For more information about the release, see:
- https://www.postgresql.org/docs/17/release-17-9.html
- https://www.postgresql.org/docs/17/release-17-10.html
Fixes the following vulnerabilities:
- CVE-2026-6479:
Prevent unbounded recursion while processing startup packets
A malicious client could crash the connected backend by alternating
rejected SSL and GSS encryption requests indefinitely.
- CVE-2026-6473
Fix assorted integer overflows in memory-allocation calculations
Various places were incautious about the possibility of integer overflow
in calculations of how much memory to allocate. Overflow would lead to
allocating a too-small buffer which the caller would then write past the
end of. This would at least trigger server crashes, and probably could
be exploited for arbitrary code execution. In many but by no means all
cases, the hazard exists only in 32-bit builds.
- CVE-2026-6476
Properly quote subscription names in pg_createsubscriber
The given subscription name was inserted into SQL commands without
quoting, so that SQL injection could be achieved in the (perhaps
unlikely) case that the subscription name comes from an untrusted
source.
- CVE-2026-6638
Properly quote object names in logical replication origin checks
ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolated schema and
relation names into SQL commands without quoting them, allowing
execution of arbitrary SQL on the publisher.
- CVE-2026-6473
Reject over-length options in ts_headline()
The StartSel, StopSel and FragmentDelimiter strings must not exceed 32Kb
in length, but this was not checked for. An over-length value would
typically crash the server.
- CVE-2026-6474
Guard against malicious time zone names in timeofday() and pg_strftime()
A crafted time zone setting could pass % sequences to snprintf(),
potentially causing crashes or disclosure of server memory. Another path
to similar results was to overflow the limited-size output buffer used
by pg_strftime().
- CVE-2026-6472
When creating a multirange type, ensure the user has CREATE privilege on
the schema specified for the multirange type.
The multirange type can be put into a different schema than its parent
range type, but we neglected to apply the required privilege check when
doing so.
- CVE-2026-6478
Use timing-safe string comparisons in authentication code.
Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking
passwords, hashes, etc. It is not known whether the data dependency of
those functions is usefully exploitable in any of these places, but in
the interests of safety, replace them.
- CVE-2026-6477
Mark PQfn() as unsafe, and avoid using it within libpq
For a non-integral result type, PQfn() is not passed the size of the
output buffer, so it cannot check that the data returned by the server
will fit. A malicious server could therefore overwrite client memory.
This is unfixable without an API change, so mark the function as
deprecated. Internally to libpq, use a variant version that can apply
the missing check.
- CVE-2026-6475
Prevent path traversal in pg_basebackup and pg_rewind
These applications failed to validate output file paths read from their
input, so that a malicious source could overwrite any file writable by
these applications. Constrain where data can be written by rejecting
paths that are absolute or contain parent-directory references.
- CVE-2026-6473
Guard against field overflow within contrib/intarray's query_int type
and contrib/ltree's ltxtquery type.
Parsing of these query structures did not check for overflow of 16-bit
fields, so that construction of an invalid query tree was possible.
This can crash the server when executing the query.
- CVE-2026-6473
Guard against overly long values of contrib/ltree's lquery type.
Values with more than 64K items caused internal overflows, potentially
resulting in stack smashes or wrong answers.
- CVE-2026-6637
Prevent SQL injection and buffer overruns in contrib/spi.
check_foreign_key() was insufficiently careful about quoting key
values, and also used fixed-length buffers for constructing queries.
While this module is only meant as example code, it still shouldn't
contain such dangerous errors.
(cherry picked from commit 9fb64dfc24)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
go1.25.10 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
compiler, the linker, the runtime, and the crypto/fips140, go/types, and os
packages.
https://go.dev/doc/devel/release#go1.25.10
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c19e6d80fb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
go1.26.3 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
go fix command, the compiler, the linker, the runtime, and the
crypto/fips140, crypto/tls, go/types, and os packages.
https://go.dev/doc/devel/release#go1.26.3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c465f0d8eb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
go1.26.2 (released 2026-04-07) includes security fixes to the go command, the
compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os
packages, as well as bug fixes to the go command, the go fix command, the
compiler, the linker, the runtime, and the net, net/http, and net/url packages.
CVE-2026-32289: html/template: JS template literal context incorrectly tracked
CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
CVE-2026-32280: crypto/x509: unexpected work during chain building
CVE-2026-32281: crypto/x509: inefficient policy validation
https://go.dev/doc/devel/release#go1.26.2https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
Signed-off-by: Christian Stewart <christian@aperture.us>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 82518f8cb4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.
To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.
Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.
The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.
Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.
Fixes the following security vulnerabilities:
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root
For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 43d1323196)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerabilities:
CVE-2025-61732: cmd/cgo: remove user-content from doc strings in cgo ASTs
A discrepancy between how Go and C/C++ comments were parsed allowed for code
smuggling into the resulting cgo binary.
To prevent this behavior, the cgo compiler will no longer parse
user-provided doc comments.
CVE-2025-68121: crypto/tls: unexpected session resumption when using
Config.GetConfigForClient
Config.GetConfigForClient is documented to use the original Config's session
ticket keys unless explicitly overridden. This can cause unexpected
behavior if the returned Config modifies authentication parameters, like
ClientCAs: a connection initially established with the parent (or a sibling)
Config can be resumed, bypassing the modified authentication requirements.
If ClientAuth is VerifyClientCertIfGiven or RequireAndVerifyClientCert (on
the server) or InsecureSkipVerify is false (on the client), crypto/tls now
checks that the root of the previously-verified chain is still in
ClientCAs/RootCAs when resuming a connection.
Go 1.26 Release Candidate 2, Go 1.25.6, and Go 1.24.12 had fixed a similar
issue related to session ticket keys being implicitly shared by
Config.Clone. Since this fix is broader, the Config.Clone behavior change
has been reverted.
Note that VerifyPeerCertificate still behaves as documented: it does not
apply to resumed connections. Applications that use
Config.GetConfigForClient or Config.Clone and do not wish to blindly resume
connections established with the original Config must use VerifyConnection
instead (or SetSessionTicketKeys or SessionTicketsDisabled).
For more details, see the announcement:
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f56dc6b122)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerabilities:
- CVE-2025-61728: archive/zip: denial of service when parsing arbitrary ZIP
archives
archive/zip used a super-linear file name indexing algorithm that is
invoked the first time a file in an archive is opened. This can lead to a
denial of service when consuming a maliciously constructed ZIP archive.
- CVE-2025-61726: net/http: memory exhaustion in Request.ParseForm
When parsing a URL-encoded form net/http may allocate an unexpected amount
of memory when provided a large number of key-value pairs. This can
result in a denial of service due to memory exhaustion.
- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated
session ticket keys, session resumption does not account for the
expiration of full certificate chain
The Config.Clone methods allows cloning a Config which has already been
passed to a TLS function, allowing it to be mutated and reused.
If Config.SessionTicketKey has not been set, and
Config.SetSessionTicketKeys has not been called, crypto/tls will generate
random session ticket keys and automatically rotate them. Config.Clone
would copy these automatically generated keys into the returned Config,
meaning that the two Configs would share session ticket keys, allowing
sessions created using one Config could be used to resume sessions with
the other Config. This can allow clients to resume sessions even though
the Config may be configured such that they should not be able to do so.
- CVE-2025-61731: cmd/go: unexpected code execution when invoking toolchain
The Go toolchain supports multiple VCS which are used retrieving modules
and embedding build information into binaries.
On systems with Mercurial installed (hg) downloading modules (e.g. via go
get or go mod download) from non-standard sources (e.g. custom domains)
can cause unexpected code execution due to how external VCS commands are
constructed.
On systems with Git installed, downloading and building modules with
malicious version strings could allow an attacker to write to arbitrary
files on the system the user has access to. This can only be triggered by
explicitly providing the malicious version strings to the toolchain, and
does not affect usage of @latest or bare module paths.
The toolchain now uses safer VCS options to prevent misinterpretation of
untrusted inputs. In addition, the toolchain now disallows module version
strings prefixed with a "-" or "/" character.
- CVE-2025-61730: crypto/tls: handshake messages may be processed at the
incorrect encryption level
During the TLS 1.3 handshake if multiple messages are sent in records that
span encryption level boundaries (for instance the Client Hello and
Encrypted Extensions messages), the subsequent messages may be processed
before the encryption level changes. This can cause some minor
information disclosure if a network-local attacker can inject messages
during the handshake.
For details, see the announcement:
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22137df16b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
For relase notes, see:
https://go.dev/doc/devel/release#go1.25.0
Building Go 1.24 and later requires Go 1.22.6 or later for bootstrap.
To support this we use our previous Go version 1.23.12 as the version
for go-bootstrap-stage4 and have the build for Go 1.25.1 depend on
go-bootstrap-stage4.
Go version 1.23.12 is the latest go version we can build using
go-bootstrap-stage3.
The package build for go-bootstrap-stage4 if effectively identical to
go-bootstrap-stage3 with only the Go version and stage number changed.
Note: go version 1.25.1 release note mention a security fix
which is for CVE-2025-47910. This commit is not marked as security
bump, because the issue was introduced in version 1.25.0 which
was not included in Buildroot. See:
https://pkg.go.dev/vuln/GO-2025-3955
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Tested-by: Christian Stewart <christian@aperture.us>
[Julien: add link to release notes and
comment about CVE in commit log.
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ecf12c186f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2025-6020:
A flaw was found in linux-pam. The module pam_namespace may use access
user-controlled paths without proper protection, allowing local users
to elevate their privileges to root via multiple symlink attacks and
race conditions.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-6020
This fix was backported based on the work of the OpenEmbedded
community. See the link to the original patches in the patch header.
(cherry picked from 30e38505e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes: https://www.php.net/ChangeLog-8.php#8.3.31
- CVE-2025-14179:
In PHP versions, the PDO Firebird driver improperly handles NUL
bytes when preparing SQL queries. During token-by-token query
construction, a string token containing a NUL byte is copied via
strncat(), which stops at the NUL byte, dropping the closing quote
and causing subsequent SQL tokens to be interpreted as part of the
string.
This allows SQL injection when attacker-controlled values are quoted
via PDO::quote() and embedded in SQL statements.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
- https://www.cve.org/CVERecord?id=CVE-2025-14179
- CVE-2026-6722:
In PHP versions, the SOAP extension's object deduplication mechanism
stores pointers to PHP objects in a global map without incrementing
their reference counts. When an apache:Map node contains duplicate
keys, processing the second entry overwrites the first in the
temporary result map, freeing the original PHP object while its
stale pointer remains in the map. A subsequent href reference to the
freed node can copy the dangling pointer into the result. As PHP
string allocations can reclaim the freed memory region, an attacker
with control over the SOAP request body can exploit this
use-after-free to achieve remote code execution.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
- https://www.cve.org/CVERecord?id=CVE-2026-6722
- CVE-2026-6735:
In PHP, due to improper sanitation of user data, it allows an
attacker to compose an URL, which will cause the target to execute
arbitrary JavaScript code (XSS) on the target's machine when the
target is viewing the PHP-FPM status page.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv
- https://www.cve.org/CVERecord?id=CVE-2026-6735
- CVE-2026-7258:
In PHP, some functions, including urldecode(), pass signed char to
ctype functions (like isxdigit()). On the systems with default
signed char and optimized table-lookup ctype functions - such as
NetBSD - this can lead to accessing array with negative offset,
which can trigger a denial of service.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4
- https://www.cve.org/CVERecord?id=CVE-2026-7258
- CVE-2026-7259:
In PHP, a mismatch between encoding lists in Oniguruma and mbfl
leads to a NULL pointer dereference, resulting in a segmentation
fault and denial of service. The vulnerability is exploitable when
user-controlled input can influence the encoding passed
to mb_regex_encoding().
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75
- https://www.cve.org/CVERecord?id=CVE-2026-7259
- CVE-2026-7261:
In PHP, when SoapServer is configured with SOAP_PERSISTENCE_SESSION,
the handler object is persisted across requests via session storage.
However, in the case SOAP requests results in an error, the
persistance is handled incorrectly, resulting in freeing the object
while keeping a pointer to it, which may lead to use-after-free.
This may lead to memory corruption, information disclosure, or
process crashes, with confidentiality, integrity, and availability
impact on the vulnerable system.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q
- https://www.cve.org/CVERecord?id=CVE-2026-7261
- CVE-2026-7262:
In PHP, when a SOAP server has a typemap configured, the decoding
process contains a mistake which checks the wrong variable in case
of missing value element. This leads to dereferences a NULL
pointer, causing a segmentation fault. This allows a remote
unauthenticated attacker to crash the PHP SOAP server process,
resulting in denial of service.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv
- https://www.cve.org/CVERecord?id=CVE-2026-7262
- CVE-2026-7568:
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before
8.4.21, and 8.5.* before 8.5.6, the metaphone() function in
ext/standard/metaphone.c uses a signed int variable to track the
current position within the input string. If a string longer than
2,147,483,647 bytes is passed, a signed integer overflow occurs,
resulting in undefined behavior. This can lead to an out-of-bounds
read, causing a segmentation fault or access to unrelated memory, and
may affect the availability of the PHP process.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57
- https://www.cve.org/CVERecord?id=CVE-2026-7568
(cherry picked from 952aa90078)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- Update email address to v@baodeep.com.
- Take over maintainership of package/amlogic-boot-fip.
Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9d4d79f9ae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-48850:
PuTTY 0.72 before 0.84 has a double free in RSA KEX.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-48850
- CVE-2026-48851:
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust
indication for TELNET data but the trust status is not cleared between
proxy authentication and the main session.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-48851
- CVE-2026-48852:
PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature
verification.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-48852
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_WESTON_XWAYLAND currently depends on BR2_PACKAGE_LIBEPOXY,
which implicitly requires either libGL or libEGL. However, the XWayland
glamor support uses libepoxy with EGL, so express that dependency
directly. With only libGL and no libEGL, it fails to build. E.g.,
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_ETNAVIV=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XWAYLAND=y
BR2_PACKAGE_LIBEPOXY=y
fails with:
In file included from ../glamor/glamor_priv.h:73,
from ../glamor/glamor_composite_glyphs.c:25:
../glamor/glamor_context.h:27:10: fatal error: epoxy/egl.h: No such file or directory
27 | #include <epoxy/egl.h>
| ^~~~~~~~~~~~~
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 701f8bb31c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes build error with gcc 9.x:
output/build/libheif-1.21.1/libheif/nclx.h:128:50: error:
'bool nclx_profile::operator==(const nclx_profile&)
const' cannot be defaulted
using this defconfig:
BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
# BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_STATIC_LIBS=y
BR2_PACKAGE_LIBHEIF=y
According to https://github.com/strukturag/libheif/issues/1615#issuecomment-3457979167
gcc >= 10 with support for C++20 is needed for the package.
The failing code was introduced upstream in version 0.21.0 with commit
a62f933e38
which was added to buildroot with commit
a8aed698c7.
Also removed -std=c++11 from CXXFLAGS.
The build error was not yet recorded by the autobuilders.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7323bcc1d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Current build generated pkgconfig/libargon2.pc has wrong version string.
Version: ZERO
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 1ef471a61d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
NSS Makefile build system is pretty weak if used with parallel build. In
this case what happens is that 'ifndef FREEBL_NO_DEPEND' appears in
lib/freebl/manifest.mn and coreconf/Linux.mk. When parallel building
variable FREEBL_NO_DEPEND gets defined if not defined to 1, but in the
2 occurences we end up having on variable set to 1 and 1 still not
defined. This results in:
`
/home/giuliobenetti/br-reproduce/3e046c996825447f48377f7c4361b5db26b84f95/output/host/lib/gcc/arm-buildroot-linux-musleabi/14.3.0/../../../../arm-buildroot-linux-musleabi/bin/ld: Linux2.6_arm_arm-buildroot-linux-musleabi-gcc.br_real_glibc_PTH_DBG.OBJ/Linux_SINGLE_SHLIB/lowhash_vector.o: in function `loader_GetOriginalPathname':
lowhash_vector.c:(.text.loader_GetOriginalPathname+0x68): undefined reference to `PR_SetError'
collect2: error: ld returned 1 exit status
`
So let's pass FREEBL_NO_DEPEND=1 when building to define that variable
instead to let NSS Makefile to calculate it.
Fixes:
https://autobuild.buildroot.net/results/ad4/ad40536728303c56d1d0968e38ac36da12cca416//
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 6d3cc38ec0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
There is no CVE assigned with the vendor name "cesenta".
The CPE ID introduced in [1], correctly reference "cesanta" as a CPE
vendor but introduced a typo while writing the vendor metadata in
`mongoose.mk`.
[1] 3d632c941f package/mongoose: add MONGOOSE_CPE_ID_VENDOR
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit de4044a0c9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-32853:
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e)
contain a heap out-of-bounds read vulnerability in the UltraZip
encoding handler that allows a malicious VNC server to cause
information disclosure or application crash. Attackers can exploit
improper bounds checking in the HandleUltraZipBPP() function by
manipulating subrectangle header counts to read beyond the allocated
heap buffer.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32853
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
- 009008e2f4
- CVE-2026-32854:
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee)
contain null pointer dereference vulnerabilities in the HTTP proxy
handlers within httpProcessInput() in httpd.c that allow remote
attackers to cause a denial of service by sending specially crafted
HTTP requests. Attackers can exploit missing validation of strchr()
return values in the CONNECT and GET proxy handling paths to trigger
null pointer dereferences and crash the server when httpd and proxy
features are enabled.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32854
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
- dc78dee51a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 258128aefe)
[thomas: backport patch to 2025.02]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
