mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity
67,963 Commits 6 Branches 483 Tags
ec7785adc8e9c03e651d879341d1a78391cc8232
Commit Graph

67963 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Korsgaard
ec7785adc8 package/python-django: security bump to version 4.1.12 
Fixes the following security issue:

CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator

Following the fix for CVE-2019-14232, the regular expressions used in the
implementation of django.utils.text.Truncator’s chars() and words() methods
(with html=True) were revised and improved.  However, these regular
expressions still exhibited linear backtracking complexity, so when given a
very long, potentially malformed HTML input, the evaluation would still be
slow, leading to a potential denial of service vulnerability.

The chars() and words() methods are used to implement the truncatechars_html
and truncatewords_html template filters, which were thus also vulnerable.

The input processed by Truncator, when operating in HTML mode, has been
limited to the first five million characters in order to avoid potential
performance and memory issues.

https://www.djangoproject.com/weblog/2023/oct/04/security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-30 08:39:24 +01:00
Fabrice Fontaine
5d6f22b9dc package/suricata: security bump to version 6.0.15 
This is a security release, fixing a number of important issues.

https://forum.suricata.io/t/suricata-6-0-15-released/4068/2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5ef8369d98)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-27 08:54:34 +02:00
Fabrice Fontaine
5f85677c9b package/vim: security bump to version 9.0.2053 
Fix CVE-2023-5344, CVE-2023-5441 and CVE-2023-5535

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9ccfb25dde)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-27 08:53:42 +02:00
Bernd Kuhls
65bc718874 {linux, linux-headers}: bump 5.15.x / 6.{1, 5}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d8bcff69fc)
[Peter: drop 6.5.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-27 08:49:16 +02:00
Yann E. MORIN
2e494349a4 package/pkg-utils: teach per-package-rsync to copy or hardlink dest 
commit 21d52e52d8 (package/pkg-utils.mk: break hardlinks in global
{TARGET, HOST}_DIR on per-package build) was recently reverted, so we
are back to a situation where it is possible for packages and post-build
scripts to modify files in-place, and thus impact files in any arbitrary
per-package directory, which may break things on rebuild for example.

21d52e52d8 was too big a hammer, but we can still apply the reasoning
from it, to the aggregation of the final target and host directories.

This solves the case for post-build scripts at least. We leave the case
of inter-package modification aside, as it is a bigger issue that will
need more than just copying files around.

We use --hard-links, so that hard-links in the source (the PPD), are
kept as new hard-links (i.e. "copy" of hard-links) in the destination.
This contributes to limiting the size of target/.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
(cherry picked from commit 23edf9837c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 20:31:18 +02:00
Yann E. MORIN
afd4e92238 Revert "package/pkg-utils.mk: break hardlinks in global {TARGET, HOST}_DIR on per-package build" 
Commit 21d52e52d8 (package/pkg-utils.mk: break hardlinks in global
{TARGET, HOST}_DIR on per-package build) stopped hardlink the source and
destination when rsyncing per-package directory, on the rationale that
modifying files in-place after the rsync would also modify the original
file, and that break foo-rebuild and can cause issues with post-build
scripts.

However, what 21d52e52d8 did not envision, is that copying instead of
hard-linking has two nasty side effects:

  - the size increase for the build directory increase with the number
    of packages and with the depth of th dependency chains for those
    packages: a (relatively small) build that was previously totalling
    ~13GiB in output/, now totals north of 122GiB, an almost 10-time
    increase;

  - the build time increases, as it takes more time to read+write files
    than it takes to create a new link to a file; the same build saw an
    increase of build time from 5min 10s to 7min 30s, a 45% increase.

These regressions are both serious, so revert the change; we'll come up
with a stopgap measure in follow-up commits.

This reverts commit 21d52e52d8.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
(cherry picked from commit 8f1487d6fa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 20:30:47 +02:00
Adrian Perez de Castro
d19e8ca768 package/xdg-dbus-proxy: fix tarball name in hash file 
Fixes: 487761a5b2 ("package/xdg-dbus-proxy: bump to version 0.1.5")
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d4fc46f751)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 18:58:39 +02:00
Adrian Perez de Castro
3d47381d4a package/xdg-dbus-proxy: bump to version 0.1.5 
Version 0.1.5 mainly fixes handling of paths with more than 255
characters. Release notes:

  https://github.com/flatpak/xdg-dbus-proxy/releases/tag/0.1.5

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 487761a5b2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 18:40:07 +02:00
Bernd Kuhls
13affee92c {linux, linux-headers}: bump 6.1.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2e1890db65)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 18:37:26 +02:00
Fabrice Fontaine
ae2b8dd57a package/ksmbd-tools: security bump to version 3.4.9 
Fix two security issues that reported by ZDI.

https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.4.7
https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.4.8
https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.4.9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 5eac719129)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 13:11:44 +02:00
Woodrow Douglass
1a7d29405b package/opencv4-contrib: properly note dependencies between modules 
Also, add myself to the DEVELOPERS file

Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
[Arnout: fix typo BR2_PACKAGE_OPENCV4_LIB_OBJDETECCT]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit a7736afaca)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 13:03:43 +02:00
Brandon Maier
9eebcb8058 Makefile: fix SDK relocation for per-package-dirs 
The relocate-sdk.sh script does not work correctly when
BR2_PER_PACKAGE_DIRECTORIES is enabled. relocate-sdk.sh expects
everything to point at $HOST_DIR, but each package will be pointing at
its $(O)/per-package/*/host.

Use the same command for scrubing host paths during the build, to scrub
to the final host directory location.

Signed-off-by: Brandon Maier <Brandon.Maier@collins.com>
Acked-by: Charles Hardin <ckhardin@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 25e60fbe1c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-26 09:38:58 +02:00
Titouan Christophe
d975bd56a8 package/redis: security bump to v7.0.14 
This contains security fixes for:
- CVE-2022-24834
- CVE-2023-36824
- CVE-2023-41053
- CVE-2023-45145

See the release notes:
https://raw.githubusercontent.com/redis/redis/7.0.14/00-RELEASENOTES

Signed-off-by: Titouan Christophe <titouanchristophe@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-24 17:17:12 +02:00
Peter Korsgaard
593454c77e Update for 2023.02.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023.02.6 		2023-10-16 10:19:31 +02:00
Fabrice Fontaine
1b638d8d33 package/libhtp: bump to version 0.5.45 
Needed by suricata 6.0.14:
http://autobuild.buildroot.net/results/b9d/b9df165b014698e5b4c2d218574947476cf23216/

https://github.com/OISF/libhtp/blob/0.5.45/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d821de0e46)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 22:47:00 +02:00
Bernd Kuhls
0481d11003 package/exim: security bump version to 4.96.2 
Release notes: https://seclists.org/oss-sec/2023/q4/107

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 5759ec066a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 20:32:38 +02:00
Fabrice Fontaine
f72ce56f8d package/mutt: fix libgpgme static build 
Fix the following static build failure with libgpgme raised since at
least bump to version 2.2.9 in commit
7a2afdb7b1:

/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/sh4a-buildroot-linux-musl/11.3.0/../../../../sh4a-buildroot-linux-musl/bin/ld: /home/autobuild/autobuild/instance-11/output-1/host/sh4a-buildroot-linux-musl/sysroot/usr/lib/libgpgme.a(assuan-support.o): in function `my_usleep':
assuan-support.c:(.text+0x260): undefined reference to `__assuan_usleep'

Fixes:
 - http://autobuild.buildroot.org/results/0680dbc95601fcd8cdf07b926ea5e9be2079c7bf
 - http://autobuild.buildroot.org/results/b4f2d1ad77fb8b97accc4150d8249de145cb9cf4

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b518b0f161)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 20:25:19 +02:00
Gaël PORTAY
eaad8eda67 board/raspberrypi: fix typo in comment 
This fixes a typo by dropping off the spurious x in ensure.

Signed-off-by: Gaël PORTAY <gael.portay@rtone.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3381a08433)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 20:24:41 +02:00
Fabrice Fontaine
56caafceab package/netsnmp: fix musl build 
Fix the following musl build failure raised since bump to version 5.9.4
in commit 868603755c:

large_fd_set.c: In function 'LFD_SET':
../include/net-snmp/net-snmp-config.h:1614:30: error: unknown type name 'unknown'; did you mean 'union'?
 1614 | #define NETSNMP_FD_MASK_TYPE unknown
      |                              ^~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/394ebf93621c33dc2ddf370297268e6de9de7c9a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dad81003c9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 20:23:22 +02:00
Fabrice Fontaine
3d2cffe1a2 package/nmap: fix build with libressl >= 3.5.0 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 796ebbcf34)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 20:20:54 +02:00
Yann E. MORIN
1a91b6a044 package/gcc: remove leftover from legacy PowerPC patch 
In commit 0c82f3f635 (package/gcc: remove powerpc conditional patching
logic), the macro defining the conditional patch was removed, but it was
still referenced and expanded in the apply-patches hook.

Drop that now.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 84cdd92f01)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 20:19:55 +02:00
Bernd Kuhls
fa8d1acc2d package/samba4: security bump version to 4.18.8 
Release notes: https://www.samba.org/samba/history/samba-4.18.8.html

Fixes CVE-2023-3961, CVE-2023-4091, CVE-2023-4154,  CVE-2023-42669 &
CVE-2023-42670.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2dc61bfa76)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-15 20:19:37 +02:00
Peter Korsgaard
1dedb69aef package/libcue: security bump to version 2.3.0 
Fixes the following security issue:

CVE-2023-43641: Out-of-bounds array access in track_set_index
https://github.com/lipnitsk/libcue/security/advisories/GHSA-5982-x7hv-r9cj

For more details, see the github writeup:
https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3aee3a326d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:44:30 +02:00
Peter Korsgaard
43133fafae package/go: security bump to version 1.20.10 
Fixes CVE-2023-39325: rapid stream resets can cause excessive work

A malicious HTTP/2 client which rapidly creates requests and immediately
resets them can cause excessive server resource consumption.  While the
total number of requests is bounded to the http2.Server.MaxConcurrentStreams
setting, resetting an in-progress request allows the attacker to create a
new request while the existing one is still executing.

go1.20.10 (released 2023-10-10) includes a security fix to the net/http
package.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:41:45 +02:00
Bernd Kuhls
d2cc929ce7 {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 5}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d71743b736)
[Peter: drop 6.5.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:28:56 +02:00
Bernd Kuhls
2424d35012 package/wireless-regdb: bump version to 2023.09.01 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 29b6e170b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:25:29 +02:00
Bernd Kuhls
5d99a2a050 package/python3: bump version to 3.11.6 
Release notes: https://www.python.org/downloads/release/python-3116/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 337485b232)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:24:48 +02:00
Bernd Kuhls
e7f646b715 {linux, linux-headers}: bump 5.15.x / 6.{1, 5}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 003cdd5de3)
[Peter: drop 6.5.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:23:16 +02:00
Peter Korsgaard
440594bb9b package/gstreamer1-editing-services: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8c8ff42674)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:19:10 +02:00
Peter Korsgaard
ba99b48bd8 package/gst-omx: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6339e7f413)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:19:01 +02:00
Peter Korsgaard
718fcd47ed package/gst1-rtsp-vaapi: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 688dcef3d7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:18:38 +02:00
Peter Korsgaard
af3e6c8ebc package/gst1-rtsp-server: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7a0cbea0e3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:18:26 +02:00
Peter Korsgaard
fb980f430f package/gst1-python: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3aff0c2cde)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:18:09 +02:00
Peter Korsgaard
16937c87a5 package/gst1-libav: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 57fc4d90d0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:18:00 +02:00
Peter Korsgaard
24ae784a09 package/gst1-devtools: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 637cf8fdab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:17:41 +02:00
Peter Korsgaard
d157536698 package/gst1-plugins-ugly: security bump to version 1.22.6 
Fixes the following security issues:

ZDI-CAN-21443: Heap-based buffer overflow in the RealMedia file demuxer when
handling malformed files in GStreamer versions before 1.22.5 / 1.20.7.

https://gstreamer.freedesktop.org/security/sa-2023-0004.html

ZDI-CAN-21444: Heap-based buffer overflow in the RealMedia file demuxer when
handling malformed files in GStreamer versions before 1.22.5 / 1.20.7.

https://gstreamer.freedesktop.org/security/sa-2023-0005.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7f2571f594)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:17:35 +02:00
Peter Korsgaard
b1e2cd3e25 package/gst1-plugins-bad: security bump to version 1.22.6 
Fixes the following security issues:

CVE-2023-37329: Heap-based buffer overflow in the PGS blu-ray subtitle
decoder when handling certain files in GStreamer versions before 1.22.4 /
1.20.7.

https://gstreamer.freedesktop.org/security/sa-2023-0003.html

CVE-2023-40474: Heap-based buffer overflow in the MXF file demuxer when
handling malformed files with uncompressed video in GStreamer versions
before 1.22.6.

https://gstreamer.freedesktop.org/security/sa-2023-0006.html

CVE-2023-40475: Heap-based buffer overflow in the MXF file demuxer when
handling malformed files with AES3 audio in GStreamer versions before
1.22.6.

https://gstreamer.freedesktop.org/security/sa-2023-0007.html

CVE-2023-40476: Stack-based buffer overflow in the H.265 video parser when
handling malformed H.265 video streams in GStreamer versions before 1.22.6.

https://gstreamer.freedesktop.org/security/sa-2023-0008.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 19fe76b8b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:17:05 +02:00
Peter Korsgaard
0284e84d46 package/gst1-plugins-good: security bump to version 1.22.6 
Fixes CVE-2023-37327: Heap-based buffer overflow in the FLAC parser when
handling malformed image tags in GStreamer versions before 1.22.4 / 1.20.7.

https://gstreamer.freedesktop.org/security/sa-2023-0001.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 40c3696131)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:16:59 +02:00
Peter Korsgaard
6aa971dffb package/gst1-plugins-base: security bump to version 1.22.6 
Fixes CVE-2023-37328: Heap-based buffer overflow in the subparse subtitle
parser when handling certain SRT subtitle files in GStreamer versions before
1.22.4 / 1.20.7.

https://gstreamer.freedesktop.org/security/sa-2023-0002.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 14e2374592)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:16:40 +02:00
Peter Korsgaard
1f9558079c package/gstreamer1: bump to version 1.22.6 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 133ced8e02)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:16:33 +02:00
Peter Korsgaard
ff02d18d29 package/cups: add upstream security fix for CVE-2023-4504 
Fixes CVE-2023-4504: Postscript Parsing Heap Overflow

https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
https://takeonme.org/cves/CVE-2023-4504.html

There is a 2.4.7 release with this fix, but upstream unfortunately broke
!gnutls builds, so backport the security fix instead:

https://github.com/OpenPrinting/cups/issues/762

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b9d9497019)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:14:22 +02:00
Jan Čermák
5f56122cd0 package/libcurl: security bump to 8.4.0 
Fixes following two vulnerabilities:

* CVE-2023-38545: SOCKS5 heap buffer overflow
  https://curl.se/docs/CVE-2023-38545.html
* CVE-2023-38546: cookie injection with none file
  https://curl.se/docs/CVE-2023-38546.html

Signed-off-by: Jan Čermák <sairon@sairon.cz>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 30dd60ba7e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:12:57 +02:00
Francois Perrad
6543b63273 package/mbedtls: security bump to version 2.28.5 
Fixes the following security issue:

CVE-2023-43615: Buffer overread in TLS stream cipher suites
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2023-10-1/

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 26762e3009)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:10:36 +02:00
Francois Perrad
0b4c5daf4a package/mbedtls: bump to version 2.28.4 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7dc2462a8e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:10:29 +02:00
Francois Perrad
8032a566d5 package/mbedtls: bump to 2.28.3 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8941de8454)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 20:10:23 +02:00
Thomas Petazzoni
e5d9ea090d DEVELOPERS: add Thomas Petazzoni for nodejs 
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 65dfac5d11)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 17:44:35 +02:00
Bernd Kuhls
056e5618b3 package/exim: security bump version to 4.96.1 
Fixes CVE-2023-42114, CVE-2023-42115, CVE-2023-42116:
https://exim.org/static/doc/security/CVE-2023-zdi.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 657d10b34b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 17:42:32 +02:00
Daniel Lang
2ee81d616b package/efl: bump to version 1.26.3 
This is a bug-fix release.

See: https://www.enlightenment.org/news/2022-09-16-efl-1.26.3

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6037f9387a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 17:18:28 +02:00
Daniel Lang
13fc9dcb34 package/netsnmp: security bump to version 5.9.4 
CVE-2022-44792 handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c
in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can
be used by a remote attacker (who has write access) to cause the
instance to crash via a crafted UDP packet, resulting in Denial of
Service.

CVE-2022-44793 handle_ipv6IpForwarding in
agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a
NULL Pointer Exception bug that can be used by a remote attacker to
cause the instance to crash via a crafted UDP packet, resulting in
Denial of Service.

The pgp key was changed [0] as the old one expired [1].

[0]: 90a6d98aae/
[1]: https://github.com/net-snmp/net-snmp/issues/595

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 868603755c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 17:17:36 +02:00
Fabrice Fontaine
00855772b8 package/sslh: add SSLH_CPE_ID_VENDOR 
cpe:2.3:a:sslh_project:sslh is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/3E1DF528-5507-4919-A3EC-4283949BE06F

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5fcd2ef29d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-10-13 17:15:16 +02:00