Commit Graph

83465 Commits

Author SHA1 Message Date
Titouan Christophe
c4edb8a805 package/redis: security bump to v8.10.2
See the release notes:
https://github.com/redis/redis/blob/8.10.2/00-RELEASENOTES

No CVE number are mentioned in these notes, however it states:
"Update urgency: `SECURITY`: There are security fixes in the release"

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5263a5f220)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:47 +02:00
Yann E. MORIN
23a89f0245 package/gpsd: backport security fixes for CVE-2026-58459
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8cfad4f0f4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:44 +02:00
Bernd Kuhls
e1f54e6c73 package/python3: remove 2to3
Upstream release 3.13.0 first included commit
ae00b810d1
which removed the 2to3 program and the lib2to3 module.

Buildroot commit d63e207eb8 bumped the
package from 3.12.9 to 3.13.2 but forgot to remove its handling.

Current versions of Kodi do not need lib2to3.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: fix typo in commit log version "3.13.9" -> "3.12.9"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 96bac75585)
[raphael: resolve conflicts in Config.in.legacy]
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:20:11 +02:00
Bernd Kuhls
cd1b2818a8 package/python3: remove configure option --without-cxx-main
Upstream release 3.12.0 first included commit
398ed84dc4
which removed the configure option --with-cxx-main.

Buildroot commit 36e635d2d5 bumped the
package from 3.11.6 to 3.12.1 but forgot to remove that configure
option.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 261aaa6d63)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:46 +02:00
Yegor Yefremov
08c78948dd package/mbedtls: security bump to v3.6.7
For more information about the release, see:

- https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7
- https://github.com/Mbed-TLS/mbedtls/compare/mbedtls-3.6.6..mbedtls-3.6.7

Fixes the following vulnerabilities:

- CVE-2026-50587:
    Timing side-channel in RSA PKCS#1 v1.5 decryption

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50587
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-rsa-pkcs1-v15-decryption-timing-side-channel/

- CVE-2026-50581:
    Extended master secret calculation failure ignored

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50581
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-extended-master-secret-calculation-failure-ignored/

- CVE-2026-50640:
    Ignored TLS 1.3 resumption secret derivation error

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50640
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ignored-tls13-resumption-secret-derivation-error/

- CVE-2026-50713:
    Heap corruption with early renegotiation after corrupted record
    in DTLS

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50713
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-heap-corruption-early-renegotiation-corrupted-dtls-record/

- CVE-2026-50584:
    ChaCha20 counter overflow can reuse keystream

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50584
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-chacha20-counter-overflow-keystream-reuse/

- CVE-2026-73096:
    TLS 1.3 early data integrity failure due to buffered plaintext
    across key change

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-73096
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-early-data-integrity-failure-key-change/

- CVE-2026-35336:
    Possible buffer overflow in mbedtls_ecdh_calc_secret()

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-35336
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-possible-buffer-overflow-ecdh-calc-secret/

- CVE-2026-50580:
    Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50580
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-ecdhe-psk-client-buffer-overflow/

- CVE-2026-54435:
    Side channel leak in ECC optimized modp

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-54435
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ecc-optimized-modp-side-channel/

- CVE-2026-50586:
    Information disclosure in TLS 1.2 NewSessionTicket

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50586
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-newsessionticket-information-disclosure/

- CVE-2026-50583:
    Out-of-bounds read when parsing a zero-length ECC public key

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50583
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-zero-length-ecc-public-key-oob-read/

- CVE-2026-50588:
    Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange
    parsing

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50588
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls12-ecjpake-serverkeyexchange-oob-read/

- CVE-2026-50579:
    Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7
    context

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50579
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-use-after-free-pkcs7-free-reused-context/

- CVE-2026-54441:
    Signature algorithm restrictions not enforced on certificate
    chain

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-54441
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-signature-algorithm-restrictions-certificate-chain/

- CVE-2026-50585:
    Incomplete context reset in mbedtls_ssl_session_reset()

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-50585
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-ssl-session-reset-incomplete-context-reset/

- CVE-2026-73064:
    A random generator fault can compromise TLS data integrity

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-73064
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/

- CVE-2026-25832:
    TLS 1.3 client accepts HelloRetryRequest selecting an
    unadvertised group

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-25832
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-hrr-unadvertised-group/

- CVE-2026-49300:
    X.509 CA bit forgery via invalid basicConstraints extension

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-49300
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-x509-ca-bit-forgery-invalid-basicconstraints/

It also fixes the following issue, which has no CVE identifier:

- PKCS7 signed data verification accepts weak hash algorithms

For more information, see:
 - https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-pkcs7-weak-hash-algorithms-accepted/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45903c02e3)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:42 +02:00
Thomas Petazzoni
e2071312ca package/libarchive: drop dependency on host-pkgconf
Commit 95db5707df bumped libarchive to
version 3.8.1, and as part of this, dropped AUTORECONF = YES. This
allowed to drop the host-pkgconf dependency, which was only needed due
to AUTORECONF = YES. However, the host-pkgconf dependency removal was
only done for the target variant of libarchive, and not for the host
variant.

This commit aligns the host variant with the target variant from that
perspective.

This is not tagged as a fix, as nothing was broken.

Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit ddaa55ead5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:38 +02:00
Bernd Kuhls
78a14e155a package/vlc: security bump to version 3.0.24
https://code.videolan.org/videolan/vlc/-/blob/3.0.24/NEWS
https://code.videolan.org/videolan/vlc/-/tags/3.0.24

https://www.videolan.org/vlc/releases/3.0.24.html
"Over 130 security fixes across VLC and its bundled libraries"

https://www.videolan.org/security/sb-vlc3024.html
"VLC 3.0.24 fixes over 50 security issues in VLC itself."

Upstream removed unmaintainted libschroediner library:
614914f7bb

Upstream removed support for mfx, which was disabled in buildroot, and
replaced it with optional support for libvpl:
dcd1e9f447

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cdddb871d3)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:35 +02:00
Bernd Kuhls
030dc6e253 package/tzdata: bump version to 2026e
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VXIA4AU73OQL3OZ3ZBZHWIASIIVBGUJV/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/L4IGHJRBUQR53F7RTEHM5IS7ZMBR3YXP/
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/NVHSX2PAQIT44U5FCCEVNJJYXQMMTJSA/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3b3f1d6d9d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:31 +02:00
Bernd Kuhls
dc7e2cca5c package/hwdata: bump version to 0.412
https://github.com/vcrhonek/hwdata/releases/tag/v0.412

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 57ed2d0d68)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:27 +02:00
Bernd Kuhls
841cdc4017 package/hwdata: bump version to 0.411
https://github.com/vcrhonek/hwdata/releases/tag/v0.411
https://github.com/vcrhonek/hwdata/releases/tag/v0.410

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e3c4a32d34)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 13:17:17 +02:00
Raphaël Mélotte
3a55c7aba6 {linux, linux-headers}: bump 6.18.x, 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x series
Update the latest kernel releases to:
 - 6.18.54 -> 6.18.55
 - 6.12.111 -> 6.12.112
 - 6.6.157 -> 6.6.158
 - 6.1.188 -> 6.1.189
 - 5.15.221 -> 5.15.222
 - 5.10.270 -> 5.10.271

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 22:09:26 +02:00
Bernd Kuhls
a345a04442 package/libheif: security bump version to 1.23.5
https://github.com/strukturag/libheif/releases/tag/v1.23.5

Fixes the following CVEs:

(CVE numbers will be added when assigned.)

CVE-2026-XXXXX (GHSA-v8qw-hwjv-44hw)
CVE-2026-XXXXX (GHSA-qwpf-5wf7-r996)
CVE-2026-XXXXX (GHSA-9c75-9g8r-4728)
CVE-2026-XXXXX (GHSA-r7gr-2xm2-23wf)
CVE-2026-XXXXX (GHSA-q492-cfcm-895h)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5feefc6be0)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:33:57 +02:00
Peter Seiderer
b42d59e25f package/dhcpcd: fix check-package warnings in S41dhcpcd
Update S41dhcpcd:

- use plain "dhcpcd" for DAEMON (instead of "/sbin/dhcpcd"), adjust
  PIDFILE accordingly and while at it use quotation marks for variable
  definitions
- fix indent (tabs vs. spaces)

Fixes:

  $ ./utils/check-package package/dhcpcd/*
  package/dhcpcd/S41dhcpcd:6: Do not include path in DAEMON (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:8: Incorrect PIDFILE value  (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:13: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:17: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:21: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:25: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)
  package/dhcpcd/S41dhcpcd:30: should be indented with tabs (https://nightly.buildroot.org/#adding-packages-start-script)

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 42c3ecb293)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:33:22 +02:00
Bernd Kuhls
9f02742040 package/thrift: security bump version to 0.25.0
https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1

Removed patch 0001 which is included in this release.

Updated license hash due to upstream commit
df376589a8

Quoting https://seclists.org/oss-sec/2026/q4/38:

"It fixes the 61 vulnerabilities listed below.
[...]
Each entry gives the CVSS 4.0 score, the ASF rating, the title, the
affected language bindings and a link to the full announcement (severity
vector, weakness, description and credit). The CVE records are at
https://www.cve.org/CVERecord?id=<CVE id>.

CVE-2026-61373  8.7  important Java TSaslNonblockingServer pre-auth
                               unbounded SASL frame allocation
                               Bindings: Java
 https://lists.apache.org/thread/shy1rrm2g383wlbdb2p7w19c868ntdjp

CVE-2026-61374  7.1  important Java TSaslTransport post-auth data-frame
                               missing size limit
                               Bindings: Java
 https://lists.apache.org/thread/35831rngzrqky1gvc32t06psgq1b8441

CVE-2026-63772  8.7  important Unauthenticated single-packet crash of Go
                               Thrift servers via the THeader transform
                               count
                               Bindings: Go
 https://lists.apache.org/thread/6kpzdw29gsfxptv4b65y9s6f42tdyo8k

CVE-2026-66054  6.9  moderate  C++ THeaderTransport does not enforce
                               configured maxFrameSize
                               Bindings: C++
 https://lists.apache.org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33

CVE-2026-66055  8.2  important TJSONProtocol accepts a single JSON
                               string/number exceeding the configured size
                               limit (multi-language)
                               Bindings: C++, Java, Go, netstd, Python,
                                 Delphi
 https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx

CVE-2026-66081  8.7  important c_glib read_message_begin leaves output
                               parameters unset for non-versioned messages
                               Bindings: c_glib
 https://lists.apache.org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57

CVE-2026-66331  6.9  moderate  Buffered transport reads are not accounted
                               against MaxMessageSize
                               Bindings: Delphi
 https://lists.apache.org/thread/971572orz86jdwlg58wqv8o50oqqb143

CVE-2026-66837  8.7  important PHP accelerator sizes a stack buffer from a
                               wire-controlled string length
                               Bindings: PHP
 https://lists.apache.org/thread/7o985t84551tpo55v6fsd3g42gs3zps1

CVE-2026-66858  8.7  important skip() does not apply the recursion limit
                               (Python accelerator, PHP, Perl, Lua,
                               Smalltalk, OCaml)
                               Bindings: Python, PHP, Perl, Lua, Smalltalk,
                                 OCaml
 https://lists.apache.org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5

CVE-2026-66859  8.7  important c_glib multiplexed processor crashes on a
                               message it cannot route
                               Bindings: c_glib
 https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o

CVE-2026-82458  8.7  important Container element count not bounded by the
                               bytes available
                               Bindings: Go, Rust, netstd, OCaml, Erlang,
                                 JavaME, C++, Java, Kotlin, D
 https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7

CVE-2026-82459  8.2  important Integer underflow in C++ THeaderTransport
                               allows an unauthenticated remote peer to
                               terminate a 32-bit process
                               Bindings: C++
 https://lists.apache.org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2

CVE-2026-83632  9.2  critical  C++ THttpTransport grows its line buffer
                               without bound
                               Bindings: C++
 https://lists.apache.org/thread/zjv6hjmhl4tb4l4l1dk4bmc2whxh0lb4

CVE-2026-83663  8.7  important TFramedTransport and THeaderTransport
                               re-enter Read once per frame that carries no
                               payload (Go)
                               Bindings: Go
 https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct

CVE-2026-83745  8.7  important WebSocket frame decoders allocate the payload
                               buffer from the declared length, not the
                               bytes received (Node.js, D)
                               Bindings: Node.js, D
 https://lists.apache.org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgc

CVE-2026-85086  6.9  moderate  Perl TLS client disables certificate
                               verification by default
                               Bindings: Perl
 https://lists.apache.org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmy

CVE-2026-85087  6.9  moderate  Python ≥3.12 host-name check silently becomes
                               a no-op
                               Bindings: Python
 https://lists.apache.org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0d

CVE-2026-85088  6.9  moderate  The C++ and D clients fall back to the
                               certificate Common Name when subjectAltName
                               entries are present but do not match
                               Bindings: C++, D
 https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371

CVE-2026-85476  8.2  important c_glib `read_all` spins when the underlying
                               read returns 0
                               Bindings: c_glib
 https://lists.apache.org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jj

CVE-2026-85483  6.3  moderate  c_glib TZlibTransport reports a full read
                               after a premature stream end
                               Bindings: c_glib
 https://lists.apache.org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfy

CVE-2026-85493  8.7  important TProtocolUtil.skip follows peer-chosen
                               nesting to any depth the stack allows (Dart,
                               Java ME)
                               Bindings: Dart, JavaME
 https://lists.apache.org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5m

CVE-2026-85494  8.7  important Framed transport and binary protocol size a
                               read buffer from a peer-declared length with
                               no effective maximum (multi-language)
                               Bindings: Python, Ruby, Erlang, Lua, Dart,
                                 JavaME, D, Perl, PHP
 https://lists.apache.org/thread/rm0m34gt6fh1flvt16wty559hfg191qr

CVE-2026-86535  8.7  important A JSON member name can stall the Node
                               server's event loop indefinitely
                               Bindings: Node.js
 https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g

CVE-2026-86536  6.3  moderate  A map key from the wire can replace a decoded
                               object's prototype in generated JavaScript
                               Bindings: Node.js, JavaScript, TypeScript
 https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp

CVE-2026-86537  8.7  important A truncated HTTP request stops the D

                               library's server, allowing an unauthenticated

                               remote attacker to deny service
                               Bindings: D
 https://lists.apache.org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7m

CVE-2026-87117  8.7  important PHP `thrift_protocol` accelerator

                               dereferences a missing container-element spec

                               Bindings: PHP
 https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy

CVE-2026-90440  8.2  important An exception escaping a libevent callback
                               stops the D library's non-blocking server,
                               allowing an unauthenticated remote attacker
                               to deny service
                               Bindings: D
 https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg

CVE-2026-91135  9.2  critical  C++ `THeaderTransport::transform()` heap
                               buffer overflow (write direction)
                               Bindings: C++
 https://lists.apache.org/thread/rbpwlhlxnv2qgyk8cfscp2d2fd3p0ojb

CVE-2026-91137  8.7  important PHP `thrift_protocol` accelerator: zero-byte
                               container elements
                               Bindings: PHP
 https://lists.apache.org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7

CVE-2026-92834  6.3  moderate  C++ WebSocket server transport does not read
                               a full request length
                               Bindings: C++
 https://lists.apache.org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0

CVE-2026-93925  8.7  important C++ `THeaderTransport::writeVarint32()` stack
                               buffer overflow on a negative protocol id
                               Bindings: C++
 https://lists.apache.org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9

CVE-2026-93926  8.7  important C++ `THeaderTransport::untransform()` leaks
                               the zlib stream on the error path
                               Bindings: C++
 https://lists.apache.org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgb

CVE-2026-94633  8.7  important Dart `TBinaryProtocol.readMessageBegin`
                               allocates from the pre-versioned name length
                               Bindings: Dart
 https://lists.apache.org/thread/cxkbblyht7988p2o6yvnmd6536qmt88k

CVE-2026-94634  8.2  important Python `TJSONProtocol` has a string length
                               limit that is off by default
                               Bindings: Python
 https://lists.apache.org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4

CVE-2026-94635  8.7  important Lua `TBinaryProtocol:readMessageBegin`
                               bypasses `checkStringSize` on the
                               pre-versioned name
                               Bindings: Lua
 https://lists.apache.org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3

CVE-2026-94636  8.2  important Python `TZlibTransport` stops enforcing its
                               decompressed-size limit once the limit is
                               exactly used up
                               Bindings: Python
 https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrs

CVE-2026-94637  8.2  important Go `THeaderTransport` does not bound the
                               inflated size of a ZLIB frame
                               Bindings: Go
 https://lists.apache.org/thread/6hxll1jcnod9gfr225tz7my08lpj3jmt

CVE-2026-94638  6.3  moderate  PHP `thrift_protocol` C extension ignores the
                               configured `maxStringSize`
                               Bindings: PHP
 https://lists.apache.org/thread/v60w786pqr7njzz9425grby8yjrgmbsj

CVE-2026-94639  8.2  important Java `TSaslNonblockingServer`: residual of
                               CVE-2026-61373 (thread-death black hole + no
                               cross-connection budget)
                               Bindings: Java
 https://lists.apache.org/thread/5okpz47dv8hy0s3r6tmrplg3y7jzhhyw

CVE-2026-94642  8.7  important PHP `TSimpleServer` exits the whole process
                               on any non-transport exception
                               Bindings: PHP
 https://lists.apache.org/thread/5tjwbbyympbj16lblocv9b12s32sg113

CVE-2026-94644  8.2  important PHP `TJSONProtocol` string/number readers
                               have no size bound
                               Bindings: PHP
 https://lists.apache.org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzq

CVE-2026-94645  8.2  important Node.js `TJSONProtocol` uses a peer-declared
                               container size as an unbounded loop bound
                               Bindings: Node.js
 https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6

CVE-2026-94646  8.7  important Node.js `server.js` ends the process on any
                               per-connection error (+ two triggers)
                               Bindings: Node.js
 https://lists.apache.org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8

CVE-2026-94648  8.2  important dart `TJsonProtocol`/`TJSONProtocol` has no
                               string size bound
                               Bindings: Dart
 https://lists.apache.org/thread/f9w4q6ttlc3k9404x4do25gdhqodtjnn

CVE-2026-94650  8.2  important c_glib generated struct readers have no
                               recursion-depth guard (native stack
                               exhaustion)
                               Bindings: c_glib
 https://lists.apache.org/thread/poskkt3p754b2f293g63934hw160o86j

CVE-2026-94651  8.2  important Java `TSaslNonblockingServer`
                               `Computation.run` orphans a connection on a
                               pre-auth parse error
                               Bindings: Java
 https://lists.apache.org/thread/rflzpdvtk8yhpzg99wkf5yf277nn7267

CVE-2026-94652  6.3  moderate  C++ `TEvhttpServer` leaks its
                               `RequestContext` when the processor throws
                               before calling back
                               Bindings: C++
 https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727

CVE-2026-94653  8.2  important PHP framed/memory/HTTP transports re-slice
                               the buffer on every read (quadratic)
                               Bindings: PHP
 https://lists.apache.org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4m

CVE-2026-94654  8.2  important Python `TNonblockingServer` busy-loops and
                               stops selecting all fds after an
                               8192-byte-boundary frame
                               Bindings: Python
 https://lists.apache.org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7j

CVE-2026-94655  8.2  important Lua `TJsonProtocol` string/number readers
                               have no size bound and are quadratic
                               Bindings: Lua
 https://lists.apache.org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dt

CVE-2026-94656  8.2  important rb `TJsonProtocol`/`TJSONProtocol` has no
                               string size bound
                               Bindings: Ruby
 https://lists.apache.org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8

CVE-2026-94657  8.2  important javame `TJsonProtocol`/`TJSONProtocol` has no
                               string size bound
                               Bindings: JavaME
 https://lists.apache.org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14

CVE-2026-94658  8.7  important Lua `TFramedTransport`/`THttpTransport`

                               re-slice the buffer on every read (quadratic)

                               Bindings: Lua
 https://lists.apache.org/thread/hv6b1nyk2p15gy5pmtprwo7z9m46mfcx

CVE-2026-96277  8.7  important Ruby `SimpleServer` ends `serve()` on any
                               non-Transport/Protocol exception
                               Bindings: Ruby
 https://lists.apache.org/thread/k1t5r9sz7k5tn57cnf5khw2ywlxv6098

CVE-2026-96286  8.2  important Perl servers end `serve()` when serving one
                               connection fails
                               Bindings: Perl
 https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9

CVE-2026-96287  8.2  important Perl `FramedTransport` reads and TLS socket

                               writes re-slice the remaining buffer on every

                               call (quadratic)
                               Bindings: Perl
 https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9

CVE-2026-96288  8.2  important Erlang generated struct reads have no
                               recursion-depth guard (unbounded memory)
                               Bindings: Erlang
 https://lists.apache.org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzb

CVE-2026-96289  8.2  important php `--gen php:inlined` struct readers (and
                               `TProtocol::skipBinary`) have no
                               recursion-depth guard
                               Bindings: PHP
 https://lists.apache.org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8

CVE-2026-96292  8.2  important Lua `THttpTransport:_parseHeaders` matches
                               each header line with a backtracking pattern
                               (quadratic)
                               Bindings: Lua
 https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn

CVE-2026-96294  8.7  important nodejs web server: no `error` listener on an
                               upgraded WebSocket connection
                               Bindings: Node.js
 https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4

CVE-2026-96990  8.2  important Erlang thrift_json_protocol reads a whole
                               message with no size bound
                               Bindings: Erlang
 https://lists.apache.org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dgh

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ab2c029070)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:31:46 +02:00
Bernd Kuhls
cf9d383ade package/thrift: bump version to 0.24.0
https://github.com/apache/thrift/blob/v0.24.0/CHANGES.md

Please note that this bump includes CVE-2026-41608:
https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
which fixes a security bug in the python bindings that are not used by
buildroot.

Building this defconfig

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://toolchains.bootlin.com/downloads/releases/toolchains/aarch64--glibc--bleeding-edge-2017.05-toolchains-1-2.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_6=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_9=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM_GLIBC=y
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_PACKAGE_THRIFT=y

without this bump does not cause build errors.

The Gitlab pipelines detected a build error for this bump with the
defconfig bootlin-aarch64-glibc-old:

/builds/bkuhls/buildroot/br-test-pkg/bootlin-aarch64-glibc-old/build/thrift-0.24.0/lib/cpp/src/thrift/transport/TBufferTransports.h:110:32:
 error: ‘ptrdiff_t’ does not name a type

To fix the problem we add a patch to include cstddef.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0e5019c2e4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:31:33 +02:00
Bernd Kuhls
789bf2f21f package/mpg123: remove MMU dependency
Buildroot commit f0862592b3 added the
dependency to BR2_USE_MMU in 2014.

Upstream made fork() optional in 2022:
91f75fc026

This change reveals a previously hidden build error with the toolchain
bootlin-armv7m-uclibc:

src/libmpg123/synth_arm_accurate.S: Assembler messages:
src/libmpg123/synth_arm_accurate.S:22: Error: selected processor does
 not support ARM opcodes
src/libmpg123/synth_arm_accurate.S:31: Error: attempt to use an ARM
 instruction on a Thumb-only processor --
 `stmfd sp!,{r4,r5,r6,r7,r8,r9,r10,r11,lr}'
src/libmpg123/synth_arm_accurate.S:33: Error: attempt to use an ARM
 instruction on a Thumb-only processor -- `add r0,r0,#64'
[...]

To fix the problem we limit ARM code to BR2_ARM_CPU_HAS_ARM.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fca0899dd6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:31:01 +02:00
Bjørn Damstedt Rasmussen
98ef053c24 package/openjdk-bin: add proper CPE ID information
The CPE ID on openjdk version 21.0.2 in NVD:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:oracle:openjdk:21.0.2:*:*:*:*:*:*:*

HOST_OPENJDK_BIN_CPE_ID_VERSION has be overwritten to match NVD's
versioning.

Signed-off-by: Bjørn Damstedt Rasmussen <contact@bearware.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b174bfd0b2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:29:56 +02:00
Yegor Yefremov
71a0aff9cf package/swig: also create a swig4.0 symlink
FindSWIG in CMake searches for swig4.0, swig3.0 and swig2.0 before it
tries plain swig, and it searches the whole PATH for one name before
moving on to the next. We only create swig3.0 and swig$(SWIG_VERSION_MAJOR)
(swig4.5) symlinks in $(HOST_DIR)/bin, so a swig4.0 installed on the
build machine, as Ubuntu 22.04 does with its swig4.0 package, takes
precedence over our host-swig for every CMake package that does not pass
SWIG_EXECUTABLE explicitly. With CMake 3.22.1, libftdi1 with Python
bindings ends up with

  -- Found SWIG: /usr/bin/swig4.0 (found suitable version "4.0.2", ...)

Also create a swig4.0 symlink, and update the comment accordingly.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9722f61382)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:28:33 +02:00
Bjørn Damstedt Rasmussen
daa15b62e4 package/openjdk: CPE ID for openjdk
The CPE ID on version 21.0.2 in NVD:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:oracle:openjdk:21.0.2:*:*:*:*:*:*:*

The automatically generated OPENJDK_CPE_ID_VERSION cannot be used
because OPENJDK_VERSION includes a '+', e.g. "21.0.2+10". NVD will not
accept a version number with '+'.

Signed-off-by: Bjørn Damstedt Rasmussen <contact@bearware.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 875cc7bbf1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:28:20 +02:00
Bjørn Damstedt Rasmussen
0bc7fbf48f package/setserial: CPE ID for setserial
This is a valid CPE ID:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:setserial_project:setserial:2.17:*

Signed-off-by: Bjørn Damstedt Rasmussen <contact@bearware.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3010c801e3)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:28:12 +02:00
Dario Binacchi
76b472df0a package/libgphoto2: drop autoreconf
Commit 8b05934511 ("package/libgphoto2: bump to version 2.5.34")
removed the patch touching the autoconf macros, but left behind the
comment referring to it and LIBGPHOTO2_AUTORECONF = YES. The release
tarball ships a regenerated configure script that already includes the
jpeg_mem_dest size type check, so autoreconf is no longer needed.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e493982138)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:28:02 +02:00
Fiona Klute
240b30a2a5 package/libseccomp: security bump to version 2.6.1
The upstream changelog [1] lists three security fixes (without CVEs):

* Incorrect 64-bit comparison merge in libseccomp can weaken seccomp filters
  https://github.com/seccomp/libseccomp/security/advisories/GHSA-4q85-33p6-j5g6

* Oversized seccomp filters can trigger libseccomp double free
  https://github.com/seccomp/libseccomp/security/advisories/GHSA-46fr-jh49-xvhx

* Oversized seccomp filters can trigger libseccomp heap corruption
  https://github.com/seccomp/libseccomp/security/advisories/GHSA-2hqh-5c36-grrm

[1] https://github.com/seccomp/libseccomp/releases/tag/v2.6.1

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 18f6446b4f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:27:51 +02:00
TIAN Yuanhao
c58a9d0abe package/chrony: add 50-chrony.list for systemd-timedated
systemd-timedated discovers NTP services from ntp-units.d/*.list.
Buildroot's chrony package never installs one: on a systemd image
without timesyncd, 'timedatectl status' reports

    NTP service: n/a

and 'timedatectl set-ntp on' fails with

    Failed to set ntp: NTP not supported

even though chronyd is running.

Install 50-chrony.list, following the convention set by Debian,
Fedora and Arch, so timedatectl can manage chrony.

Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Scott Fan <fancp2007@gmail.com>
Signed-off-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 079f168792)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:26:50 +02:00
Florian Larysch
2ea8cf9afb linux: fix pahole discovery when BR2_LINUX_KERNEL_NEEDS_HOST_PAHOLE
Around Linux 5.11, upstream started introducing checks that execute
"pahole --version" for feature discovery (e.g. [1]).

However, when building with BR2_LINUX_KERNEL_NEEDS_HOST_PAHOLE Buildroot
only lists host-pahole in LINUX_DEPENDENCIES, so it isn't available for
the configure step when using BR2_PER_PACKAGE_DIRECTORIES. This results
in the host pahole being used (resulting in host-dependent behavior), or
no pahole being detected at all when the build host doesn't have it
(which will then disable Kconfig options that require it).

Fix this by adding host-pahole to LINUX_KCONFIG_DEPENDENCIES.

A similar issue occurs when running "make linux-menuconfig" and friends
because PATH deliberately gets stripped when pkg-kconfig.mk builds
x_CONFIGURATOR_MAKE_ENV. Explicitly pass the pahole path to fix this.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=5f9ae91f7c0dbbc4195e2a6c8eedcaeb5b9e4cbb

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6c9c2b71e6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:26:40 +02:00
Fiona Klute (othermo GmbH)
999368b2a7 package/e2fsprogs: enable libarchive for host package
mke2fs need libarchive to populate a newly created filesystem from a
tarball with "-d tarball|-". Enable it in HOST_E2FSPROGS_CONF_OPTS,
and add a dependency on host-libarchive.

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b1990243ca)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:26:30 +02:00
Fiona Klute (othermo GmbH)
0679bed2f6 package/gnu-efi: fix license information
Split the confusing "and/or" for gnulib, so dual-licensed and GPL-only
parts are clearly noted, and add the missing LGPL license. Lines in
GNU_EFI_LICENSE are ordered the same way as the information is given
in the LICENSE file.

The license situation of inc/subst/elf.h is curious: The file itself
is licensed under LGPL-2.1-or-later, and used in gnu-efi under
LGPL-3.0-or-later (accompanied by the appropriate license files),
which in turn allows using it for object code under different terms
with certain conditions (see section 3 of LGPL 3.0, as noted in the
gnu-efi LICENSE file).

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7ed738bf5d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:26:20 +02:00
Bernd Kuhls
6d271094e8 package/suricata: security bump version to 8.0.7
https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315

Fixes CVE-2026-45764, CVE-2026-45766, CVE-2026-45769, CVE-2026-45768,
CVE-2026-46387, CVE-2026-45759, CVE-2026-45762, CVE-2026-45765,
CVE-2026-45747, CVE-2026-45770, CVE-2026-46352, CVE-2026-45767,
CVE-2026-45763, CVE-2026-45751, CVE-2026-45752 & CVE-2026-45761

https://forum.suricata.io/t/suricata-8-0-6-and-7-0-17-released/6391

Fixes CVE-2026-63452, CVE-2026-63450, CVE-2026-63449, CVE-2026-57227,
CVE-2026-57229, CVE-2026-63446, CVE-2026-63448, CVE-2026-57224,
CVE-2026-63447, CVE-2026-63451, CVE-2026-57222 & CVE-2026-57228

https://forum.suricata.io/t/suricata-8-0-7-released/6467

Fixes 67 security bugs, all CVEs are pending.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 510003c041)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:09:12 +02:00
Yegor Yefremov
bcdaf25207 package/tcpreplay: security bump to version 4.6.1
Fixes the following security issues:

4.5.4: GHSA-2wmf-4p77-784q, GHSA-5cjx-62pj-pmgq, GHSA-pfqg-243f-8q25,
       GHSA-pjh6-6hrw-vcwr, GHSA-ww62-mxv7-pg55
4.5.5: GHSA-27v4-xhfx-g2rx, GHSA-777w-9599-w8g4, GHSA-jj65-mrgg-f5fx,
       GHSA-m655-53p4-6qm8, GHSA-p7xp-4gj2-x56c, GHSA-v8c4-9w98-9v6v
4.6.0: GHSA-5q26-7fxx-v8fh, GHSA-fwcr-mqg6-hqmx, GHSA-m6w7-8497-g9c9
4.6.1: GHSA-4hqm-8v2c-9pwj, GHSA-p3f2-88rg-9mch, GHSA-pmmx-m8p5-969j

Release notes:
https://github.com/appneta/tcpreplay/releases/tag/v4.5.3
https://github.com/appneta/tcpreplay/releases/tag/v4.5.4
https://github.com/appneta/tcpreplay/releases/tag/v4.5.5
https://github.com/appneta/tcpreplay/releases/tag/v4.6.0
https://github.com/appneta/tcpreplay/releases/tag/v4.6.1

Since 4.6.0, CMake is upstream's recommended build system, so convert
the package to it. The option parsers, tcpedit_stub.h and man pages
are pre-generated in the release tarball, so disable autogen, python3
and asciidoctor to not depend on what's installed on the host.

Add patches to:
- make WITH_TCPDUMP work when cross compiling
- find fts_read() in musl-fts' libfts (replaces passing -lfts)
- fix a struct ethhdr redefinition in txring.h with musl

TX_RING support, which is always detected on Linux, unconditionally
uses pthreads, so add a dependency on BR2_TOOLCHAIN_HAS_THREADS.

Fixes:
https://autobuild.buildroot.org/results/1db3e924c659c8edff026568ffbfc576d5222db9

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6ffe6f923c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:08:30 +02:00
Francois Perrad
f6d5135cc6 package/haproxy: allow Lua 5.4
see commit "MEDIUM: lua: Add support for the Lua 5.4"
08ed98fd79

Signed-off-by: Francois Perrad <francois.perrad.86@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5d36891dce)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:08:16 +02:00
Bernd Kuhls
f25fc6742f package/python-twisted: security bump version to 26.4.0
https://github.com/twisted/twisted/blob/twisted-26.4.0/NEWS.rst

Fixes CVE-2026-42304.

Updated license hash due to copyright year bump:
ac504cc808

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e325baa39c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:07:55 +02:00
Bernd Kuhls
385c25f4b0 package/{glibc, localedef}: security bump version to 2.44-57-g34106fee6
Fixes CVE-2026-97399:
34106fee69

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a205fa58d2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:05:36 +02:00
Bernd Kuhls
17da320627 package/libpng: security bump to version 1.6.59
https://github.com/pnggroup/libpng/blob/v1.6.59/ANNOUNCE

Fixes CVE-2026-46675.

Switched to sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 7bb353814c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:05:24 +02:00
Bernd Kuhls
435115dd6d package/libpng: remove autoreconf
Buildroot commit 08ad91052b removed
0001-riscv-Support-only-RVV-1.0.patch but forgot to remove its
associated autoreconf.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c2f05a81ad)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:05:14 +02:00
Bernd Kuhls
4f0b66e7d7 package/ca-certificates: Replace c_rehash with openssl rehash
The upcoming bump of libopenssl to 4.0.2 removes the c_rehash script:

https://openssl-library.org/post/2026-04-14-openssl-40-final-release/
https://github.com/openssl/openssl/blob/openssl-4.0.2/CHANGES.md#openssl-40

"* Removed `c_rehash` script tool.  Use `openssl rehash` instead."

Note that c_rehash was already described as obsolete in the release
notes for OpenSSL 3.0.2 and 3.0.3.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Cc: Martin Bark <martin@barkynet.com>
[Fiona: add note about how long c_rehash has been considered obsolete]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 97e7c6d82f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:05:08 +02:00
TIAN Yuanhao
902f6c9f37 package/network-manager: set modprobe path to /sbin/modprobe
With -Dmodprobe left empty, meson setup searches /sbin and /usr/sbin
on the host, and if it finds modprobe bakes the path into
MODPROBE_PATH, which may be different from the install path on the
target.

Pass -Dmodprobe=/sbin/modprobe: both busybox's and kmod's modprobe
resolve there; a missing modprobe only costs an error log at runtime.

Signed-off-by: TIAN Yuanhao <tianyuanhao3@163.com>
[Fiona: clarify that only /sbin and /usr/sbin are searched, not $PATH]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit dbb77fc03f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:03:02 +02:00
Yegor Yefremov
dc8e76474f package/erlang: fix build with BR2_TIME_BITS_64
erts/emulator/sys/unix/sys_time.c undefines _FILE_OFFSET_BITS before
including system headers. With BR2_TIME_BITS_64=y, Buildroot passes
-D_TIME_BITS=64, which glibc only accepts together with
_FILE_OFFSET_BITS=64, so the build fails with:

  error: #error "_TIME_BITS=64 is allowed only with _FILE_OFFSET_BITS=64"

Backport the upstream commit that removes this ancient workaround.

Fixes:
https://autobuild.buildroot.org/results/72443d8e794451cbc4063e906d6b2405021cb52f

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b2005938ae)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:01:59 +02:00
Bernd Kuhls
5e4fddd4e8 package/apache: security bump to version 2.4.69
https://downloads.apache.org/httpd/CHANGES_2.4.69

Fixes the following security issues:

  *) SECURITY: CVE-2026-93546: mod_dav_fs namespace overflow
     (cve.mitre.org)
     Integer overflow in mod_dav_fs in Apache HTTP Server through
     2.4.68 allows an authenticated WebDAV client with write access
     to crash worker processes and persistently corrupt a directory's
     property database via PROPPATCH requests declaring many XML
     namespaces.
     Credits: Zhen Kong

  *) SECURITY: CVE-2026-79768: mod_userdir information disclosure
     (cve.mitre.org)
     Path equivalence: '/./' (single dot directory) vulnerability in
     Apache HTTP Server's mod_userdir module when configured
     with absolute non-wildcard UserDir directive (the 2nd form
     in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir
     )
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Vlatko Kosturjak, Marlink Cyber

  *) SECURITY: CVE-2026-73637: mod_auth_digest DoS attack
     (cve.mitre.org)
     Use after free in mod_auth_digest in Apache Software Foundation
     Apache HTTP Server before 2.4.69 on all platforms allows an
     unauthenticated remote client to cause authentication state
     corruption via concurrent Digest authentication requests when
     AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set
     to 0.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Zhen Kong

  *) SECURITY: CVE-2026-73636: mod_auth_digest one-time-nonce replay
     attack (cve.mitre.org)
     Authentication bypass by capture-replay in mod_auth_digest in
     Apache Software Foundation Apache HTTP Server 2.4.x on all
     platforms allows a man-in-the-middle (MITM) attacker to replay
     captured digest authentication credentials via crafted requests
     that trigger garbage collection of the client's shared memory
     entry when AuthDigestNonceLifetime is set to 0.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Hyojae Lee

  *) SECURITY: CVE-2026-63718: mod_proxy_uwsgi Transfer-Encoding
     response smuggling (cve.mitre.org)
     Inconsistent Interpretation of HTTP Requests ('HTTP
     Request/Response Smuggling') response smuggling vulnerability in
     Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi
     response with Transfer-Encoding.
     This issue affects Apache HTTP Server: from 2.4.30 through
     2.4.68.
     Credits: Qing Xu

  *) SECURITY: CVE-2026-63686: mod_xml2enc crash on charset
     conversion failure (cve.mitre.org)
     A NULL pointer dereference in mod_xml2enc in Apache Software
     Foundation Apache HTTP Server before 2.4.69 on all platforms
     allows an untrusted backend server to cause a denial of service
     via a proxied response with a charset whose conversion partially
     succeeds then fails.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-63292: mod_vhost_alias stack overflow
     (cve.mitre.org)
     Stack-based buffer overflow in mod_vhost_alias in Apache
     Software Foundation Apache HTTP Server through 2.4.68 on all
     platforms allows a remote client to cause a denial of service or
     potentially execute arbitrary code via an HTTP request with a
     Host header exceeding 8192 bytes when VirtualDocumentRoot uses a
     hostname format specifier and LimitRequestFieldSize is raised
     above the default.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Hyojae Lee

  *) SECURITY: CVE-2026-63045: mod_proxy_ftp PASV address handling
     (cve.mitre.org)
     Improper validation of FTP PASV reply address in mod_proxy_ftp
     in Apache Software Foundation Apache HTTP Server through 2.4.68
     on all platforms allows, in forward proxy configurations, an
     untrusted FTP server to cause the proxy to open a data
     connection to an arbitrary third-party host via a crafted PASV
     response.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: Zhen Kong

  *) SECURITY: CVE-2026-59797: mod_ssl SSLRequire allows .htaccess
     ap_expr file-function (cve.mitre.org)
     Improper Privilege Management vulnerability in Apache HTTP
     Server's mod_ssl via SSLRequire and file-related expressions.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: kimchunbok

  *) SECURITY: CVE-2026-59685: Out-of-Bounds Write in
     ap_directory_walk() Canonical-Name Rewrite on
     CASE_BLIND_FILESYSTEM (cve.mitre.org)
     Out-of-bounds Write vulnerability in Apache HTTP Server on
     Windows while processing paths with 8.3 names that may grow when
     expanded.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Dhiraj Mishra

  *) SECURITY: CVE-2026-58415: mod_dav_fs property database read
     access (cve.mitre.org)
     Internal state files accessible to external parties in
     mod_dav_fs in Apache Software Foundation Apache HTTP Server
     before 2.4.69 on all platforms allows a remote client to read
     WebDAV dead properties of resources it cannot author via a GET
     request for the .DAV state directory
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: �지웅 (kimchunbok)

  *) SECURITY: CVE-2026-57941: mod_http2 use-after-free / wild write
     via shared session->bbtmp re-entrancy (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server's
     mod_http2Â via shared session->bbtmp re-entrancy
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-56449: mod_proxy_html: crash in dump_content
     (cve.mitre.org)
     Out-of-bounds Write vulnerability in Apache HTTP Server's
     mod_proxy_html with crafted HTTP response bodies.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-56154: mod_rewrite use-after-free via
     %{LA-U:HTTP:...} (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server's mod_rewrite
     when using lookahead (%{LA-U:HTTP:...})
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Nebula Security (@nebusecurity)

  *) SECURITY: CVE-2026-56153: mod_charset_lite: Heap overflow in
     finish_partial_char (cve.mitre.org)
     Out-of-bounds Write vulnerability in Apache HTTP Server's
     mod_charset_lite.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Bartlomiej Dmitruk at striga.ai

  *) SECURITY: CVE-2026-48005: mod_auth_digest reauthentication
     attack (cve.mitre.org)
     Missing authentication checks in mod_auth_digest in Apache
     Software Foundation Apache HTTP Server before 2.4.69 on all
     platforms allows an unauthenticated remote client to cause a
     denial of service (forced re-authentication) via forged
     Authorization headers when Digest authentication is enabled with
     AuthDigestNcCheck .
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue.
     Credits: lokerxx

  *) SECURITY: CVE-2026-47360: mod_session: Session cookie not
     removed during internal redirect (cve.mitre.org)
     Exposure of Sensitive Information to an Unauthorized Actor
     vulnerability in Apache HTTP Server's mod_session_cookie module.
     Â
     When SessionCookieRemove changes across internal redirects, the
     session cookie may still be passed to a backend server.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: lokerxx

  *) SECURITY: CVE-2026-46729: mod_heartmonitor denial of service
     (cve.mitre.org)
     NULL Pointer Dereference vulnerability in Apache HTTP Servers
     mod_heartmonitor over unicast listener.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
     Credits: Zhang San

  *) SECURITY: CVE-2026-42528: mod_dav shared lock overflow
     (cve.mitre.org)
     A memory calculation bug in mod_dav in Apache httpd 2.4.67 and
     earlier allows an attacker with permission to create WebDAV
     locks to crash server child processes.
     Users are recommended to upgrade to version 2.4.69, which fixes
     this issue
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42356: limited RCE for some internal
     redirects to non-CGI files in CGI directories (cve.mitre.org)
     Deployment of wrong handler vulnerability in Apache HTTP Server
     allows the target of some internal redirects from CGI programs
     to also be treated as CGI and executed. The target must already
     be in a directory enabled for CGI and have no other extension
     understood by mod_mime.
     This issue affects Apache HTTP Server: from 2.4.60 through
     2.4.68.
     Credits: Feliks Penconek

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 47dfe84399)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:01:50 +02:00
Fiona Klute (othermo GmbH)
09c50a9f97 package/lvm2: set unconditional dependency with "=", not "+="
This is a simple style fix.

Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d236b45fc4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:01:37 +02:00
Peter Korsgaard
a6fb2719ec docs/manual/common-usage.adoc: correct generate-cyclonedx invocation
Commit e09bf9e951 ("docs/manual: add information on CycloneDX")
unfortunately introduced a typo.  The make target is 'make show-info', not
just 'make show'.

Fix that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit d703573765)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:01:27 +02:00
Raphaël Mélotte
d27b7b9432 support/testing: harfbuzz: new runtime test
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7fccf3a91e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 12:01:17 +02:00
Bernd Kuhls
b73bf11d5f package/python3: security bump version to 3.14.8
https://www.python.org/downloads/release/python-3148/
https://docs.python.org/release/3.14.8/whatsnew/changelog.html

Security content in this releases

CVE-2026-19445 gh-156293
Use-after-free of a server-side SSLContext when sni_callback switches
contexts

CVE-2026-19553 gh-156793
SSLContext.wrap_bio() missing validation of server_hostname parameter

CVE-2026-82049 gh-157190
tarfile extraction filters allow file modification and content
disclosure via hard link to symlink

CVE-2026-15310 gh-156002
Memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression

CVE-2026-19672 gh-155999
tarfile extraction filter bypass allows creation of directories outside
the destination

CVE-2026-15806 gh-155694
urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over
another scheme

CVE-2026-17084 gh-155292
StringPrep algorithm considered Unicode codepoint attributes outside
Unicode 3.2.0

gh-158446
Reject float format precision near INT_MAX

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6e0a068475)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:50:38 +02:00
Bernd Kuhls
5b418e0645 package/libopenssl: security bump to version 3.6.5
https://github.com/openssl/openssl/releases/tag/openssl-3.6.5

This release incorporates the following bug fixes and mitigations:

Fixed DTLS retransmissions of handshake messages from a stale buffer offset.
(CVE-2026-84782)

Fixed excessive memory allocation in relative CRLDP processing.
(CVE-2026-35189)

Fixed QUIC unvalidated amplification credit may be over-accounted.
(CVE-2026-35191)

Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
(CVE-2026-42772)

Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
(CVE-2026-54872)

Fixed QUIC STREAM fragment metadata DoS.
(CVE-2026-54873)

Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.
(CVE-2026-54875)

Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake.
(CVE-2026-72897)

Fixed QUIC connection-level flow control was not enforced for streams.
(CVE-2026-75804)

Fixed a NULL pointer dereference in CMP client revocation response handling.
(CVE-2026-75805)

Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.
(CVE-2026-75806)

Fixed a timing side-channel in SM2 signature generation.
(CVE-2026-77696)

Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack
implementation.
(CVE-2026-84784)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 97a94e01ef)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:50:25 +02:00
Bernd Kuhls
319bbad24c package/pcre2: security bump to version 10.49
https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.49

This is a security-only release, to address GHSA-r9hj-j2rw-4q3m:
https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m

Switched to sha256 tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 99ea0fbb3d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:50:14 +02:00
Bernd Kuhls
c16ecc6494 package/{glibc, localedef}: security bump version to 2.44-55-gc90398e00
Fixes CVE-2026-89092:
c90398e005

Also fix typo in comment.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c71fccc7a9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:48:28 +02:00
Julien Olivain
9800b5d3b4 support/testing: bubblewrap: new runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1ad0796f2b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:48:15 +02:00
Fiona Klute
aacf9c6ad6 package/bubblewrap: fix build failure if kernel uses localversion
Bubblewrap expects the value of the assume_kernel option, if set, to
be exactly three numbers separated by dots, nothing else [1]. If that
requirement is not met configuring the build fails.

Buildroot sets assume_kernel to $(LINUX_VERSION_PROBED) since the
version bump to 0.12.0. However, the expansion of
LINUX_VERSION_PROBED may contain additional suffixes, e.g. if
CONFIG_LOCALVERSION is set, or localversion* files are present (like
in CIP kernels). So filter the version string to ignore any suffixes.

[1] https://github.com/containers/bubblewrap/blob/v0.13.0/meson.build#L94-L104

Fixes: 4cb6193d2e ("package/bubblewrap: security bump to version 0.12.0")
Fixes: https://autobuild.buildroot.org/results/e7513e4730000e46b13bb9cf25955ebd3ec5fb71/

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a2b5b7371b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:47:59 +02:00
John Ernberg
d351d851e4 package/util-linux-libs: Do not install to target
util-linux-libs was introduced as an intermediate package to help break
circular dependencies with util-linux, and therefor only exists to provide
more basic versions of the libraries util-linux provide, to break these
dependency chains.

There is no need to install these to target as they will never be used
there.

Under all circumstances the libraries are built and installed by the main
util-linux package.

This only solves the confict for target, the conflict will remain for
staging as that conflict is much harder to solve.

Cc: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: John Ernberg <j@j-ernberg.se>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 8b57f2f421)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:47:13 +02:00
Francois Perrad
2210953f23 package/wireshark: fix support for lua
Since version 4.4.0 of wireshark, support for Lua 5.3 and 5.4 has been
added, and support for Lua 5.1 and 5.2 has been removed. See
https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html

This fixes an infinite loop during the build, as for some reason when
Lua 5.1 is available, the CMake check for Lua 5.3 or 5.4 loops
indefinitely, with cmake taking up 100% of one CPU core.

Fixes: 49fa20e667 ("package/wireshark: bump to latest upstream stable v4.4.9")
Signed-off-by: Francois Perrad <francois.perrad.86@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c4c6ad81bf)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:28:22 +02:00
Bernd Kuhls
9c1a024d42 package/libopenssl: remove patch 0002
Patch was committed upstream in a slightly different version
0984041283
and was first released in version 3.0 which was added to buildroot with
commit 3c66f65a6a.

Added Upstream: tag to patch 0001.

Renumbered patch 0003 and updated Upstream: tag.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7dab0537a0)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-08 11:28:08 +02:00
Raphaël Mélotte
110319c4a9 {linux, linux-headers}: bump 6.18.x series
Update the latest kernel releases to:
 - 6.18.53 -> 6.18.54

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-01 08:56:03 +02:00