mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity
56,623 Commits 6 Branches 483 Tags
8fd35db31bdedf7956c74a8ef2676cf344d5e3fd
Commit Graph

56623 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Fabrice Fontaine
8fd35db31b package/findutils: add FINDUTILS_CPE_ID_VENDOR 
cpe:2.3:a:gnu:findutils is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Afindutils

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5c81ffaffc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:26:06 +02:00
Fabrice Fontaine
c3cd45d320 package/python-pillow: security bump to version 8.2.0 
- Fix numerous CVEs:
  https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#security
  https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html#security
  https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html#security
  https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security
- Update license to HPND:
  81078e8a0d

https://pillow.readthedocs.io/en/stable/releasenotes/index.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e4625ae8d5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:25:14 +02:00
Fabrice Fontaine
e1f5ffc326 package/python-pillow: add webpmux support 
webpmux is an optional dependency since version 2.2.0 and
b4735f7829

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: move into existing webp conditional block]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a1f3e99f0e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:25:02 +02:00
Fabrice Fontaine
70f869e49f package/python-pillow: add xcb support 
libxcb is an optional dependency since version 7.1.0 and
3c39e6fcf6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e1e0e275c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:24:54 +02:00
Fabrice Fontaine
0787c26661 package/python-pillow: add lcms2 support 
lcms2 is an optional dependency since version 2.3.0 and
6d9f349140

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9e21579c13)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:24:49 +02:00
Fabrice Fontaine
10405de456 package/expat: security bump to version 2.4.1 
Fix CVE-2013-0340 "Billion Laughs":
https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/

https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 990d0c1cd2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:23:25 +02:00
Fabrice Fontaine
0c9fd33934 package/expat: bump to version 2.3.0 
https://github.com/libexpat/libexpat/blob/R_2_3_0/expat/Changes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f2720836b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:23:21 +02:00
Fabrice Fontaine
6431ed682e package/qemu: fix build with latest binutils 
Fixes:
 - http://autobuild.buildroot.org/results/c0881df995093036eb7579d870efcae3feb323aa

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1eb1a24e9f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 10:21:13 +02:00
Fabrice Fontaine
2c659b358a package/libnids: drop LIBNIDS_IGNORE_CVES 
NVD database has been updated:
https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&seach_type=all&query=cpe:2.3:a:libnids_project:libnids:1.24:*:*:*:*:*:*:*

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 65c9ebcd90)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:13:12 +02:00
Fabrice Fontaine
971cd9e294 package/mini-snmpd: add CPE variables 
cpe:2.3:a:minisnmpd_project:minisnmpd is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aminisnmpd_project%3Aminisnmpd

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5dfb873acf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:12:32 +02:00
Fabrice Fontaine
db4b42eedd package/minissdpd: add MINISSDPD_CPE_ID_VENDOR 
cpe:2.3:a:miniupnp_project:minissdpd is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aminiupnp_project%3Aminissdpd

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 84c07e1f51)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:12:26 +02:00
Fabrice Fontaine
392064c10e package/minidlna: add CPE variables 
cpe:2.3:a:readymedia_project:readymedia is a valid CPE identifier for
this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Areadymedia_project%3Areadymedia

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit cb140cd040)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:12:19 +02:00
Fabrice Fontaine
700f216173 package/minizip: add MINIZIP_CPE_ID_VENDOR 
cpe:2.3:a:minizip_project:minizip is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aminizip_project%3Aminizip

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: fix typo MINZIP -> MINIZIP]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 425339dcdf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:11:47 +02:00
Fabrice Fontaine
d8805810c3 package/netsurf: add NETSURF_CPE_ID_VENDOR 
cpe:2.3:a:netsurf-browser:netsurf is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Anetsurf-browser%3Anetsurf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 22c5e1f847)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:11:41 +02:00
Fabrice Fontaine
9a69e303c9 package/opencv3: add CPE variables 
cpe:2.3:a:opencv:opencv is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aopencv%3Aopencv

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4919a9c17f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:11:07 +02:00
Fabrice Fontaine
cf11ac8f30 package/oprofile: add OPROFILE_CPE_ID_VENDOR 
cpe:2.3:a:maynard_johnson:oprofile is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amaynard_johnson%3Aoprofile

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bd5dabce4c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:11:01 +02:00
Fabrice Fontaine
ce067a4710 package/libnids: add LIBNIDS_CPE_ID_VENDOR 
cpe:2.3:a:libnids_project:libnids is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alibnids_project%3Alibnids

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3ab5ec3fbc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 09:08:23 +02:00
Bernd Kuhls
bc116b690b package/hwloc: add optional dependencies to udev, libxml2, ncurses & numactl 
udev:
https://github.com/open-mpi/hwloc/blob/master/config/hwloc.m4#L626

libxml2:
https://github.com/open-mpi/hwloc/blob/master/config/hwloc.m4#L1273

ncurses:
https://github.com/open-mpi/hwloc/blob/master/config/hwloc_internal.m4#L340

numactl:
https://github.com/open-mpi/hwloc/blob/master/config/hwloc_internal.m4#L419

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[yann.morin.1998@free.fr: drop unconditional --disable-libxml2]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 648ff342db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 08:39:41 +02:00
Fabrice Fontaine
37de514b65 package/p7zip: add P7ZIP_CPE_ID_VENDOR 
cpe:2.3:a:7-zip:p7zip is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3A7-zip%3Ap7zip

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 77d1a1be54)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 08:11:07 +02:00
Fabrice Fontaine
1650cce463 package/libical: add LIBICAL_CPE_ID_VENDOR 
cpe:2.3:a:libical_project:libical is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alibical_project%3Alibical

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c95d3d8ab8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 08:10:59 +02:00
Fabrice Fontaine
243fffb181 package/shellinabox: add SHELLINABOX_CPE_ID_VENDOR 
cpe:2.3:a:shellinabox_project:shellinabox is a valid CPE identifier for
this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ashellinabox_project%3Ashellinabox

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 81009e31d9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 08:10:47 +02:00
Fabrice Fontaine
dbd9d87261 package/blktrace: add BLKTRACE_CPE_ID_VENDOR 
cpe:2.3:a:blktrace_project:blktrace is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ablktrace_project%3Ablktrace

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b3c332853e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-08 08:10:41 +02:00
Peter Korsgaard
a9c45a66a2 package/lz4: add upstream security fix for CVE-2021-3520 
Fixes a potential memory corruption with negative memmove() size.  For
details, see (NVD not yet updated):

https://security-tracker.debian.org/tracker/CVE-2021-3520

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ecb55c43ce)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:43:09 +02:00
Fabrice Fontaine
b14c5918d4 package/imagemagick: security bump to version 7.0.11-13 
Fix CVE-2021-20309 to CVE-2021-20313

https://github.com/ImageMagick/ImageMagick/blob/7.0.11-13/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d642381049)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:42:21 +02:00
Fabrice Fontaine
32f4885cc3 package/vlc: fix build with latest live555 
Fix build failure with live555 raised since commit
6ad1c7f12e

Fixes:
 - http://autobuild.buildroot.org/results/83170984f96238756c45bf1f4e542363afafd45f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eb6017fabe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:40:39 +02:00
Fabrice Fontaine
ddeadc09a8 package/msmtp: add MSMTP_CPE_ID_VENDOR 
cpe:2.3:a:marlam:msmtp is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amarlam%3Amsmtp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bf85592a46)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:40:34 +02:00
Fabrice Fontaine
4ef158c3db package/mpv: add MPV_CPE_ID_VENDOR 
cpe:2.3:a:mpv:mpv is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ampv%3Ampv

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b5eaff4df3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:40:24 +02:00
Fabrice Fontaine
089246ef52 package/pwgen: add PWGEN_CPE_ID_VENDOR 
cpe:2.3:a:pwgen_project:pwgen is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apwgen_project%3Apwgen

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eb72fa0d3c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:39:14 +02:00
Fabrice Fontaine
64b824184d package/pulseaudio: add PULSEAUDIO_CPE_ID_VENDOR 
cpe:2.3:a:pulseaudio:pulseaudio is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apulseaudio%3Apulseaudio

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 27c764153a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:39:05 +02:00
Fabrice Fontaine
e0cb9d01eb package/proxychains-ng: add PROXYCHAINS_NG_CPE_ID_VENDOR 
cpe:2.3:a:proxychains-ng_project:proxychains-ng is a valid CPE
identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aproxychains-ng_project%3Aproxychains-ng

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 53d0ca9dfb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:38:58 +02:00
Fabrice Fontaine
6118713a20 package/pigz: add PIGZ_CPE_ID_VENDOR 
cpe:2.3:a:zlib:pigz is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Azlib%3Apigz

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1ee888c248)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:37:38 +02:00
Fabrice Fontaine
bf45624821 package/picocom: add PICOCOM_CPE_ID_VENDOR 
cpe:2.3:a:picocom_project:picocom is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apicocom_project%3Apicocom

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 214d4e9c22)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:37:33 +02:00
Fabrice Fontaine
31477c0181 package/pngquant: add PNGQUANT_CPE_ID_VENDOR 
cpe:2.3:a:pngquant:pngquant is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apngquant%3Apngquant

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f5732350be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:37:27 +02:00
Fabrice Fontaine
947ee29bb0 package/uhd: USRP1 needs gcc >= 4.9 
Commit c577eac16e forgot to add
dependencies of BR2_PACKAGE_UHD_USB to BR2_PACKAGE_UHD_USRP1

Fixes:
 - http://autobuild.buildroot.org/results/eaae6548fb536e2b0ea539c236cd7579e63fa21e

Note: threads dependency is already guaranteed as uhd itself depends on
NPTL already.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0403dd7d76)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:36:43 +02:00
Fabrice Fontaine
daf1a5d80a package/llvm: include limits 
Fix the following build failure:

In file included from /data/buildroot-autobuilder/instance-0/output-1/build/host-llvm-9.0.1/utils/benchmark/src/benchmark_register.cc:15:
/data/buildroot-autobuilder/instance-0/output-1/build/host-llvm-9.0.1/utils/benchmark/src/benchmark_register.h: In function 'void AddRange(std::vector<T>*, T, T, int)':
/data/buildroot-autobuilder/instance-0/output-1/build/host-llvm-9.0.1/utils/benchmark/src/benchmark_register.h:17:30: error: 'numeric_limits' is not a member of 'std'
   17 |   static const T kmax = std::numeric_limits<T>::max();
      |                              ^~~~~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/68581aad7c622a1fc74bb5556799e3c681425b2a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8d8f456d59)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:35:29 +02:00
Christian Stewart
10c2e6c588 package/runc: security bump to version 1.0.0-rc95 
Fixes CVE-2021-30465: runc 1.0.0-rc94 and earlier are vulnerable to a symlink
exchange attack whereby an attacker can request a seemingly-innocuous container
configuration that actually results in the host filesystem being bind-mounted
into the container, allowing for a container escape.

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 96c23d1d0f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:34:57 +02:00
Peter Korsgaard
51e7ddcf3b package/mutt: add upstream security fix for CVE-2021-32055 
Fixes the following security issue:

- CVE-2021-32055: Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt
  2019-10-25 through 2021-05-04) has a $imap_qresync issue in which
  imap/util.c has an out-of-bounds read in situations where an IMAP sequence
  set ends with a comma.  NOTE: the $imap_qresync setting for QRESYNC is not
  enabled by default.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:32:25 +02:00
Fabrice Fontaine
98345c9bcf package/wireshark: security bump to version 3.4.5 
Fixes: CVE-2021-22207 Excessive memory consumption in MS-WSP dissector
in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service
via packet injection or crafted capture file

See also: https://www.wireshark.org/security/wnpa-sec-2021-04.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: add CVE reference]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 92de0d76ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:22:12 +02:00
Adrian Perez de Castro
8a9c4dc3d4 package/wpewebkit: select gstreamer autoaudiosink 
Select BR2_PACKAGE_GST1_PLUGINS_GOOD_PLUGIN_AUTODETECT when multimedia
support is enabled. This is needed at runtime to automatically select
a suitable audio output element, otherwise WebKit will crash at an
assertion due to the missing "autoaudiosink" element. More here:

  https://wpewebkit.org/about/faq.html#why-does-the-browser%2Flauncher-(e.g.-cog)-crash-when-trying-to-play-audio%3F

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 51484b29ca)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:21:09 +02:00
Yann E. MORIN
3cdbe916c8 package/lvm2: drop legacy default 
Commit f289b1b36f (legacy: drop options removed more than 5 years ago
now) forgot to remove a legacy default.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5c07dfcc1a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:20:05 +02:00
Heiko Thiery
9aa474f25b package/waylandpp: add dependency to BR2_INSTALL_LIBSTDCPP 
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
[yann.morin.1998@free.fr: propagate the dependency to kodi]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ac16bb646f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:18:55 +02:00
Fabrice Fontaine
d6aa6df736 package/python-bluezero: select dbus 
Build is broken since commit
8bdc5e7c4d because BR2_PACKAGE_DBUS_PYTHON
is selected without selecting BR2_PACKAGE_DBUS

Fixes:
 - http://autobuild.buildroot.org/results/378dd714940440b8f9db763479ae929e90e33b80

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4f79b1cb93)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:18:18 +02:00
Arnout Vandecappelle (Essensium/Mind)
80611b9900 package/python-bluezero: add recursive dependencies 
python-bluezero selects python-gobject but fails to include its arch and
toolchain dependencies. Add them now, as well as the corresponding
comment.

dbus-python also has some dependencies, but all of them are covered by
the python3 dependency, so don't bother with those.

Fixes: 8bdc5e7c4d

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e2bcf6605a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:15:51 +02:00
Grzegorz Blach
1233f34e76 package/python-bluezero: depends on dbus-python and python-gobject 
As of version 0.4.0 observer.py uses dbus-python (to comunicate with BlueZ)
instead of python-aioblescan. Thus, all modules now depend on dbus-python.

Signed-off-by: Grzegorz Blach <grzegorz@blach.pl>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 8bdc5e7c4d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:15:24 +02:00
Thomas De Schampheleire
6dfe6d01b9 package/ebtables: fix runtime in case of BR2_KERNEL_64_USERLAND_32 
ebtables 2.0.11 no longer works correctly when userland is 32-bit and the
kernel is 64-bit. This used to work correctly in version 2.0.10-4.

Problem is twofold:
- ebtables itself was broken and needs to be patched
- buildroot needs to pass the correct flag again to indicate when we are in
  this situation

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4b5743e523)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-06-07 23:14:03 +02:00
Fabrice Fontaine
677b20cf24 package/assimp: depends on libzlib 
assimp doesn't build with zlib-ng because Z_EXPORT and z_crc_t are used
by the bundled unzip source code

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 8f11388f4e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-23 20:44:51 +02:00
Fabrice Fontaine
00420c00cb package/assimp: fix build on musl 
Fixes:
 - http://autobuild.buildroot.net/results/7c2db184ee200d1719308f38f42382bb39d8d5c6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 68c8f889f8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-23 20:44:40 +02:00
Fabrice Fontaine
8f8267c78c Revert "package/assimp: fix static only build" 
This reverts commit b44b5cb265.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ebe83db655)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-23 20:44:30 +02:00
Fabrice Fontaine
97a7ca7d83 Revert "package/assimp: fix musl zlib/zip related compile failure" 
This reverts commit b529a582ba as it
raises a build failure with hiawatha because assimp installs its own
zlib library in staging directory.

Fixes:
 - http://autobuild.buildroot.org/results/9cac31962d48245a5579da692dbc9488292a397e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 59cbf37585)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-23 20:44:22 +02:00
Sergey Matyukevich
a8d1e0532b package/dhcp: add host-gawk to global dependencies and build environment 
DHCP package may silently fail to install binaries to the target image.
The problem occurs when buildroot output/host and build server provide
different flavors of awk. For instance, mawk on build server and gawk
in buildroot output/host. In this case isc-dhcp configure script detects
gawk in output/host and generates Makefiles specifying gawk without
absolute path. During Buildroot installation phase, those Makefiles
are used to install dhcp binaries. They attempt to use gawk without
absolute path. However build host does not have gawk.

To resolve the issue add host-gawk to dependencies and specify absolute
path to host-gawk in dhcp configure script using DHCP_CONF_ENV.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9ec60e877e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-05-23 20:36:00 +02:00