Bugfix release fixing crash / NULL pointer access issues and gsasl
authentication compatibility with Microsoft servers.
Mutt 2.2.14 was released on February 20, 2025. This is a bug-fix release,
fixing a couple possible crashes, in GPGME and with IMAP when logging out,
and correcting a small issue with unnecessary encoding of "." in attachment
names (2231 encoding).
Mutt 2.2.15 was released on October 2, 2025. This is a bug-fix release,
fixing an IMAP search/limit bug, a compilation issue, and containing a
workaround for gsasl SMTP authentication issues with some MS servers. A few
parts of the documentation were also improved.
Mutt 2.2.16 was released on November 22, 2025. This is a bug-fix release,
fixing a resource leak when compiled with OpenSSL/LibreSSL, which could
eventually result in new connections failing.
http://www.mutt.org/news.html
The 2.2.16 release is not available on bitbucket, so change to the official
ftp.mutt.org location instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 206cd3cd31)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Bugfix release with large number of (security) fixes.
For 6.2.26:
- a severe issue was found in the compression library (slz) where
specially crafted patterns with tune.bufsize above 17408 or
tune.maxrewrite below 964 (both non-default) could cause output
buffer overflows due to the overhead exceeding the promised
worst-case growth bound of 5 bytes and reach up to 1/16 of the
input contents. Given that the compression output is hardly
controllable, and the canaries at the end of the pools will catch
this at release time, the risk of exploitation by a hostile server
is close to zero, however it will cause repeated crashes if such a
crafted file is present on a server and regularly downloaded. A
workaround consists in keeping tune.maxrewrite at least 1/16 of
tune.bufsize or just not changing them since the defaults are safe.
A CVE was requested two weeks ago for this one, I'll mention it when
it arrives.
- HTTP/2 incomplete transfer detection was missing for HEADERS frames
carrying END_STREAM. When relayed to an HTTP/1.1 server that
responds before the end of the transfer, this can result in bytes
of the next request over the same connection to be ignored. Most of
the time it will cause the connection to be dropped due to an
unparsable request, but when combined with "http-reuse never", or
on totally idle servers, the client could expect the second request
to reuse the same connection and perform a content smuggling attack
that would allow to pass an unverified request to a server. For
those who can't upgrade, a temporary workaround is to disable
HTTP/2 by specifying "alpn http/1.1" on bind lines and adding
"disable-h2-upgrade" in HTTP frontends. A CVE will be requested for
this one.
- HTTP/1.1 bodyless messages announcing a non-null Content-Length did
not force close mode on the backend, potentially causing
desynchronisation between HAProxy and the server in conjunction
with other bugs.
- FCGI record length truncation with large bufsize (>=65544) could
enable request smuggling into PHP-FPM since the 16-bit
content_length field silently truncated to 65535 bytes.
- an unvalidated SNI name_len field in ClientHello could cause OOB
heap reads of up to 65KB via XXH3, smp_dup(), and log-format leaks
on any TCP frontend using req.ssl_sni, possibly causing crashes when
used.
- ECDSA JWT signatures with ES256/384/512 could cause a heap overflow
of ~14 bytes in the DER conversion before verification.
- Lua's httpclient headers conversion accepted more than 101 headers
without bound checking, causing a stack buffer overflow reachable
from any Lua action/task/service.
- peers dictionary cache updates accepted an unvalidated entry id as
array index, allowing OOB heap writes at attacker-controlled
offsets.
- Lua had a use-after-free of HTTP reason strings managed by Lua's GC
between set_status() and start_response(), potentially leaking
adjacent information from memory.
- the regsub sample function could leak ~9-50KB of stale heap data
when back-reference expansion overflowed the output buffer.
- SPOE decode_varint() had no iteration cap, allowing pointer
arithmetic to wrap and dereference memory ~64KB before the
allocation, causing SIGSEGV or parser confusion.
- in sample expressions, less common HTTP methods (PATCH etc.) are
represented by both an enum and a string. The string part was not
handled correctly in sample duplication functions, resulting in
their contents appearing empty when trying to fetch the method.
- QPACK varint decoding is now also limited to 62-bit, and had a risk
of 1-byte OOB reads on truncated streams, which could cause
incorrect header decoding.
- config: a few argument parsing errors in conditional expressions
used in ".if" could be misreported and even cause a crash during
the parsing. Also, a few keywords relying on warnif_misplaced_*
didn't check the return value and didn't count emitted warnings as
warnings.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47016.html
For 6.2.27:
A major issue were fixed by this release. It was related to the scheme-based
normalization. The presence of commas in Host header and authority was permitted
and would be used to compare the values, which then would differ when read via
hdr(host) which splits them on commas, and under certain circumstances, trigger
crashes (at least it did in the OSS-Fuzz environment when injecting the values
directly at the HTX layer). The issue was fixed. Remains the case of the comma
characters in authorities. Even though the spec permits commas in authorities
(not in domain names), there is currently no use case for this and it causes an
ambiguity with the historical use of hdr(host), so we preferred to just deny
them. The change was performed on the 3.4-dev10 and postponed for the next 3.3
release. It will probably be backported to lower versions too.
An issue in the FCGI multiplexer was fixed. The function responsible to emit
FCGI_PARAM records was not handling cases of full buffer in a consistent
way. The issue was quite limited, but the "http-send-name-header" option could
be silently ignored. The issue was fixed by reworking this function.
The scheme-based normalization was fixed to properly handle case of OPTIONS
requests. As stated in RFC9110#4.2.3, when the scheme-based normalization is
performed, an empty path must be normalized to "/", except for OPTIONS request.
Finally, a memory leak on error path (tools) and other minor issues were also
fixed.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47059.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22f1e90d6b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
- CVE-2026-27654: Buffer overflow in ngx_http_dav_module when using the
alias directive with WebDAV COPY or MOVE requests.
- CVE-2026-27784 & CVE-2026-32647: Buffer overflows in ngx_http_mp4_module
when processing specially crafted MP4 files.
- CVE-2026-27651: NULL pointer dereference in the mail proxy module
during CRAM-MD5 or APOP authentication retries.
- CVE-2026-28753: DNS PTR record manipulation in auth_http or SMTP proxy.
- CVE-2026-28755: OCSP certificate check bypass in the stream module.
For a full list of changes, see:
https://nginx.org/en/CHANGES-1.28
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 8008da299f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See here for changes:
https://nginx.org/en/CHANGES-1.28
Following security related issues are fixed:
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Security: insufficient check in virtual servers handling with TLSv1.3
SNI allowed to reuse SSL sessions in a different virtual server, to
bypass client SSL certificates verification (CVE-2025-23419).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash
(CVE-2024-7347).
Thanks to Nils Bars.
*) Security: when using HTTP/3, processing of a specially crafted QUIC
session might cause a worker process crash, worker process memory
disclosure on systems with MTU larger than 4096 bytes, or might have
potential other impact (CVE-2024-32760, CVE-2024-31079,
CVE-2024-35200, CVE-2024-34161).
Thanks to Nils Bars of CISPA.
Update patch 0007, which does not apply cleanly.
License file was changed, year was bumped to 2025.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a0081aa1f8)
[thomas: remove previously Cherry picked commit]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
While CVE-2019-6111 was already fixed in 2025.89, the version 2026.90
provided a follow up of that fix.
Note that the author provided this note with this patch:
> Note breaking change: "-r" is now disallowed when the target directory exists
> (an additional change in Dropbear's version). If that's required an alternative
> such as rsync could be used.
Adapt your usage of dropbear accordingly.
- CVE-2019-6111:
An issue was discovered in OpenSSH 7.9. Due to the scp implementation
being derived from 1983 rcp, the server chooses which
files/directories are sent to the client. However, the scp client only
performs cursory validation of the object name returned (only
directory traversal attacks are prevented). A malicious scp server (or
Man-in-The-Middle attacker) can overwrite arbitrary files in the scp
client target directory. If recursive operation (-r) is performed, the
server can manipulate subdirectories as well (for example, to
overwrite the .ssh/authorized_keys file).
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2019-6111
- CVE-2026-35385:
In OpenSSH before 10.3, a file downloaded by scp may be installed
setuid or setgid, an outcome contrary to some users' expectations, if
the download is performed as root with -O (legacy scp protocol) and
without -p (preserve mode).
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-35385
[1] https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.90
(cherry picked from commit 5b136c89ff)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-27448:
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in
version 0.14.0 and prior to version 26.0.0, if a user provided
callback to `set_tlsext_servername_callback` raised an unhandled
exception, this would result in a connection being accepted. If a user
was relying on this callback for any security-sensitive behavior, this
could allow bypassing it. Starting in version 26.0.0, unhandled
exceptions now result in rejecting the connection.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-27448
- d41a814759
- CVE-2026-27459:
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in
version 22.0.0 and prior to version 26.0.0, if a user provided
callback to `set_cookie_generate_callback` returned a cookie value
greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided
buffer. Starting in version 26.0.0, cookie values that are too long
are now rejected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-27459
- 57f09bb4bb
(cherry picked from commit 7bcba8498b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Thanks to OpenEmbedded Community for providing the patches:
https://github.com/openembedded/meta-openembedded/blob/scarthgap/meta-python/recipes-devtools/python/python3-cbor2/
- CVE-2025-64076:
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the
decode_definite_long_string() function of the C extension decoder
(source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds
Read (CWE-191, CWE-125): An incorrect variable reference and missing
state reset in the chunk processing loop causes buffer_length to not
be reset to zero after UTF-8 character consumption. This results in
subsequent chunk_length calculations producing negative values (e.g.,
chunk_length = 65536 - buffer_length), which are passed as signed
integers to the read() method, potentially triggering unlimited read
operations and resource exhaustion. (2) Memory Leak via Missing
Reference Count Release (CWE-401): The main processing loop fails to
release Python object references (Py_DECREF) for chunk objects
allocated in each iteration. For CBOR strings longer than 65536 bytes,
this causes cumulative memory leaks proportional to the payload size,
enabling memory exhaustion attacks through repeated processing of
large CBOR payloads. Both vulnerabilities can be exploited remotely
without authentication by sending specially-crafted CBOR data
containing definite-length text strings with multi-byte UTF-8
characters positioned at 65536-byte chunk boundaries. Successful
exploitation results in denial of service through process crashes
(CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities
affect all applications using cbor2's C extension to process untrusted
CBOR data, including web APIs, IoT data collectors, and message queue
processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9
pushed with released version 5.7.1.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64076
- CVE-2025-68131:
cbor2 provides encoding and decoding for the Concise Binary Object
Representation (CBOR) serialization format. Starting in version 3.0.0
and prior to version 5.8.0, whhen a CBORDecoder instance is reused
across multiple decode operations, values marked with the shareable
tag (28) persist in memory and can be accessed by subsequent CBOR
messages using the sharedref tag (29). This allows an attacker-
controlled message to read data from previously decoded messages if
the decoder is reused across trust boundaries. Version 5.8.0 patches
the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68131
- CVE-2026-26209:
cbor2 provides encoding and decoding for the Concise Binary Object
Representation (CBOR) serialization format. Versions prior to 5.9.0
are vulnerable to a Denial of Service (DoS) attack caused by
uncontrolled recursion when decoding deeply nested CBOR structures.
This vulnerability affects both the pure Python implementation and the
C extension `_cbor2`. The C extension relies on Python's internal
recursion limits `Py_EnterRecursiveCall` rather than a data-driven
depth limit, meaning it still raises `RecursionError` and crashes the
worker process when the limit is hit. While the library handles
moderate nesting levels, it lacks a hard depth limit. An attacker can
supply a crafted CBOR payload containing approximately 100,000 nested
arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits
the Python interpreter's maximum recursion depth or exhausts the
stack, causing the process to crash with a `RecursionError`. Because
the library does not enforce its own limits, it allows an external
attacker to exhaust the host application's stack resource. In many web
application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery),
an unhandled `RecursionError` terminates the worker process
immediately. By sending a stream of these small (<100KB) malicious
packets, an attacker can repeatedly crash worker processes, resulting
in a complete Denial of Service for the application. Version 5.9.0
patches the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-26209
(cherry picked from commit b676a4f51b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
Fixes CVEs:
CVE-2026-40684 Possible crash with malicious DNS data when using musl libc
On systems using musl libc (not glibc) due to an oddity in octal printing
it is possible to crash the connection instance when malformed DNS data
is present in PTR records.
CVE-2026-40685 Possible OOB read/write on corrupt JSON in header
configurations using json operators on invalid externally-provided input
could trigger heap corruption.
CVE-2026-40686 Possible OOB read with large UTF8 trailing characters
configurations using utf8 operators on malformed utf8 in headers could
trigger OOB reads and might trigger some data leak if error
messages are required for subsequent emails in the current connection
and similar malformed headers are present.
CVE-2026-40687 Possible OOB read/write with SPA authenticator
in configurations using the SPA authentication driver to a hostile/compromised
external SPA/NTLM connnection it is possible to trigger an OOB read/write
and crash the connection instance or possibly leak heap data to the instance.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f6d37ab9a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This reverts commit 0d81107f02. The bug
the workaround is for was fixed in binutils 2.29.51 (first release
listed in bfd/ChangeLog after the fix), which is by now far older than
any version supported by Buildroot.
Compile tested with qemu_microblazeel_mmu_defconfig plus
BR2_PACKAGE_KMOD=y.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 7653e616f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/OpenSC/OpenSC/blob/0.27.1/NEWS
Switched to sha256 tarball hash provided by upstream.
Removed patch which is included in this release.
Fixes the following CVEs:
* CVE-2025-13763: Several uses of potentially uninitialized memory
detected by fuzzers
* CVE-2025-49010: Possible write beyond buffer bounds during processing
of GET RESPONSE APDU
* CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver
* CVE-2025-66038: Possible read beyond buffer bounds when parsing
historical bytes in PIV driver
* CVE-2025-66037: Possible buffer overrun while parsing SPKI
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit baa0a13653)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
NetworkManager stopped requiring intltool with 1.40:
56b51b98fb/NEWS (L434)
Fixes: e7c20ad548
host-gettext is already an indirect dependency via package/libglib2.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: add reference to commit that updated NM to 1.40]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit c393060c7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
There is no such option, and according to the commit history never
was. If BR2_PACKAGE_HOST_PYTHON3_SSL=y the build adds host-openssl to
HOST_PYTHON3_DEPENDENCIES directly.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 201d6f4937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
GCC 12.x is unsupported upstream but the patches from the gcc-13 release
branch are easy enough to backport. The first one (libcody fix) applies
without changes, the second one only needs to move one header instead of
two for gcc-12.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
eeb65cf0f6 manually backported upstream
util-linux security fix (util-linux: 5e390467b26a3cf3fecc04e1a0d482dff3162fc4)
but didn't account for ul_canonicalize_path being named just canonicalize_path
in 2.40.x. Use the upstream backported patch from the 2.40.x maintenance
branch instead.
Can be reproduced with the following defconfig:
BR2_arm=y
BR2_cortex_a7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_INIT_NONE=y
BR2_SYSTEM_BIN_SH_NONE=y
BR2_PACKAGE_UTIL_LINUX_LOSETUP=y
Fixes: eeb65cf0f6
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[thomas: added defconfig]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.3.news
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c1a34838b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
