Bernd Kuhls
47b5cbb1ca
package/rsync: security bump version to 3.4.3
...
https://download.samba.org/pub/rsync/NEWS#3.4.3
Fixes CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620 & CVE-2026-45232.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-20 21:36:20 +02:00
Bernd Kuhls
4e14863c94
package/imagemagick: security bump version to 7.1.2-23
...
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-23---2026-05-17
Fixes the following CVEs:
CVE-2026-42326, CVE-2026-45031, CVE-2026-45358, CVE-2026-45359,
CVE-2026-45624, CVE-2026-45664, CVE-2026-46520, CVE-2026-46521,
CVE-2026-46522, CVE-2026-46523, CVE-2026-46557 & CVE-2026-46559.
[copied list of CVEs from
https://www.news.de/technik/859626214/imagemagick-gefaehrdet-it-sicherheitshinweis-vom-bsi-und-bug-report-bekannte-schwachstellen-und-sicherheitsluecken/1/ ]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-20 21:32:19 +02:00
Bernd Kuhls
0d3d25bcc9
package/libde265: security bump version to 1.0.19
...
https://github.com/strukturag/libde265/releases/tag/v1.0.19
Fixes CVE-2026-45382 & CVE-2026-45383.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-20 21:31:52 +02:00
Bernd Kuhls
944f41e9e2
package/libheif: security bump version to 1.22.0
...
https://github.com/strukturag/libheif/releases/tag/v1.22.0
Fixes the following CVEs/advisories:
CVE-2026-32738 (GHSA-7f2h-cmpf-v9ww) : Heap OOB Read / SEGV Crash via Zero samples_per_chunk in stsc
CVE-2026-32739 (GHSA-j9g7-q9hv-gq8c) : Infinite Loop DoS in stts Sample Duration Lookup
CVE-2026-32740 (GHSA-frfr-f3vg-2g6j) : Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing
CVE-2026-32741 (GHSA-j3w5-7whq-p37q) : heap buffer overflow in decode_mask_image()
CVE-2026-32814 (GHSA-4m8r-34pg-rvwc) : Uninitialized Heap Memory Information Leak via Failed Grid Tiles
CVE-2026-32882 (GHSA-hg7q-rjr2-8x46) : Heap Buffer OOB Read in overlay compositing due to wrong alpha stride
CVE-2026-41069 (GHSA-p82x-fpmv-576r) : Out-of-bounds vector access leading to invalid dereference
CVE-2026-41071 (GHSA-xj92-xjff-h8w3) : Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count
CVE-2026-47178 (GHSA-5x55-x5pf-9c6g) : Heap Out Of Bounds Write in unci subsystem
CVE-2026-47247 (GHSA-2vh6-whr3-cmq3) : Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
CVE-2026-47251 (GHSA-p6q9-fhf2-vj9v) : Incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
CVE-2026-47254 (GHSA-wqjg-4x9g-6cvg) : Heap Buffer Overflow in Track::get_next_sample_raw_data() -- OOB Chunk Vector Access
CVE-2026-47709 (GHSA-4h72-vqgp-9376) : NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
CVE-2026-47714 (GHSA-h4wm-6wwf-qvhx) : Integer overflow in inline mask size calculation causes undersized buffer allocation
CVE TBD (GHSA-6x5f-qchq-cxqv) : heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
(GHSA-95jx-g5vf-cpp8) : Integer Overflow in SampleAuxInfoReader Offset Calculation
(GHSA-p4r6-6972-g26m) : Incorrect byte-count initialization in BitstreamRange constructor allows container-boundary check bypass
(GHSA-jh2w-m72q-q595) : Out-of-bounds read and assertion-based DoS in EXIF parsing (find_exif_tag / read32) with short EXIF TIFF payload
(GHSA-9h96-c44j-jpq9) : Heap buffer overflow via uint32_t stride overflow in image plane allocation
Added upstream commit to fix build error with imagemagick which would
be introduced by this bump.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-20 21:31:11 +02:00
Andreas Mohr
1ef471a61d
package/libargon2: fix pkgconfig version string
...
Current build generated pkgconfig/libargon2.pc has wrong version string.
Version: ZERO
Signed-off-by: Andreas Mohr <and@gmx.li >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-20 21:25:57 +02:00
Arnout Vandecappelle
8f7ae01409
CHANGES: Update for 2026.02.2
...
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
(cherry picked from commit 9bf4d998d8
2026-05-20 14:04:33 +02:00
Arnout Vandecappelle
fe893189c8
Update news.html and download.html for 2026.02.2
...
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-20 14:04:33 +02:00
Arnout Vandecappelle
91d019e5e2
CHANGES: Update for 2025.02.14
...
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
(cherry picked from commit 92f9688952
2026-05-20 14:02:20 +02:00
Arnout Vandecappelle
01f9b3d7f2
Update news.html and download.html for 2025.02.14
...
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-20 14:02:18 +02:00
Shubham Chakraborty
c17d110b10
DEVELOPERS: added Shubham Chakraborty for htop
...
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-18 22:21:12 +02:00
Shubham Chakraborty
009b044a44
package/htop: bump to version 3.5.1
...
This patch updates htop from version 3.5.0 to 3.5.1, a minor bugfix
release.
Changelog:
- https://github.com/htop-dev/htop/blob/main/ChangeLog
Builds Tested Using:
- utils/test-pkg -a -p htop
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-18 22:18:14 +02:00
John Ernberg
12a6a7d1c6
package/openvmtools: Add patch to fix build failure with newer glib versions
...
Later versions of glib defines g_free as a macro, causing build
failures. Add patch from upstream pull request to fix the issue.
Fixes: https://autobuild.buildroot.org/results/5c6/5c6407b9f8ac1959717e18d81d629b4a4455b06d
Cc: Karoly Kasza <kaszak@gmail.com >
Signed-off-by: John Ernberg <j@j-ernberg.se >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-18 21:31:50 +02:00
Bernd Kuhls
b28aeeab1f
package/gnupg2: security bump version to 2.5.20
...
https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000505.html
"This release adds two features to gpgsm and fixes a some minor security
bugs."
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-18 20:57:43 +02:00
Julien Olivain
b2e3521685
package/tzdata: bump to 2026b
...
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/
Signed-off-by: Julien Olivain <ju.o@free.fr >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-18 20:18:14 +02:00
Julien Olivain
721a44f935
package/zic: bump to 2026b
...
For release notes, see:
https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/VX2Z3CBO6KHTYZNBBKFFWM7ZCI6TVCXP/
Signed-off-by: Julien Olivain <ju.o@free.fr >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-18 20:17:43 +02:00
Julien Olivain
fa7583c86b
package/python-google-api-core: propagate python-google-auth dependencies
...
Fixes:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_PYTHON_GOOGLE_AUTH
Depends on [n]: BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS [=n]
Selected by [y]:
- BR2_PACKAGE_PYTHON_GOOGLE_API_CORE [=y] && BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_PROTOBUF_ARCH_SUPPORTS [=y]
Signed-off-by: Julien Olivain <ju.o@free.fr >
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be >
2026-05-18 20:12:00 +02:00
Giulio Benetti
668b47bdab
package/zlib-ng: fix build failure for PowerPC soft-float
...
As suggested in this review[1], when building for PowerPC with soft-float
enabled, let's also disable both WITH_POWER8/9 that in order disables
all the possible PowerPC acceleration instructions.
Fixes:
https://autobuild.buildroot.org/results/a0fa5a175c546993d818371a0de93b2e9845a183/
[1]: https://github.com/zlib-ng/zlib-ng/pull/2151/changes#r2803264882
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-17 23:59:43 +02:00
Giulio Benetti
d0f43c052c
package/libnss: fix build failure on big endian architectures
...
Add local patch pending upstream to fix build failure due to missing gcm
stubs.
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-17 23:53:00 +02:00
Julien Olivain
ec694f8f6d
package/fwts: bump to version 26.03.00
...
See release announces:
26.01.00: https://lists.ubuntu.com/archives/fwts-devel/2026-January/014129.html
26.03.00: https://lists.ubuntu.com/archives/fwts-devel/2026-March/014171.html
The website [1] is no longer working. This commit updates FWTS_SITE
to use Github [2], which is now the primary download site in the
release announce.
This commit also rewrote the package patch (to add a new
--disable-werror configure option), which was proposed upstream.
This new option is added in FWTS_CONF_OPTS. With this patch now
proposed upstream, the corresponding .checkpackageignore entry
is also removed.
The license hash is also updated, after a year update in [3].
The fwts efi_runtime kernel module has been removed upstream,
in commit [4]. It is replaced by the Kernel driver efi_test, present
since Kernel v4.9, introduced in commit [5]. This commit removes the
option and updates the runtime test accordingly. A note is added in the
Config.in package help.
Fixes:
https://autobuild.buildroot.org/results/859390dbd2a1d7b3bf43588a461a2ff7dc66f92b/
[1] https://fwts.ubuntu.com/
[2] https://github.com/fwts/fwts
[3] b3cd64e61d6d52a62169https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ff6301dabc3ca20ab8f50f8d0252ac05da610d89
Signed-off-by: Julien Olivain <ju.o@free.fr >
[Romain: add a comment for FWTS_AUTORECONF = YES]
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-17 23:47:48 +02:00
Michael Nosthoff
56ff67b50b
package/supertux: fix build with gcc > 11
...
Fixes:
"missing #include <memory>" when building with GCC > 11.
Signed-off-by: Michael Nosthoff <buildroot@heine.tech >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-17 23:38:52 +02:00
Bernd Kuhls
9fb64dfc24
package/postgresql: security bump version to 18.4
...
https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/
Fixes CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-17 22:13:43 +02:00
Bernd Kuhls
f049a07fb0
{linux, linux-headers}: bump 5.{10, 15}.x / 6.{1, 6, 12, 18}.x / 7.0.x series
...
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-17 18:55:38 +02:00
Florian Larysch
6b1b1d6380
package/libnfs: fix build on strict alignment archs
...
Building libnfs fails on targets that have alignment requirements via
-Wcast-align even though the underlying buffers are sufficiently
aligned. Import the upstream fix that silences those warnings.
Fixes: https://autobuild.buildroot.org/results/d7c/d7c0bc5861afdf9bc26906e9abd217bef898fc48
Signed-off-by: Florian Larysch <fl@n621.de >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-15 19:14:16 +02:00
Julien Olivain
955fb2f7c4
package/libabseil-cpp: add patch to fix build with gcc <= 12
...
libabseil-cpp headers can break some packages build, like protobuf,
when compiled with gcc 12. See [1] [2]. The issue has been reported
in protobuf upstream, in [3].
The issue is due to gcc <= 12 not supporting the mix of standard
C++ attributes with GNU attributes. See [4].
Gcc 12 has been removed from Buildroot internal toolchains in
commit [5], but gcc 12 can still be present in external toolchains
or on the host. This is currently the case of the Buildroot Docker
reference image, based on Debian 12 (Bookworm).
This commit fixes the issue by adding a package patch.
Fixes:
- [1] [2] and many more.
[1] https://gitlab.com/buildroot.org/buildroot/-/jobs/13904066346
[2] https://autobuild.buildroot.org/results/33f6cfd37cb48c15a53b3e7123d5ce8388a0f2ab
[3] https://github.com/protocolbuffers/protobuf/issues/26383
[4] https://gcc.gnu.org/PR69585
[5] 58cf7c51dahttps://github.com/abseil/abseil-cpp/pull/2044
Signed-off-by: Julien Olivain <ju.o@free.fr >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-15 18:38:50 +02:00
Bernd Kuhls
40e9341b0b
package/libks: select BR2_PACKAGE_LIBOPENSSL_ENGINES
...
libks makes use of ERR_* functions defined in openssl/err.h which are
included by openssl/engine.h resulting in a build failure when
!BR2_PACKAGE_LIBOPENSSL_ENGINES since commit
623d3bbe43https://autobuild.buildroot.net/results/aac/aac25e5c584ede962cac95c353afd64bf720199c/
The oldest build error on the master branch dates back to Feb 2025:
https://autobuild.buildroot.net/results/83a/83a207bee796afbc619b62c5ecf89c662484170f/
so a backport to LTS branches should be considered.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-15 18:03:35 +02:00
Dario Binacchi
d2ad5b8833
package/libgphoto2: fix build with gcc >= 14
...
The commit adds an upstream patch to fix the following build failure:
jl2005c/jl2005bcd_decompress.c: In function 'jl2005bcd_decompress':
jl2005c/jl2005bcd_decompress.c:161:46: error: passing argument 3 of 'jpeg_mem_dest' from incompatible pointer type [-Wincompatible-pointer-types]
161 | jpeg_mem_dest (&cinfo, &jpeg_header, &jpeg_header_size);
| ^~~~~~~~~~~~~~~~~
| |
| long unsigned int *
Fixes:
- https://autobuild.buildroot.org/results/cb983d9ad90170aa8d7f2b9a5dfc30055d83b5de
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com >
Tested-by: Edgar Bonet <bonet@grenoble.cnrs.fr >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-15 17:33:41 +02:00
Giulio Benetti
6d3cc38ec0
package/libnss: fix Makefile ifndef FREEBL_NO_DEPEND
...
NSS Makefile build system is pretty weak if used with parallel build. In
this case what happens is that 'ifndef FREEBL_NO_DEPEND' appears in
lib/freebl/manifest.mn and coreconf/Linux.mk. When parallel building
variable FREEBL_NO_DEPEND gets defined if not defined to 1, but in the
2 occurences we end up having on variable set to 1 and 1 still not
defined. This results in:
`
/home/giuliobenetti/br-reproduce/3e046c996825447f48377f7c4361b5db26b84f95/output/host/lib/gcc/arm-buildroot-linux-musleabi/14.3.0/../../../../arm-buildroot-linux-musleabi/bin/ld: Linux2.6_arm_arm-buildroot-linux-musleabi-gcc.br_real_glibc_PTH_DBG.OBJ/Linux_SINGLE_SHLIB/lowhash_vector.o: in function `loader_GetOriginalPathname':
lowhash_vector.c:(.text.loader_GetOriginalPathname+0x68): undefined reference to `PR_SetError'
collect2: error: ld returned 1 exit status
`
So let's pass FREEBL_NO_DEPEND=1 when building to define that variable
instead to let NSS Makefile to calculate it.
Fixes:
https://autobuild.buildroot.net/results/ad4/ad40536728303c56d1d0968e38ac36da12cca416//
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-15 16:58:36 +02:00
Giulio Benetti
89609ad586
package/libblockdev: fix build failure due to missing dependency json-glib
...
When BR2_PACKAGE_LIBBLOCKDEV_LVM2 is enabled it requires package
json-glib to be enabled starting from libblockdev version 3.5.0
so let's enable it accordingly.
Fixes:
https://autobuild.buildroot.org/results/fceb64bb7fcfced61ef900b580b458135baa3713/
Fixes: c03745d7degiulio.benetti@benettiengineering.com >
[Romain: add the commit hash introducing the build issue]
Signed-off-by: Romain Naour <romain.naour@smile.fr >
2026-05-15 16:04:53 +02:00
Andreas Ziegler
0a9836fcbe
package/mpd: update to version 0.24.10
...
Version 0.24.10 change log:
* input
- cache: fix deadlock bug
* decoder
- sidplay: support millisecond-precision time stamps
- sidplay: support libsidplayfp version 3
* database
- upnp: allow building with libupnp 1.14.30 which has fixed the API breakage
* Windows
- work around build failure due to zlib bug
Signed-off-by: Andreas Ziegler <br025@umbiko.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-15 12:39:18 +02:00
Bernd Kuhls
eb496bd63e
package/sed: security bump version to 4.10
...
https://lists.gnu.org/archive/html/sed-devel/2026-04/msg00027.html
"'sed --follow-symlinks -i' no longer has a TOCTOU race [...]"
Fixes CVE-2026-5958: https://cert.pl/en/posts/2026/04/CVE-2026-5958/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-14 10:28:37 +02:00
Bernd Kuhls
3dfde73b67
package/intel-microcode: security bump version to 20260512
...
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20260512
Fixes CVE-2025-35979:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01420.html
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-14 10:21:53 +02:00
Thomas Perale
140d618567
package/python-cbor2: add CPE ID
...
The "cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:*" is a valid CPE
[1][2] for this package.
[1] https://nvd.nist.gov/products/cpe/detail/C9CB66BA-6D92-430D-B3A8-D20C43E0655C
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-26209
Signed-off-by: Thomas Perale <thomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-13 21:07:36 +02:00
Thomas Perale
de4044a0c9
package/mongoose: fix typo in CPE vendor
...
There is no CVE assigned with the vendor name "cesenta".
The CPE ID introduced in [1], correctly reference "cesanta" as a CPE
vendor but introduced a typo while writing the vendor metadata in
`mongoose.mk`.
[1] 3d632c941fthomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-13 21:03:57 +02:00
Romain Naour
af2f3208cf
package/python-sdbus-modemmanager: fix sdbus-modemmanager intall path
...
Since the last version bump in commit [1] python-sdbus-modemmanager
install step miss-behave following the switch to poetry (as reported
by [2]).
The sdbus-modemmanager python module is intalled in a second
"modemmanager" subdirectory:
$(TARGET_DIR)/lib/python3.14/site-packages/sdbus_block/modemmanager/modemmanager/
This break existing python script using:
from sdbus_block.modemmanager import MMBearer
Fix tool.poetry install step by removing one "modemmanager".
[1] 7c30b1e522https://github.com/zhanglongqi/python-sdbus-modemmanager/issues/24
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904075359
Signed-off-by: Romain Naour <romain.naour@smile.fr >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-13 21:00:35 +02:00
Thomas Perale
258128aefe
package/libvncserver: patch CVE-2026-3285{3, 4}
...
- CVE-2026-32853:
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e)
contain a heap out-of-bounds read vulnerability in the UltraZip
encoding handler that allows a malicious VNC server to cause
information disclosure or application crash. Attackers can exploit
improper bounds checking in the HandleUltraZipBPP() function by
manipulating subrectangle header counts to read beyond the allocated
heap buffer.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32853
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
- 009008e2f4https://www.cve.org/CVERecord?id=CVE-2026-32854
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
- dc78dee51athomas.perale@mind.be >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-12 22:39:13 +02:00
Dowan Gullient
ba604325c4
support/testing: test_file_capabilities: Fix build failure
...
Buildroot commit [1] updated the Kernel for this test, but forgot to
add the "arm/" prefix for the dtb path. Since Linux 6.5, .dts files
have been moved to "arch/arm/boot/dts/" and the test was not able to
find the file anymore, which caused the build to fail.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14297955524
[1] 74e7e07f83dowan.gullient@smile.fr >
[Julien: reword commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-12 22:14:31 +02:00
Bernd Kuhls
7bebe8f567
package/samba4: security bump version to 4.24.2
...
https://www.samba.org/samba/history/samba-4.24.2.html
Fixes CVE-2026-40170.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-12 21:45:09 +02:00
Bernd Kuhls
e00d34dcc9
package/libmodsecurity: security bump version to 3.0.15
...
https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.15/CHANGES
Fixes CVE-2026-42268 & CVE-2026-30923.
Rebased patch 0001 due to upstream commit
f38b5b7296bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-12 21:38:00 +02:00
Bernd Kuhls
7774858c11
package/exim: security bump version to 4.99.3
...
https://seclists.org/oss-sec/2026/q2/491
https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/EXIM-Security-2026-05-01.1.txt
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-12 21:30:50 +02:00
Bernd Kuhls
f328822cf1
package/liburiparser: security bump version to 1.0.2
...
https://github.com/uriparser/uriparser/blob/uriparser-1.0.2/ChangeLog
Fixes CVE-2026-44927 & CVE-2026-44928.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-12 21:20:22 +02:00
Peter Korsgaard
9684cb9b44
Update for 2026.05-rc1
...
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
2026-05-12 15:53:05 +02:00
Shubham Chakraborty
44f60e9f70
package/dos2unix: update upstream URLs
...
The old upstream page [1] is being deprecated. It currently shows:
"""
This page will go offline on 1 July 2026. Go to the new page at
https://waterlander.net/dos2unix/
"""
This commit updates the homepage, download site and hash file URL
to the new upstream location [2].
[1] http://waterlan.home.xs4all.nl/dos2unix.html
[2] https://waterlander.net/dos2unix/
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com >
[Julien: add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-11 21:33:52 +02:00
Julien Olivain
262db97f12
package/dash: fix hash file
...
Buildroot commit 3563ae9586ju.o@free.fr >
2026-05-11 21:32:28 +02:00
Giulio Benetti
3563ae9586
package/dash: bump to version 0.5.13.4
...
For change log, see:
https://git.kernel.org/pub/scm/utils/dash/dash.git/log/?h=6a1533f24b646364ad514c542292b5c85b2adabf
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-11 21:16:53 +02:00
Bernd Kuhls
6be9c7e9cf
package/dnsmasq: security bump version to 2.92rel2
...
https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html
https://thekelleys.org.uk/dnsmasq/CVE/
Fixes CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893 & CVE-2026-5172.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-11 21:09:02 +02:00
Bernd Kuhls
78a93cfa9b
package/libgpg-error: security bump version to 1.61
...
https://github.com/gpg/libgpg-error/blob/libgpg-error-1.61/NEWS
https://dev.gnupg.org/T8239
https://lwn.net/Articles/1071807/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-11 19:10:28 +02:00
Bernd Kuhls
4ecf88dc4e
package/libksba: bump to version 1.7.0
...
https://github.com/gpg/libksba/blob/libksba-1.7.0/NEWS
https://dev.gnupg.org/T8121
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-11 19:10:21 +02:00
Bernd Kuhls
91c79494e6
{linux, linux-headers}: bump 6.18.x / 7.0.x series
...
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
Signed-off-by: Julien Olivain <ju.o@free.fr >
2026-05-11 18:48:57 +02:00
Peter Korsgaard
aa8e6bc395
Revert "package/python-setuptools: bump to version 82.0.0"
...
This reverts commit 51365ff063https://gitlab.com/buildroot.org/buildroot/-/jobs/14249332016
And many more.
Longer term we either want to upgrade all the defconfigs (which will not fix
the issue for external users) or find a way to patch older u-boot versions.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
2026-05-11 12:20:29 +02:00
Bernd Kuhls
e3c662eac9
package/{glibc, localedef}: security bump to version 2.43-27-g4070d808b
...
Fixes the following security issues:
CVE-2026-5450: scanf %mc off-by-one heap buffer overflow
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0009;h=3c297fdc8018d26dfa3b1b269b8fdc2d4ab07e81;hb=HEAD
CVE-2026-5928: Potential buffer under-read in ungetwc
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0010;h=ae9953fb717886b93ea55fdede14450a0d4835f4;hb=HEAD
git shortlog 2.43-22-g8362e8ce1..2.43-27-g4070d808b
DJ Delorie (1):
include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
Florian Weimer (1):
Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
H.J. Lu (1):
abilist.awk: Handle weak unversioned defined symbols
Rocket Ma (2):
libio: Fix ungetwc operating on byte stream [BZ #33998 ]
stdio-common: Fix buffer overflow in scanf %mc [BZ #34008 ]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net >
[Peter: use correct git hash in _IGNORE_CVES for CVE-2026-5928]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com >
2026-05-11 12:18:28 +02:00
