Fixes the following vulnerabilities:
- CVE-2025-61728: archive/zip: denial of service when parsing arbitrary ZIP
archives
archive/zip used a super-linear file name indexing algorithm that is
invoked the first time a file in an archive is opened. This can lead to a
denial of service when consuming a maliciously constructed ZIP archive.
- CVE-2025-61726: net/http: memory exhaustion in Request.ParseForm
When parsing a URL-encoded form net/http may allocate an unexpected amount
of memory when provided a large number of key-value pairs. This can
result in a denial of service due to memory exhaustion.
- CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated
session ticket keys, session resumption does not account for the
expiration of full certificate chain
The Config.Clone methods allows cloning a Config which has already been
passed to a TLS function, allowing it to be mutated and reused.
If Config.SessionTicketKey has not been set, and
Config.SetSessionTicketKeys has not been called, crypto/tls will generate
random session ticket keys and automatically rotate them. Config.Clone
would copy these automatically generated keys into the returned Config,
meaning that the two Configs would share session ticket keys, allowing
sessions created using one Config could be used to resume sessions with
the other Config. This can allow clients to resume sessions even though
the Config may be configured such that they should not be able to do so.
- CVE-2025-61731: cmd/go: unexpected code execution when invoking toolchain
The Go toolchain supports multiple VCS which are used retrieving modules
and embedding build information into binaries.
On systems with Mercurial installed (hg) downloading modules (e.g. via go
get or go mod download) from non-standard sources (e.g. custom domains)
can cause unexpected code execution due to how external VCS commands are
constructed.
On systems with Git installed, downloading and building modules with
malicious version strings could allow an attacker to write to arbitrary
files on the system the user has access to. This can only be triggered by
explicitly providing the malicious version strings to the toolchain, and
does not affect usage of @latest or bare module paths.
The toolchain now uses safer VCS options to prevent misinterpretation of
untrusted inputs. In addition, the toolchain now disallows module version
strings prefixed with a "-" or "/" character.
- CVE-2025-61730: crypto/tls: handshake messages may be processed at the
incorrect encryption level
During the TLS 1.3 handshake if multiple messages are sent in records that
span encryption level boundaries (for instance the Client Hello and
Encrypted Extensions messages), the subsequent messages may be processed
before the encryption level changes. This can cause some minor
information disclosure if a network-local attacker can inject messages
during the handshake.
For details, see the announcement:
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22137df16b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
For relase notes, see:
https://go.dev/doc/devel/release#go1.25.0
Building Go 1.24 and later requires Go 1.22.6 or later for bootstrap.
To support this we use our previous Go version 1.23.12 as the version
for go-bootstrap-stage4 and have the build for Go 1.25.1 depend on
go-bootstrap-stage4.
Go version 1.23.12 is the latest go version we can build using
go-bootstrap-stage3.
The package build for go-bootstrap-stage4 if effectively identical to
go-bootstrap-stage3 with only the Go version and stage number changed.
Note: go version 1.25.1 release note mention a security fix
which is for CVE-2025-47910. This commit is not marked as security
bump, because the issue was introduced in version 1.25.0 which
was not included in Buildroot. See:
https://pkg.go.dev/vuln/GO-2025-3955
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Tested-by: Christian Stewart <christian@aperture.us>
[Julien: add link to release notes and
comment about CVE in commit log.
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ecf12c186f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2025-6020:
A flaw was found in linux-pam. The module pam_namespace may use access
user-controlled paths without proper protection, allowing local users
to elevate their privileges to root via multiple symlink attacks and
race conditions.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-6020
This fix was backported based on the work of the OpenEmbedded
community. See the link to the original patches in the patch header.
(cherry picked from 30e38505e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes: https://www.php.net/ChangeLog-8.php#8.3.31
- CVE-2025-14179:
In PHP versions, the PDO Firebird driver improperly handles NUL
bytes when preparing SQL queries. During token-by-token query
construction, a string token containing a NUL byte is copied via
strncat(), which stops at the NUL byte, dropping the closing quote
and causing subsequent SQL tokens to be interpreted as part of the
string.
This allows SQL injection when attacker-controlled values are quoted
via PDO::quote() and embedded in SQL statements.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
- https://www.cve.org/CVERecord?id=CVE-2025-14179
- CVE-2026-6722:
In PHP versions, the SOAP extension's object deduplication mechanism
stores pointers to PHP objects in a global map without incrementing
their reference counts. When an apache:Map node contains duplicate
keys, processing the second entry overwrites the first in the
temporary result map, freeing the original PHP object while its
stale pointer remains in the map. A subsequent href reference to the
freed node can copy the dangling pointer into the result. As PHP
string allocations can reclaim the freed memory region, an attacker
with control over the SOAP request body can exploit this
use-after-free to achieve remote code execution.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
- https://www.cve.org/CVERecord?id=CVE-2026-6722
- CVE-2026-6735:
In PHP, due to improper sanitation of user data, it allows an
attacker to compose an URL, which will cause the target to execute
arbitrary JavaScript code (XSS) on the target's machine when the
target is viewing the PHP-FPM status page.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv
- https://www.cve.org/CVERecord?id=CVE-2026-6735
- CVE-2026-7258:
In PHP, some functions, including urldecode(), pass signed char to
ctype functions (like isxdigit()). On the systems with default
signed char and optimized table-lookup ctype functions - such as
NetBSD - this can lead to accessing array with negative offset,
which can trigger a denial of service.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4
- https://www.cve.org/CVERecord?id=CVE-2026-7258
- CVE-2026-7259:
In PHP, a mismatch between encoding lists in Oniguruma and mbfl
leads to a NULL pointer dereference, resulting in a segmentation
fault and denial of service. The vulnerability is exploitable when
user-controlled input can influence the encoding passed
to mb_regex_encoding().
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75
- https://www.cve.org/CVERecord?id=CVE-2026-7259
- CVE-2026-7261:
In PHP, when SoapServer is configured with SOAP_PERSISTENCE_SESSION,
the handler object is persisted across requests via session storage.
However, in the case SOAP requests results in an error, the
persistance is handled incorrectly, resulting in freeing the object
while keeping a pointer to it, which may lead to use-after-free.
This may lead to memory corruption, information disclosure, or
process crashes, with confidentiality, integrity, and availability
impact on the vulnerable system.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q
- https://www.cve.org/CVERecord?id=CVE-2026-7261
- CVE-2026-7262:
In PHP, when a SOAP server has a typemap configured, the decoding
process contains a mistake which checks the wrong variable in case
of missing value element. This leads to dereferences a NULL
pointer, causing a segmentation fault. This allows a remote
unauthenticated attacker to crash the PHP SOAP server process,
resulting in denial of service.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv
- https://www.cve.org/CVERecord?id=CVE-2026-7262
- CVE-2026-7568:
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before
8.4.21, and 8.5.* before 8.5.6, the metaphone() function in
ext/standard/metaphone.c uses a signed int variable to track the
current position within the input string. If a string longer than
2,147,483,647 bytes is passed, a signed integer overflow occurs,
resulting in undefined behavior. This can lead to an out-of-bounds
read, causing a segmentation fault or access to unrelated memory, and
may affect the availability of the PHP process.
For more information, see:
- https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57
- https://www.cve.org/CVERecord?id=CVE-2026-7568
(cherry picked from 952aa90078)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- Update email address to v@baodeep.com.
- Take over maintainership of package/amlogic-boot-fip.
Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9d4d79f9ae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-48850:
PuTTY 0.72 before 0.84 has a double free in RSA KEX.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-48850
- CVE-2026-48851:
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust
indication for TELNET data but the trust status is not cleared between
proxy authentication and the main session.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-48851
- CVE-2026-48852:
PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature
verification.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-48852
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_WESTON_XWAYLAND currently depends on BR2_PACKAGE_LIBEPOXY,
which implicitly requires either libGL or libEGL. However, the XWayland
glamor support uses libepoxy with EGL, so express that dependency
directly. With only libGL and no libEGL, it fails to build. E.g.,
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_ETNAVIV=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XWAYLAND=y
BR2_PACKAGE_LIBEPOXY=y
fails with:
In file included from ../glamor/glamor_priv.h:73,
from ../glamor/glamor_composite_glyphs.c:25:
../glamor/glamor_context.h:27:10: fatal error: epoxy/egl.h: No such file or directory
27 | #include <epoxy/egl.h>
| ^~~~~~~~~~~~~
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 701f8bb31c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes build error with gcc 9.x:
output/build/libheif-1.21.1/libheif/nclx.h:128:50: error:
'bool nclx_profile::operator==(const nclx_profile&)
const' cannot be defaulted
using this defconfig:
BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
# BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_STATIC_LIBS=y
BR2_PACKAGE_LIBHEIF=y
According to https://github.com/strukturag/libheif/issues/1615#issuecomment-3457979167
gcc >= 10 with support for C++20 is needed for the package.
The failing code was introduced upstream in version 0.21.0 with commit
a62f933e38
which was added to buildroot with commit
a8aed698c7.
Also removed -std=c++11 from CXXFLAGS.
The build error was not yet recorded by the autobuilders.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7323bcc1d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Current build generated pkgconfig/libargon2.pc has wrong version string.
Version: ZERO
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 1ef471a61d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
NSS Makefile build system is pretty weak if used with parallel build. In
this case what happens is that 'ifndef FREEBL_NO_DEPEND' appears in
lib/freebl/manifest.mn and coreconf/Linux.mk. When parallel building
variable FREEBL_NO_DEPEND gets defined if not defined to 1, but in the
2 occurences we end up having on variable set to 1 and 1 still not
defined. This results in:
`
/home/giuliobenetti/br-reproduce/3e046c996825447f48377f7c4361b5db26b84f95/output/host/lib/gcc/arm-buildroot-linux-musleabi/14.3.0/../../../../arm-buildroot-linux-musleabi/bin/ld: Linux2.6_arm_arm-buildroot-linux-musleabi-gcc.br_real_glibc_PTH_DBG.OBJ/Linux_SINGLE_SHLIB/lowhash_vector.o: in function `loader_GetOriginalPathname':
lowhash_vector.c:(.text.loader_GetOriginalPathname+0x68): undefined reference to `PR_SetError'
collect2: error: ld returned 1 exit status
`
So let's pass FREEBL_NO_DEPEND=1 when building to define that variable
instead to let NSS Makefile to calculate it.
Fixes:
https://autobuild.buildroot.net/results/ad4/ad40536728303c56d1d0968e38ac36da12cca416//
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 6d3cc38ec0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
There is no CVE assigned with the vendor name "cesenta".
The CPE ID introduced in [1], correctly reference "cesanta" as a CPE
vendor but introduced a typo while writing the vendor metadata in
`mongoose.mk`.
[1] 3d632c941f package/mongoose: add MONGOOSE_CPE_ID_VENDOR
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit de4044a0c9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-32853:
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e)
contain a heap out-of-bounds read vulnerability in the UltraZip
encoding handler that allows a malicious VNC server to cause
information disclosure or application crash. Attackers can exploit
improper bounds checking in the HandleUltraZipBPP() function by
manipulating subrectangle header counts to read beyond the allocated
heap buffer.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32853
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
- 009008e2f4
- CVE-2026-32854:
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee)
contain null pointer dereference vulnerabilities in the HTTP proxy
handlers within httpProcessInput() in httpd.c that allow remote
attackers to cause a denial of service by sending specially crafted
HTTP requests. Attackers can exploit missing validation of strchr()
return values in the CONNECT and GET proxy handling paths to trigger
null pointer dereferences and crash the server when httpd and proxy
features are enabled.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32854
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
- dc78dee51a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 258128aefe)
[thomas: backport patch to 2025.02]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerabilities:
- CVE-2026-4046:
The iconv() function in the GNU C Library versions 2.43 and earlier
may crash due to an assertion failure when converting inputs from the
IBM1390 or IBM1399 character sets, which may be used to remotely crash
an application. This vulnerability can be trivially mitigated by
removing the IBM1390 and IBM1399 character sets from systems that do
not need them.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-4046
- glibc-2.41-135-g61737f43b1f0d9f64a6f16649625476b70f9f4d3
- CVE-2026-4437:
Calling gethostbyaddr or gethostbyaddr_r with a configured
nsswitch.conf that specifies the library's DNS backend in the GNU C
Library version 2.34 to version 2.43 could, with a crafted response
from the configured DNS server, result in a violation of the DNS
specification that causes the application to treat a non-answer
section of the DNS response as a valid answer.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-4437
- glibc-2.41-131-gdbd8335c8ce8af11226ee1514d7a020b15c63345
- CVE-2026-4438:
Calling gethostbyaddr or gethostbyaddr_r with a configured
nsswitch.conf that specifies the library's DNS backend in the GNU C
library version 2.34 to version 2.43 could result in an invalid DNS
hostname being returned to the caller in violation of the DNS
specification.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-4438
- glibc-2.41-132-g502861645bb1baf650d58e2ddd6b230bc26676c9
> git shortlog 2.41-123-gfb4db64a0..glibc-2.41-137-gb676adadb
Carlos O'Donell (2):
resolv: Count records correctly (CVE-2026-4437)
resolv: Check hostname for validity (CVE-2026-4438)
DJ Delorie (1):
include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
Florian Weimer (8):
Switch currency symbol for the bg_BG locale to euro
nss: Introduce dedicated struct nss_database_for_fork type
Linux: In getlogin_r, use utmp fallback only for specific errors
nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
posix: Run tst-wordexp-reuse-mem test
Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
Michael Jeanson (1):
tests: fix tst-rseq with Linux 7.0
Xi Ruoyao (1):
elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
Yury Khrustalev (1):
posix: Fix invalid flags test for p{write,read}v2
Acked-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e3c662eac9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
