Commit Graph

59058 Commits

Author SHA1 Message Date
Fabrice Fontaine
d32e40af5a package/unixodbc: add UNIXODBC_CPE_ID_VENDOR
cpe:2.3:a:unixodbc:unixodbc is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aunixodbc%3Aunixodbc

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 764176324e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:19:17 +01:00
Fabrice Fontaine
c9f21979ea package/unrar: add UNRAR_CPE_ID_VENDOR
cpe:2.3:a:rarlab:unrar is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ararlab%3Aunrar

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ba9ca16b33)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:19:12 +01:00
Fabrice Fontaine
9627432a07 package/util-linux/util-linux-libs: add CPE variables
cpe:2.3:a:kernel:util-linux is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Akernel%3Autil-linux

Inherit the values from util-linux; they really are, and have to be,
the same.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: inherit values from util-linux]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bfe518b068)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:18:46 +01:00
Yann E. MORIN
b8e05059ca core/show-info: 'name' only applies to packages
Commit 0cfa165948 (package/pkg-utils.mk: introduce "name" field in
show-info output) did what it said, but did so in the generic show-info
part, thus it was also added to filesystems (rootfs), the other kind of
entity that show-info reports on.

Only packages have a "name"; filesystems do not. Instead, they already
have an 'image_name'.

Move the 'name' field to the package-related part of show-info.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 471ecea5ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:15:37 +01:00
Yann E. MORIN
8fef27a520 Makefile: really comment syntax colouring
The unmatched escaped single-quote lies in the middle of a few
function calls, so they too must be fake-closed to properly fix
colour highlighting in some editors.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit cba51c7f5a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:14:49 +01:00
Yann E. MORIN
7954aa6e60 core/pkg-generic: also list files installed in images/
Some packages install nothing in target nor staging, but install images
(like the kernel vmlinux, or a bootloader boot blob...)

If we want to appropriately account for the files installed by each
package, we also need to take images/ into account.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5d00fecb7d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:13:25 +01:00
Yann E. MORIN
c63dcc4579 support/dependencies: avoid spurious warning on print-vars
When calling 'printvars', the 'suitable-host-package' macro is printed
(a macro is just a variable like the others, after all, just with some
parameters). Because it is printed as a variable, it is missing its
parameters, but it still tries to evaluate the $(shell) construct.

This causes spurious warning:

    make[1]: support/dependencies/check-host-.sh: Command not found

Only try and call the script if there is actually a tool to check for.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 77304e5143)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:12:50 +01:00
Yann E. MORIN
be8b42242b package/kodi-*: run pkg-config at build time, not at parse time
When calling 'printvars' on a just-configured tree, the output contains
many spurious warnings about pkg-config being not found:

    make[1]: [...]/host/bin/pkg-config: Command not found

This is partly because a few packages call pkg-config at the time the
Makefile is parsed (really, right when make evaluates the recipe before
executing it).

It is customary, instead, to defer the call to pkg-config to the actual
shell running the recipe's commands, like all our other packages do.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 22fb4c469b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:11:57 +01:00
Yann E. MORIN
745a763e43 core/show-info: report build_dir relative to CONFIG_DIR
Currently, the build_dir field is reported relative to $(BASE_DIR), to
avoid leaking local paths.

However, BASE_DIR is not a directory that is very convenient: for
in-tree builds, it is $(CONFIG_DIR)/output/, while for out-of-tree
builds, it is $(CONFIG_DIR). This difference is purely an idiosyncracy
of how out-of-tree builds have been implemented in Buildroot, and is
not under the control of the user.

What the user is in control of, however, is where the .config file is
located. This, really, is the directory we should base relative paths
on.

Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 76c4df324d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:08:37 +01:00
Fabrice Fontaine
72f37850f6 package/janus-gateway: fix CVE-2021-4020
Fix CVE-2021-4020: janus-gateway is vulnerable to Improper
Neutralization of Input During Web Page Generation ('Cross-site
Scripting')

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 99d2826e03)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:03:45 +01:00
Fabrice Fontaine
7847cf3b47 Revert "package/coreutils: ignore CVE-2013-0221, CVE-2013-0222, CVE-2013-0223"
This reverts commit 8ae9156d8b as those
CVEs are not tagged as affecting gnu:coreutils in NVD NIST database but
opensuse:opensuse and redhat:entreprise_linux:
- https://nvd.nist.gov/vuln/detail/CVE-2013-0221
- https://nvd.nist.gov/vuln/detail/CVE-2013-0222
- https://nvd.nist.gov/vuln/detail/CVE-2013-0223

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7d569f5191)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:33:47 +01:00
Fabrice Fontaine
7f7331aa9e package/netdata: add NETDATA_CPE_ID_VENDOR
cpe:2.3:a:netdata:netdata is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Anetdata%3Anetdata

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 349159c439)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:32:28 +01:00
Fabrice Fontaine
0306d434cd package/mxml: add CPE variables
cpe:2.3:a:mini-xml_project:mini-xml is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amini-xml_project%3Amini-xml

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2d2888c7c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:32:27 +01:00
Fabrice Fontaine
9232f63cb4 package/motion: add MOTION_CPE_ID_VENDOR
cpe:2.3:a:motion_project:motion is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amotion_project%3Amotion

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d5d5d55933)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:31:20 +01:00
Fabrice Fontaine
bf3f02468a package/libnspr: add CPE variables
cpe:2.3:a:mozilla:netscape_portable_runtime is a valid CPE identifier
for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amozilla%3Anetscape_portable_runtime

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fffd2aade6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:30:40 +01:00
Fabrice Fontaine
816abf861c package/libhtp: add LIBHTP_CPE_ID_VENDOR
cpe:2.3:a:oisf:libhtp is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aoisf%3Alibhtp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 44048a09c8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:30:14 +01:00
Fabrice Fontaine
401fceef78 package/libgdiplus: add LIBGDIPLUS_CPE_ID_VENDOR
cpe:2.3:a:mono-project:libgdiplus is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amono-project%3Alibgdiplus

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 68e1a88ab9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:30:12 +01:00
Fabrice Fontaine
23e66a3ffc package/libffi: add LIBFFI_CPE_ID_VENDOR
cpe:2.3:a:libffi_project:libffi is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alibffi_project%3Alibffi

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 72125334ba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:29:22 +01:00
Fabrice Fontaine
1de5bcd1c8 package/libbson: add LIBBSON_CPE_ID_VENDOR
cpe:2.3:a:mongodb:libbson is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amongodb%3Alibbson

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8d23efce28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:29:10 +01:00
Fabrice Fontaine
57902ef875 package/guile: add GUILE_CPE_ID_VENDOR
cpe:2.3:a:gnu:guile is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Aguile

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7e649e705a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:28:32 +01:00
Fabrice Fontaine
ebe04fd26e package/gupnp: add GUPNP_CPE_ID_VENDOR
cpe:2.3:a:gnome:gupnp is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnome%3Agupnp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6c3122b85a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:28:30 +01:00
Fabrice Fontaine
3c1c80fc24 package/freeswitch: add FREESWITCH_CPE_ID_VENDOR
cpe:2.3:a:freeswitch:freeswitch is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Afreeswitch%3Afreeswitch

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: move after license files]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6739071d31)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:27:32 +01:00
Fabrice Fontaine
32bf2b9aca package/lynx: add LYNX_CPE_ID_VENDOR
cpe:2.3:a:lynx_project:lynx is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alynx_project%3Alynx

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e259d0d8b2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:27:25 +01:00
Fabrice Fontaine
4d545c7f94 package/libnss: add CPE variables
cpe:2.3:a:mozilla:nss is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amozilla%3Anss

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 47f3f8a1c8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:26:45 +01:00
Fabrice Fontaine
fd4cd6b325 package/gstreamer1/gstreamer1: fix girdir
As already done for libglib2 in commit
b094f88a4d, fix girdir to avoid the
following build failure with gst1-plugins-base and introspection:

/home/giuliobenetti/autobuild/run/instance-3/output-1/host/riscv32-buildroot-linux-gnu/sysroot/usr/bin/g-ir-compiler gst-libs/gst/tag/GstTag-1.0.gir --output gst-libs/gst/tag/GstTag-1.0.typelib --includedir=/usr/share/gir-1.0
Could not find GIR file 'Gst-1.0.gir'; check XDG_DATA_DIRS or use --includedir

Fixes:
 - http://autobuild.buildroot.org/results/d1e2bdde97777ff61c185d375ba412a93e7ca467

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ff420a3195)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:26:08 +01:00
Peter Korsgaard
1de800293b package/icu: backport upstream security fix for CVE-2021-30535
Fixes CVE-2021-30535: Double free in ICU in Google Chrome prior to
91.0.4472.77 allowed a remote attacker to potentially exploit heap
corruption via a crafted HTML page.

https://nvd.nist.gov/vuln/detail/CVE-2021-30535

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f4483f1aab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 15:17:22 +01:00
Peter Korsgaard
c519f86610 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 10, 15}.x series
5.14.x is EOL, so no more updates for that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 64cb922db7)
[Peter: drop 5.15.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 15:06:48 +01:00
Peter Korsgaard
bad5728c98 package/libnss: security bump to version 3.68.1
Fixes the following security issue:

- CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS
  DER-encoded signatures

For more details, see the advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 13:26:37 +01:00
Fabrice Fontaine
531fbbd645 package/samba4: drop third patch
Drop third patch as it is not needed when using compile_et from heimdal
instead of compile_et from e2fprogs as spotted by upstream in:
https://bugzilla.samba.org/show_bug.cgi?id=13856#c20

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5847208213)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 11:49:49 +01:00
Fabrice Fontaine
5e628e4ea1 package/heimdal: install compile_et
compile_et is not installed anymore by heimdal since version 7.0.1 and
e40ef47b57

So remove the broken symlink and install it manually as it is needed for
samba4 because compile_et provided by e2fsprogs raises a build failure

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 30107f026e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 11:49:42 +01:00
Fabrice Fontaine
92309ec38c package/e2fsprogs: don't install compile_et
Don't install compile_et as it raises the following build failure with
samba4 since, at least, bump to version 4.14.7 in commit
630e85f8f5:

source4/heimdal/lib/asn1/asn1_err.c:47:23: error: 'link' redeclared as different kind of symbol
   47 | static struct et_list link = { 0, 0 };
      |                       ^~~~
In file included from /home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/bits/sigstksz.h:24,
                 from /home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/signal.h:328,
                 from /home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/sys/param.h:28,
                 from ../../lib/replace/../replace/replace.h:659,
                 from ../../source4/heimdal_build/config.h:10,
                 from source4/heimdal/lib/asn1/asn1_err.c:1:
/home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/unistd.h:819:12: note: previous declaration of 'link' was here
  819 | extern int link (const char *__from, const char *__to)
      |            ^~~~

Fixes:
 - http://autobuild.buildroot.org/results/d6de6ed59c553f6f413d280f3c65184945bb3850

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dd89074e83)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 11:48:28 +01:00
Fabrice Fontaine
c795b817a9 package/wireshark: fix build failure with -latomic
Fix the following build failure raised since bump to version 3.4.10 in
commit 0ce776942d:

/usr/bin/ld: cannot find /usr/lib64/libatomic.so.1.0.0
collect2: error: ld returned 1 exit status
make[3]: *** [run/lemon] Error 1

Fixes:
 - http://autobuild.buildroot.org/results/02ea7d76a683b039fb37e005578644108bd1e3b7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 76e66240da)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 00:06:50 +01:00
Urja Rannikko
b3f998b38a boot/syslinux: define OBJCOPY and AS
This fixes build on an ARM64 host (and I assume also
other non-x86).

Signed-off-by: Urja Rannikko <urjaman@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e938419bd9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 00:05:49 +01:00
Fabrice Fontaine
8d83d809d0 package/libglib2: update fourth patch
Update fourth patch to add girdir in gio-2.0.pc. This will fix the
following build failure with libnice raised since commit
aade2fd293:

/home/giuliobenetti/autobuild/run/instance-3/output-1/host/riscv32-buildroot-linux-gnu/sysroot/usr/bin/g-ir-compiler nice/Nice-0.1.gir --output nice/Nice-0.1.typelib --includedir=/usr/share/gir-1.0
Could not find GIR file 'GObject-2.0.gir'; check XDG_DATA_DIRS or use --includedir

Fixes:
 - http://autobuild.buildroot.org/results/3088ef32b03e0bb984291b1227b187f1ff816eb7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2c916b400b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 00:03:22 +01:00
Fabrice Fontaine
86fae02128 package/vim: security bump to version 8.2.3690
- Fix CVE-2021-3973: vim is vulnerable to Heap-based Buffer Overflow
- Fix CVE-2021-3974: vim is vulnerable to Use After Free
- Fix CVE-2021-3968: vim is vulnerable to Heap-based Buffer Overflow

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5377ff1933)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:59:39 +01:00
Romain Naour
ae09da4d04 .gitlab-ci.yml: use the Docker image from gitlab registry
From [1]:
"In November 2020, Docker introduced rate limits on pull requests from
Docker Hub [2]. If your GitLab CI/CD configuration uses an image from
Docker Hub, each time a job runs, it may count as a pull request."

Since then, some jobs in our gitlab-ci fail when this rate limits is
reached [3].

To avoid this rate limit, move our Docker image from dockerhub to the
registry provided by gitlab. Keeping the image from dockerhub would be
possible by using dependency proxy [4] but the gitlab registry is good
enough.

Tested on gitlab:
https://gitlab.com/kubu93/buildroot/-/jobs/1694863584

[1] https://docs.gitlab.com/ee/user/packages/container_registry/index.html
[2] https://docs.docker.com/docker-hub/download-rate-limit/
[3] https://gitlab.com/buildroot.org/buildroot/-/jobs/1687590417
[4] https://docs.gitlab.com/ee/user/packages/dependency_proxy

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b3b4e270d1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:58:43 +01:00
Yann E. MORIN
c574f15e19 support/docker: drop use of Docker hub, use Gitlab registry
Now that our pipelines are using the Docker image from the Gitlab
registry, there is no longer any reason to push the image to the
Docker hub.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 37004bde66)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:55:44 +01:00
Yann E. MORIN
168e25719d support/docker: don't use sudo to build
On a properly setup machine, it is totally useless to use sudo to run
docker; it is very bad practice. Instead, users really should add
themselves to the docker group.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9f6a2dbe03)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:42:17 +01:00
Fabrice Fontaine
e8b450d677 package/pure-ftpd: fix CVE-2021-40524
In Pure-FTPd 1.0.49, an incorrect max_filesize quota mechanism in the
server allows attackers to upload files of unbounded size, which may
lead to denial of service or a server hang. This occurs because a
certain greater-than-zero test does not anticipate an initial -1 value.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4fd5d8df2a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:40:21 +01:00
Fabrice Fontaine
b6b41ac615 package/libmodsecurity: security bump to version 3.0.6
Support configurable limit on depth of JSON parsing (possible DoS issue)

https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d317b76458)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:39:03 +01:00
Fabrice Fontaine
a928e088d0 package/wireshark: security bump to version 3.4.10
Fix the following security issues:
- https://www.wireshark.org/security/wnpa-sec-2021-07.html
  (CVE-2021-39929)
- https://www.wireshark.org/security/wnpa-sec-2021-08.html
  (CVE-2021-39926)
- https://www.wireshark.org/security/wnpa-sec-2021-09.html
  (CVE-2021-39925)
- https://www.wireshark.org/security/wnpa-sec-2021-10.html
  (CVE-2021-39924)
- https://www.wireshark.org/security/wnpa-sec-2021-11.html
- https://www.wireshark.org/security/wnpa-sec-2021-12.html
  (CVE-2021-39922)
- https://www.wireshark.org/security/wnpa-sec-2021-13.html
  (CVE-2021-39928)
- https://www.wireshark.org/security/wnpa-sec-2021-14.html
  (CVE-2021-39921)
- https://www.wireshark.org/security/wnpa-sec-2021-15.html
  (CVE-2021-39920)

Drop WIRESHARK_BUILD_LEMON_TOOL and set LEMON_C_COMPILER which is
available since
61e66c37ab

https://www.wireshark.org/docs/relnotes/wireshark-3.4.10.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0ce776942d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:37:29 +01:00
Fabrice Fontaine
117e8a460d package/gmp: fix CVE-2021-43618
GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an
mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted
input, leading to a segmentation fault on 32-bit platforms.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9d0536d82d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:35:55 +01:00
Peter Korsgaard
f86b3d0b1f {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 10, 14, 15}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ad2b4b8cc7)
[Peter: drop 5.14.x / 5.15.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:25:37 +01:00
Maxim Kochetkov
c17667e6cc package/libosmium: bump version to 2.17.1
Changelog: https://github.com/osmcode/libosmium/releases/tag/v2.17.1

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e49fa6631b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 18:31:30 +01:00
Fabrice Fontaine
27b09e3cc4 package/libgee: fix introspection build
Fix the following build failure raised since the addition of
introspection in commit 3915e17e77:

/home/giuliobenetti/autobuild/run/instance-1/output-1/host/bin/../riscv32-buildroot-linux-gnu/sysroot/usr/bin/g-ir-compiler -l `/usr/bin/sed -nE "s/^dlname='([A-Za-z0-9.+-]+)'/\1/p" libgee-0.8.la` -o Gee-0.8.typelib Gee-0.8.gir libgee-0.8.la
Could not find GIR file 'GObject-2.0.gir'; check XDG_DATA_DIRS or use --includedir
error parsing file Gee-0.8.gir: Failed to parse included gir GObject-2.0

Fixes:
 - http://autobuild.buildroot.org/results/884faa0f84c8dc43ed1ca6cde9caf21c731a4b35

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a4bf020e8c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 18:27:36 +01:00
Fabrice Fontaine
c618303de0 package/gdb: fix NLS build
Fix the following build failure raised since version 10.1 and
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=9a665d62266e75f0519f3a663784c458885b5c63:

  CXXLD  libinproctrace.so
/home/buildroot/autobuild/instance-2/output-1/host/opt/ext-toolchain/bin/../lib/gcc/i586-buildroot-linux-musl/9.3.0/../../../../i586-buildroot-linux-musl/bin/ld: gdbsupport/tdesc-ipa.o: in function `print_xml_feature::visit(tdesc_type_builtin const*)':
/home/buildroot/autobuild/instance-2/output-1/build/gdb-10.2/build/gdbserver/../../gdbserver/../gdbsupport/tdesc.cc:310: undefined reference to `libintl_gettext'

Fixes:
 - http://autobuild.buildroot.org/results/faacc874fe9d32b74cb3d3dea988ef661cb0e3d0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 2da1267c1e)
[Peter: drop 11.1 patch]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 08:45:34 +01:00
Sébastien Szymanski
0e4c8db58e linux: fix typo in BR2_LINUX_KERNEL_CUSTOM_DTS_PATH in the help text
"Path to to out-of-tree..." -> "Path to the out-of-tree..."

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8f3e2a6678)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-10 23:05:31 +01:00
Titouan Christophe
2205f813ce package/mosquitto: bump to v2.0.14
This is a small bugfix release, read the announcement on
https://mosquitto.org/blog/2021/11/version-2-0-14-released/

Signed-off-by: Titouan Christophe <titouanchristophe@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 98372c5444)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-10 23:04:49 +01:00
Fabrice Fontaine
cbffaa5bbb package/nfs-utils: set CONFIG_NFSD
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=14346

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8d44cbc834)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-10 23:04:26 +01:00
Yann E. MORIN
c6ac525de6 boot/uboot: kconfig needs the toolchain
Starting with uboot 2021.10, with upstream commit 473fc279c89 (kconfig /
kbuild: Re-sync with Linux 4.20), the kconfig in uboot now needs the
compiler to detect its features.

Like was done for linux in 3fc990a798 (linux: kconfig needs the
toolchain) and barebox in 1c1a629d81 (boot/barebox: kconfig needs the
toolchain), add the toolchain to the kconfig dependencies of uboot.

Reported-by: Davian on IRC
Reported-by: Xogium on IRC
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c224e7e5c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-10 23:02:58 +01:00