Commit Graph

81542 Commits

Author SHA1 Message Date
Hendrik De Vloed
c8dc265a9f package/sbctl: new package
sbctl intends to be a user-friendly secure boot key manager
capable of setting up secure boot, offer key management
capabilities, and keep track of files that needs to be
signed in the boot chain.

Signed-off-by: Hendrik De Vloed <hendrik.devloed@dekimo.com>
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 20:00:26 +02:00
Franciszek Stachura
aa2d71ac38 support/testing: add memcached test
Add a basic runtime test for memcached. The test starts memcached and
checks if it responds to a basic set/get request.

Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 19:21:34 +02:00
Xukai Wang
b647b0c95d support/testing: add python-gymnasium tests
Add a basic runtime test for the python-gymnasium package.
This test verifies the fundamental operations of the library by:
- Importing `gymnasium`.
- Creating a "CartPole-v1" environment.
- Resetting the environment.
- Taking a random action step.
- Closing the environment.

Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
[Julien:
 - sort DEVELOPERS entries alphabetically
 - fix file name typo in DEVELOPERS
 - remove selection of dependencies in test config
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 12:57:57 +02:00
Xukai Wang
6e6597de21 support/testing: add python-farama-notifications tests
Add a basic runtime test for the python-farama-notifications package.
This test verifies that the `farama_notifications` package can be
imported successfully and that a test notification can be stored
within its `notifications` dictionary-like object.

Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
[Julien:
 - sort DEVELOPERS entries alphabetically
 - remove underscore in test class name
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 12:55:44 +02:00
Xukai Wang
d25f18a3c3 support/testing: add python-cloudpickle tests
Add a basic runtime test for the python-cloudpickle package.
This test verifies the fundamental serialization capabilities of the
library by:
- Importing `cloudpickle`.
- Defining a simple Python function (fibonacci).
- Using `cloudpickle.dumps()` to serialize this function.

Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
[Julien: fix flake8 warnings to fix check-package errors]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 12:30:35 +02:00
Xukai Wang
fb53371286 package/python-gymnasium: new package
Add support for the python-gymnasium package, which provides a
standard API for reinforcement learning and a broad suite of
reference environments. Gymnasium is the maintained successor
to OpenAI Gym, developed by the Farama Foundation.

Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 12:03:28 +02:00
Xukai Wang
6c0ceb48b3 package/python-farama-notifications: new package
Add support for the python-farama-notifications package,
which provides a unified notification mechanism for all
libraries maintained by the FaramaFoundation.

This package is used by Farama projects such as gymnasium
to deliver runtime and deprecation notifications in a
consistent way.

Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 12:03:28 +02:00
Xukai Wang
bdd2384cc2 package/python-cloudpickle: new package
Add support for the python-cloudpickle package, which provides
a Pickler class that extends the standard pickle.Pickler functionality.

This package is required as a dependency for gymnasium and other
machine learning or scientific computing libraries that require
advanced object serialization.

Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-29 12:03:28 +02:00
Vincent Cruz
9624acf9aa package/libnss-ato: new package
The libnss_ato module is a set of C library extensions which allows to
map every nss request for unknown user to a single predefined user.

Signed-off-by: Vincent Jardin <vjardin@free.fr>
Signed-off-by: Vincent Cruz <mooz@blockos.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-28 22:22:13 +01:00
Bernd Kuhls
6561290de5 package/gnu-efi: bump version to 4.0.4
https://github.com/ncroxon/gnu-efi/releases/tag/4.0.1
https://github.com/ncroxon/gnu-efi/releases/tag/4.0.2
https://github.com/ncroxon/gnu-efi/releases/tag/4.0.3
https://github.com/ncroxon/gnu-efi/releases/tag/4.0.4

Removed patch due to upstream commit
f3ececb9eb
which contains a different fix.

Added patch to fix build errors with syslinux:
build/syslinux-6.03/com32/lib/exit.c:57:(.text+0x19):
 undefined reference to `longjmp'
build/syslinux-6.03/com32/lib/sys/module/exec.c:206:(.text+0xdc):
 undefined reference to `setjmp'

LICENSE was clarified and new license files were added in:
71d5d1746b

licenses/LICENSE.efilib was updated in:
71b05279b1

This commit reflects those changes by updating _LICENSE_FILES and
adding the new license hashes.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-28 22:11:35 +01:00
Bernd Kuhls
62c7bd4887 package/fwupd-efi: bump version to 1.8
https://github.com/fwupd/fwupd-efi/releases/tag/1.8

Added TARGET_LD to _MESON_EXTRA_BINARIES due to upstream commit
a7ac71e3b3
which causes a misdetection of the linker used.

Build log without specifying TARGET_LD:

  Program ld.bfd found: YES (/usr/bin/ld.bfd)
  [...]
  /usr/bin/ld.bfd: cannot represent machine `aarch64'

Build log with specifying TARGET_LD:

  Program ld.bfd found: YES

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-28 19:18:35 +01:00
Bernd Kuhls
d848e83a32 package/samba4: bump version to 4.24.0
https://www.samba.org/samba/history/samba-4.24.0.html

Removed patch 0002, its content is included in upstream commit
50604bc027

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-28 12:05:34 +01:00
Vincent Cruz
bcbae423d3 package/rwmem: bump to version 2.0
For more details, see:
https://github.com/tomba/rwmem/compare/c89bc9ad9...2.0

Signed-off-by: Vincent Cruz <mooz@blockos.org>
[Julien: add info in patch "Upstream:" tag]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 22:01:39 +01:00
Alexander Shirokov
3947534566 package/broot: bump to version 1.56.2
Changelog: https://github.com/Canop/broot/blob/v1.56.2/CHANGELOG.md

Signed-off-by: Alexander Shirokov <shirokovalexs@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:57:53 +01:00
Bernd Kuhls
ee1e057343 package/intel-gmmlib: bump version to 22.10.0
https://github.com/intel/gmmlib/releases/tag/intel-gmmlib-22.10.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:54:11 +01:00
Bernd Kuhls
cf77be26be package/intel-vpl-gpu-rt: bump version to 26.1.5
https://github.com/intel/vpl-gpu-rt/releases/tag/intel-onevpl-26.1.5

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:54:11 +01:00
Bernd Kuhls
84d5e144d7 package/intel-mediadriver: bump version to 26.1.5
https://github.com/intel/media-driver/releases/tag/intel-media-26.1.5

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:54:11 +01:00
Bernd Kuhls
70e794a3dd package/jpeg-turbo: bump version to 3.1.4
https://github.com/libjpeg-turbo/libjpeg-turbo/blob/3.1.4/ChangeLog.md

Updated license hash due to copyright year bump:
e9b497016c
e82016c6bf

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:50:23 +01:00
Bernd Kuhls
729125a67f {linux, linux-headers}: bump 6.{1, 6, 12, 18, 19}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:39:48 +01:00
Bernd Kuhls
422c1af1cd package/llvm-project: bump version to 22.1.2
https://discourse.llvm.org/t/llvm-22-1-2-released/90308

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:34:54 +01:00
Bernd Kuhls
2c183f8b72 package/ccache: bump version to 4.13.2
https://ccache.dev/releasenotes.html#_ccache_4_13_2

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:21:02 +01:00
Shubham Chakraborty
6bac6a1a63 DEVELOPERS: add Shubham Chakraborty as ccache maintainer
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: add trailing slash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 21:20:52 +01:00
Peter Korsgaard
6e4a136363 package/rauc: security bump to version 1.15.2
Fixes the following security issue:

CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB

RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB
cause an integer overflow which results in a signature which covers only the
first few bytes of the payload.  Given such a bundle with a legitimate
signature, an attacker can modify the part of the payload which is not
covered by the signature.

Bundles using the recommended 'verity' or 'crypt' formats are not affected.

For more details, see the advisory:
https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx

https://github.com/rauc/rauc/releases/tag/v1.15.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 19:58:25 +01:00
Bernd Kuhls
22e4440eae package/libpng: security bump to version 1.6.56
Fixes the following security vulnerabilities:

CVE-2026-33416 (high):
Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.

CVE-2026-33636 (high):
Out-of-bounds read/write in the palette expansion on ARM Neon.

For more details, see the advisories:
https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j
https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2

Release notes:
https://github.com/pnggroup/libpng/blob/v1.6.56/ANNOUNCE

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 19:52:39 +01:00
Bernd Kuhls
ef01d4fc78 package/{glibc, localedef}: security bump to version 2.43-17-gdd9945c0b
Fixes CVE-2026-4437:
https://sourceware.org/git/?p=glibc.git;a=commit;h=5c6fca0c62ce5bd6e68e259f138097756cbafd4d

Fixes CVE-2026-4438:
https://sourceware.org/git/?p=glibc.git;a=commit;h=dd9945c0ba40d2dbc9eb7c99291ba6b69bd66718

For a full list of changes, see:
https://sourceware.org/git/?p=glibc.git;a=shortlog;h=dd9945c0ba40d2dbc9eb7c99291ba6b69bd66718

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add CVE-2026-443{7,8} to GLIBC_IGNORE_CVES]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 19:47:20 +01:00
Bernd Kuhls
a9a4d0a7a5 package/freetype: security bump version to 2.14.3
https://sourceforge.net/projects/freetype/files/freetype2/2.14.3/
"- A bunch of potential security problems have been found.  All users
 should update."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 19:23:53 +01:00
Bernd Kuhls
f359f665be package/tor: security bump version to 0.4.9.6
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.6/ReleaseNotes

Fixes TROVE-2026-003 & TROVE-2026-004. See:
https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/TROVE

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to TROVE page]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-27 19:19:40 +01:00
Titouan Christophe
0ce674c244 SECURITY.md: add new file
This is an in-tree description of Buildroot's security policies

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-26 21:07:00 +01:00
Titouan Christophe
a667cbe134 docs/website: add security contact information on the homepage
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-26 21:07:00 +01:00
Thomas Perale
4749b83e59 website/sponsors.html: add IPComm as a silver sponsor
IPCOMM GmbH is a German company that develop industrial gateways and
inter-network communication solutions.

They agreed to sponsor the LTS maintenance for 2026. We thanks them for
their contribution.

 - https://www.ipcomm.de/
 - https://www.ipcomm.de/article/AboutUs/en/sheet.html

For more informations about the LTS sponsorship, see:

 - https://buildroot.org/lts.html

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-26 20:36:06 +01:00
Thomas Perale
aef30aadfc website/sponsors.html: use higher resolution img
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-26 20:36:06 +01:00
Thomas Perale
b20972e0df website/sponsors.html: move sense to past sponsor
Sense is no longer sponsoring LTS for the year 2026.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-26 20:36:06 +01:00
Thomas Perale
1a2037d2b8 website/sponsors.html: use flexbox for sponsor grid
To avoid having to move all the sponsors through the bootstrap 'row'
when adding a new "past sponsor" on top of the current stack, this
commit make the card rely on flexboxes instead of the bootstrap
internals.

This make sure that the body of the card always fit the row height and
the also make sure that the image always fit properly without having to
touch the inline css.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-26 20:36:06 +01:00
Giulio Benetti
35e86cef16 package/libnss: bump version to 3.122
For release note, see:
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_122.html

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-25 21:25:28 +01:00
Julien Olivain
9d29863c5e support/testing: ndctl: new runtime test
Cc: Chen Pei <cp0613@linux.alibaba.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-25 21:12:20 +01:00
Giulio Benetti
0fa55218f4 package/bind: security bump to version 9.18.47
Release notes:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.47/doc/arm/html/changelog.html

Fixes CVE-2026-1519.

Fixes bug:
GL #5708
https://gitlab.isc.org/isc-projects/bind9/-/issues/5708

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-25 21:04:07 +01:00
Mattias Walström
7d26ff6c14 package/nghttp2: security bump to 1.68.1
For changelog, see:
https://github.com/nghttp2/nghttp2/releases/tag/v1.68.1

Fixes:
CVE-2026-27135:
nghttp2 Denial of service: Assertion failure due to the missing
state validation:
https://www.cve.org/CVERecord?id=CVE-2026-27135

Signed-off-by: Mattias Walström <lazzer@gmail.com>
[Julien: add links to changelog and CVE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-25 20:56:21 +01:00
Thomas Perale
50eca46e35 website/lts: fix typos
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-24 22:14:51 +01:00
Thomas Perale
e28b94d008 website/lts: add pre-filled content to mailto
Clicking on the mailto tag will prefill the email with the following
content:

> Thanks for showing interest in the Buildroot LTS Sponsorship. We would
> appreciate if you could introduce yourself and your company by
> answering the following questions: in which products do you use
> Buildroot ? How are you using Buildroot ? How many different
> configurations do you have ? How long do you support your products ?

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-24 22:14:51 +01:00
Thomas Perale
e656b8b639 website/lts: fix section on small screens
Make the section header take the whole screen size for device with a
small screen (mobile phones).

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-24 22:14:51 +01:00
Thomas Perale
b4889d8b1c website/lts: remove the href on section
We have received report from people about the section pointer that makes
them want to click on the "Sponsor Now !" section.

The original idea was to be able to link sub-section but let's make this
section is not clickable instead.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-24 22:14:51 +01:00
Vincent Stehlé
d18f7e0916 boot/edk2: fix build with host gcc >= 15, glibc >= 2.43
The edk2 package fails to build with gcc 15, with the following error:

  EfiRom.c:78:17: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]

Cherry-pick one patch from edk2-stable202602 to fix this.

This can be verified with the tests.boot.test_edk2 python tests.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
[Julien: add "host" gcc 15 and glibc 2.43 in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-24 21:57:56 +01:00
Manuel Diener
c8dd9e9a01 package/python-django: security bump to 6.0.3
Fixes the following security issues:

CVE-2026-25673 (moderate):
Potential denial-of-service vulnerability in URLField via Unicode
normalization on Windows
https://www.cve.org/CVERecord?id=CVE-2026-25673

CVE-2026-25674 (low): Potential incorrect permissions on newly
created file system objects
https://www.cve.org/CVERecord?id=CVE-2026-25674

See the release notes here:
https://docs.djangoproject.com/en/6.0/releases/6.0.3/

This commit also fixes the license hash file
django/contrib/gis/measure.py, after whitespace cleanup:
090f1da56e (diff-eb11d321d233226d88aeffc485fb6c318a06e807feb1574d80a92a7d6a1461a2)

Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
[Julien: fix license hash for django/contrib/gis/measure.py]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-24 12:11:14 +01:00
Flaviu Nistor
1332aaade4 package/python-smmap2: bump to version 5.0.3
For release notes, see:
https://github.com/gitpython-developers/smmap/releases/tag/v5.0.3

Signed-off-by: Flaviu Nistor <flaviu.nistor@gmail.com>
[Julien: add link to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-23 21:34:54 +01:00
Giulio Benetti
e8a567043d package/libnss: bump version to 3.121
For release note, see:
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_121.html

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-23 21:29:08 +01:00
Giulio Benetti
dd75f2f6a0 package/libfuse3: bump to version 3.18.2
Release notes:
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-23 21:22:32 +01:00
Bernd Kuhls
cf9a58b042 package/openblas: fix build
Buildroot commit b08ac7636d bumped the
package to version 0.3.31 and introduced a build error

linktest.c:(.text.startup+0x6f4):
 undefined reference to `openblas_set_threads_callback_function'

which according to https://github.com/OpenMathLib/OpenBLAS/issues/5607
was introduced by upstream commit
879497990f
that was first included in version 0.3.31.

This patch adds another upstream commit to fix the problem.

Fixes:
https://autobuild.buildroot.net/results/7d8/7d80a912ddda01acd109786641df02ad826399f6/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-23 21:16:04 +01:00
Waldemar Brodkorb
8937414d68 package/ruby: bump to 4.0.2
See here for news in the release:
https://www.ruby-lang.org/en/news/2026/03/16/ruby-4-0-2-released/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-23 21:01:57 +01:00
Waldemar Brodkorb
83386ecb9c DEVELOPERS: remove Waldemar Brodkorb from zabbix
I am no longer interested in zabbix.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-23 21:00:46 +01:00
Waldemar Brodkorb
84ece21e84 package/asterisk: security bump to 22.8.2
See here for detailed changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html

Fixes the following CVEs:

CVE-2026-23739 / GHSA-85x7-54wr-vh42:
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential
XXE Injection
https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42
https://www.cve.org/CVERecord?id=CVE-2026-23739

CVE-2026-23741 / GHSA-rvch-3jmx-3jf3:
ast_coredumper running as root sources ast_debug_tools.conf from
/etc/asterisk; potentially leading to privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3
https://www.cve.org/CVERecord?id=CVE-2026-23741

CVE-2026-23738 / GHSA-v6hp-wh3r-cwxh:
The Asterisk embedded web server's /httpstatus page echos user
supplied values(cookie and query string) without sanitization
https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh
https://www.cve.org/CVERecord?id=CVE-2026-23738

CVE-2026-23740 / GHSA-xpc6-x892-v83c:
ast_coredumper runs as root, and writes gdb init file to world
writeable folder; leading to potential privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c
https://www.cve.org/CVERecord?id=CVE-2026-23740

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: add CVE details in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-23 20:51:38 +01:00