This CVE is specific for the version 5.1.5 still present in Buildroot.
It has been fixed in 5.2.3 and thereby doesn't affects the other
versions available in Buildroot.
- CVE-2014-5461
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through
5.2.x before 5.2.3 allows context-dependent attackers to cause a denial
of service (crash) via a small number of arguments to a function with a
large number of fixed arguments.
For more information see:
- https://security-tracker.debian.org/tracker/CVE-2014-5461
- https://udd.debian.org/patches.cgi?src=lua5.1&version=5.1.5-11
A patch present in Debian is used to address this vulnerability.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerability:
- CVE-2025-53644:
OpenCV is an Open Source Computer Vision Library. Versions prior to
4.12.0 have an uninitialized pointer variable on stack that may lead
to arbitrary heap buffer write when reading crafted JPEG images.
Version 4.12.0 fixes the vulnerability.
https://www.cve.org/CVERecord?id=CVE-2025-53644
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The CPE 'iputils_project:iputils' has been deprecated in favour of
'iputils:iputils'.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
We dropped support for python2 a while back in [1], as such we
can remove the python six module which was only needed for
backwards comaptibility with python2.
[1] 2743ce00ca
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add commit ref removing python2 support]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add host-pkgconf dependency which is needed for finding openssl.
Set OPENSSL_NO_VENDOR=1 in the environment to ensure we use the
system openssl library.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
License has changed due to license change from regular MIT to
MIT-no-attribution:
67a170dc79
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Drop python-anyio runtime dependency which is now an optional
dependency of asyncclick. See:
ca93155e16
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add commit reference for anyio dependency change]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Running the command:
make apitrace-patch
fails with error:
Applying 0003-Explicit-header-stdint.patch using patch:
patching file frametrim/ft_dependecyobject.hpp
Reversed (or previously applied) patch detected! Skipping patch.
1 out of 1 hunk ignored -- saving rejects to file frametrim/ft_dependecyobject.hpp.rej
patching file retrace/metric_writer.cpp
Reversed (or previously applied) patch detected! Skipping patch.
1 out of 1 hunk ignored -- saving rejects to file retrace/metric_writer.cpp.rej
Commit [1] "package/apitrace: fix build with GCC 15.x" introduced a
package patch in the branch master while Buildroot was in RC cycle.
This same commit was cherry-picked in [2] in the branch "next" to also
apply cleanly the patch for commit [3] "package/apitrace: bump to
version 13".
The merge commit [4] kept the apitrace package patch
"0003-Explicit-header-stdint.patch".
This commit fixes the issue by removing this stale patch.
[1] a4b0913280
[2] bf55f4713e
[3] aec2f2ddc4
[4] 0af159ae2b
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Running the command:
make cpp-httplib-patch
fails with error:
Applying 0001-merge-commit-from-fork.patch using patch:
patching file httplib.h
Reversed (or previously applied) patch detected! Skipping patch.
2 out of 2 hunks ignored -- saving rejects to file httplib.h.rej
patching file test/test.cc
Hunk #1 FAILED at 42.
Hunk #2 FAILED at 2839.
Hunk #3 FAILED at 3624.
3 out of 3 hunks FAILED -- saving rejects to file test/test.cc.rej
Commit [1] "package/cpp-httplib: add patch for CVE-2025-46728"
introduced a package patch in the branch next while Buildroot was in
RC cycle. Just after, commit [2] "package/cpp-httplib: bump to
v0.25.0", also in branch next, removed this package patch.
This commit [1] was cherry-picked in [3] in the branch master, to
apply only the security fix for the 2025.08 release.
The merge commit [4] kept the cpp-httplib package patch
"0001-merge-commit-from-fork.patch".
This commit fixes the issue by removing this stale patch.
Fixes:
https://autobuild.buildroot.org/results/5b9843089ade428997035e49817208ce9c09a10e
[1] aea7c89396
[2] 519d03657c
[3] fd313c4ceb
[4] 0af159ae2b
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
