fa68 package/openssh: security bump to version 8.6p1 
Security
========

 * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
   option was enabled with a set of patterns that activated logging
   in code that runs in the low-privilege sandboxed sshd process, the
   log messages were constructed in such a way that printf(3) format
   strings could effectively be specified the low-privilege code.

   An attacker who had sucessfully exploited the low-privilege
   process could use this to escape OpenSSH's sandboxing and attack
   the high-privilege process. Exploitation of this weakness is
   highly unlikely in practice as the LogVerbose option is not
   enabled by default and is typically only used for debugging. No
   vulnerabilities in the low-privilege process are currently known
   to exist.

https://www.openssh.com/txt/release-8.6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 12916827e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:31:58 +02:00
Fabrice Fontaine
cf15bd789c package/refpolicy: fix REFPOLICY_CPE_ID_VENDOR 
cpe:2.3:a:selinuxproject:refpolicy is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aselinuxproject%3Arefpolicy

Indeed, cpe:2.3:a:tresys:refpolicy has been deprecated since April 21th:

  <cpe-item name="cpe:/a:tresys:refpolicy:2.20180701" deprecated="true" deprecation_date="2021-04-21T16:55:43.710Z">
    <title xml:lang="en-US">Tresys refpolicy 2.20180701</title>
      <reference href="https://github.com/TresysTechnology/refpolicy">Product</reference>
    <cpe-23:cpe23-item name="cpe:2.3:a:tresys:refpolicy:2.20180701:*:*:*:*:*:*:*">
        <cpe-23:deprecated-by name="cpe:2.3:a:selinuxproject:refpolicy:2.20180701:*:*:*:*:*:*:*" type="NAME_CORRECTION"/>

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bf1925cb97)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:28:38 +02:00
Fabrice Fontaine
d3e83e9aca package/python-autobahn: add CPE variables 
cpe:2.3:a:crossbar:autobahn is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Acrossbar%3Aautobahn

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 28b19ccb48)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:28:33 +02:00
Fabrice Fontaine
73fb529563 package/python-tqdm: add CPE variables 
cpe:2.3:a:tqdm_project:tqdm is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atqdm_project%3Atqdm

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ca6fab6ef9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:27:52 +02:00
Fabrice Fontaine
1c2113c95a package/python-requests: add CPE variables 
cpe:2.3:a:python:requests is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apython%3Arequests

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6c5cf37880)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:27:46 +02:00
Fabrice Fontaine
cd647bfb8d package/python-engineio: add PYTHON_ENGINEIO_CPE_ID_VENDOR 
cpe:2.3:a:python-engineio_project:python-engineio is a valid CPE
identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apython-engineio_project%3Apython-engineio

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 901689bfcc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:27:19 +02:00
Fabrice Fontaine
56b1f4b885 package/python-keyring: add CPE variables 
cpe:2.3:a:python:keyring is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apython%3Akeyring

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 14614d63f7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:27:12 +02:00
Fabrice Fontaine
a6f4494217 package/gstreamer1/gstreamer1: add CPE variables 
cpe:2.3:a:gstreamer_project:gstreamer is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agstreamer_project%3Agstreamer

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 38fb1ad2a0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:26:19 +02:00
Fabrice Fontaine
5fc94b549e package/gstreamer1/gst1-rtsp-server: add CPE variables 
cpe:2.3:a:gstreamer_project:gst-rtsp-server is a valid CPE identifier
for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agstreamer_project%3Agst-rtsp-server

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 75d795c493)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:25:54 +02:00
Fabrice Fontaine
15116e42cb package/gstreamer1/gst1-plugins-bad: add CPE variables 
cpe:2.3:a:freedesktop:gst-plugins-bad is a valid CPE identifier for
this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Afreedesktop%3Agst-plugins-bad

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 13c2242034)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:25:47 +02:00
Fabrice Fontaine
cdd3886dc0 package/udisks: add UDISKS_CPE_ID_VENDOR 
cpe:2.3:a:freedesktop:udisks is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Afreedesktop%3Audisks

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6381183d49)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:24:22 +02:00
Fabrice Fontaine
4446b0353b package/x11r7/libxcb: add LIBXCB_CPE_ID_VENDOR 
cpe:2.3:a:x:libxcb is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxcb

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4a321afa83)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:24:08 +02:00
Fabrice Fontaine
53d7efef54 package/x11r7/xlib_libdmx: add CPE variables 
cpe:2.3:a:x:libdmx is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibdmx

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a2f0a2147a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:23:25 +02:00
Fabrice Fontaine
75293e8d6e package/x11r7/xlib_libXxf86vm: add CPE variables 
cpe:2.3:a:x:libxxf86vm is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxxf86vm

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1ec75d777e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:23:19 +02:00
Fabrice Fontaine
87283a0b0d package/x11r7/xlib_libXxf86dga: add CPE variables 
cpe:2.3:a:x:libxxf86dga is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxxf86dga

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8017840f04)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:23:14 +02:00
Fabrice Fontaine
cefbc30569 package/x11r7/libXres: add CPE variables 
cpe:2.3:a:x:libxres is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxres

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ec86e30e66)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:22:47 +02:00
Fabrice Fontaine
88cfd19e23 package/x11r7/xlib_libXpm: add CPE variables 
cpe:2.3:a:libxpm_project:libxpm is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alibxpm_project%3Alibxpm

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit da67bf6418)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:22:42 +02:00
Fabrice Fontaine
51a053d2ed package/x11r7/xlib_libFS: add CPE variables 
cpe:2.3:a:x:libfs is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibfs

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9784dcb385)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:21:08 +02:00
Fabrice Fontaine
49e83f6e10 package/x11r7/xlib_libICE: add CPE variables 
cpe:2.3:a:freedesktop:libice is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Afreedesktop%3Alibice

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3b4980677b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:21:02 +02:00
Fabrice Fontaine
5e19718287 package/x11r7/xlib_libXt: add CPE variables 
cpe:2.3:a:x:libxt is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxt

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e0d0fec9a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:19:54 +02:00
Fabrice Fontaine
b9bd35609a package/x11r7/xlib_libXtst: add CPE variables 
cpe:2.3:a:x:libxtst is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxtst

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 74e049a0f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:19:44 +02:00
Fabrice Fontaine
33c5f42ea4 package/x11r7/xlib_libXcursor: add CPE variables 
cpe:2.3:a:x:libxcursor is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxcursor

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d3a25a98d4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:19:28 +02:00
Fabrice Fontaine
3fbde2c92e package/x11r7/xlib_libXdmcp: add CPE variables 
cpe:2.3:a:x.org:libxdmcp is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax.org%3Alibxdmcp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3558493454)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:19:21 +02:00
Fabrice Fontaine
d52d49b188 package/x11r7/xlib_libXext: add CPE variables 
cpe:2.3:a:x:libxext is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxext

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b1336915b6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:18:56 +02:00
Fabrice Fontaine
89d08aeba3 package/x11r7/xlib_libXfixes: add CPE variables 
cpe:2.3:a:x:libxfixes is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxfixes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 73ddf01dd8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:18:49 +02:00
Fabrice Fontaine
3b4c01ddd7 package/x11r7/xlib_libXinerama: add CPE variables 
cpe:2.3:a:x:libxinerama is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxinerama

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 713a76560b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:18:08 +02:00
Fabrice Fontaine
db7de62da9 package/x11r7/xlib_libXfont2: add CPE variables 
cpe:2.3:a:x:libxfont is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxfont

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 68436b2335)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:18:03 +02:00
Peter Seiderer
b74235234b package/localedef: fix host gcc-11.x compile 
Add two upstream patches fixing host gcc-11.x compile.

Fixes:

  - https://bugs.busybox.net/show_bug.cgi?id=13806

  In file included from ../include/pthread.h:1,
                   from ../sysdeps/nptl/thread_db.h:25,
                   from ../nptl/descr.h:32,
                   from ../sysdeps/x86_64/nptl/tls.h:130,
                   from ../sysdeps/generic/libc-tsd.h:44,
                   from ./localeinfo.h:224,
                   from programs/ld-ctype.c:37:
  ../sysdeps/nptl/pthread.h:734:47: error: argument 1 of type ‘struct __jmp_buf_tag *’ declared as a pointer [-Werror=array-parameter=]
    734 | extern int __sigsetjmp (struct __jmp_buf_tag *__env, int __savemask) __THROWNL;
        |                         ~~~~~~~~~~~~~~~~~~~~~~^~~~~
  In file included from ../include/setjmp.h:2,
                   from ../nptl/descr.h:24,
                   from ../sysdeps/x86_64/nptl/tls.h:130,
                   from ../sysdeps/generic/libc-tsd.h:44,
                   from ./localeinfo.h:224,
                   from programs/ld-ctype.c:37:
  ../setjmp/setjmp.h:54:46: note: previously declared as an array ‘struct __jmp_buf_tag[1]’
     54 | extern int __sigsetjmp (struct __jmp_buf_tag __env[1], int __savemask) __THROWNL;
        |                         ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4174f79a57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 23:16:45 +02:00
Fabrice Fontaine
2b1836d9ec package/libxslt: fix build with latest libxml2 
Build is broken since bump of libxml2 to version 2.9.11 in commit
a241dcec41 because libxslt calls the
following command "${XML_CONFIG} --libs print" which will return an
error code since
2a357ab99e

Fixes:
 - http://autobuild.buildroot.org/results/47ceb8c24c9ead8a450b7fea3266f760d6b77b4f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7320e5dd62)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 21:25:47 +02:00
Peter Korsgaard
aaeaac8595 package/prosody: security bump to version 0.11.9 
Fixes the following security issues:

- CVE-2021-32918: DoS via insufficient memory consumption controls

  It was discovered that default settings leave Prosody susceptible to
  remote unauthenticated denial-of-service (DoS) attacks via memory
  exhaustion when running under Lua 5.2 or Lua 5.3.  Lua 5.2 is the default
  and recommended Lua version for Prosody 0.11.x series.

- CVE-2021-32920: DoS via repeated TLS renegotiation causing excessive CPU
  consumption

  It was discovered that Prosody does not disable SSL/TLS renegotiation,
  even though this is not used in XMPP.  A malicious client may flood a
  connection with renegotiation requests to consume excessive CPU resources
  on the server.

- CVE-2021-32921: Use of timing-dependent string comparison with sensitive
  values

  It was discovered that Prosody does not use a constant-time algorithm for
  comparing certain secret strings when running under Lua 5.2 or later.
  This can potentially be used in a timing attack to reveal the contents of
  secret strings to an attacker.

- CVE-2021-32917: Use of mod_proxy65 is unrestricted in default
  configuration

  mod_proxy65 is a file transfer proxy provided with Prosody to facilitate
  the transfer of files and other data between XMPP clients.

  It was discovered that the proxy65 component of Prosody allows open access
  by default, even if neither of the users have an XMPP account on the local
  server, allowing unrestricted use of the server’s bandwidth.

- CVE-2021-32919: Undocumented dialback-without-dialback option insecure

  The undocumented option ‘dialback_without_dialback’ enabled an
  experimental feature for server-to-server authentication.  A flaw in this
  feature meant it did not correctly authenticate remote servers, allowing a
  remote server to impersonate another server when this option is enabled.

For more details, see the advisory:
https://prosody.im/security/advisory_20210512/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9c108afab8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 21:25:13 +02:00
Peter Korsgaard
e4ee7144ac test_docker_compose.py: Test the volume mount feature 
Extend docker_compose_test() to expose /bin on the host to the container
through a volume mount and verify that /bin/busybox can be downloaded and
contains the right data.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aa31d10808)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-17 21:24:11 +02:00