Boot an armv5 image running the mdnsd responder alongside the mquery
client, then check that service discovery works: mquery browses for the
bundled _http._tcp service and mdnsd, on the same host, answers over the
loopback of the eth0 multicast group.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
[Julien: add "mdnsd -v" invocation to show version]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4cd5559163)
[Thomas: remove last test that requires v1.1]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-Historyhttps://seclists.org/oss-sec/2026/q3/152
Multiple vulnerabilities have been discovered in ntfs-3g.
A new version 2026.7.7 is now available at https://github.com/tuxera/ntfs-3g
(ntfscat) Fix heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616)
Fix heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617)
Fix single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618)
Fix heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569)
Fix out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571)
Fix heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570)
Fix heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572)
Fix heap buffer overflow when building inherited ACL data. (CVE-2026-56135)
Fix out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)
Switched to sha256 tarball hash provided by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 26811cb110)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
During its configure step, libgpg-error needs awk:
configure -> src/gen-lock-obj.sh -> objdump + awk on test binary
This call is used on the output from objdump on a test binary to
retrieve the size of some data structure, and generate accordingly an
internal header (lock-obj-pub.native.h). However, libgpg-error buildroot
package does not depend explicitely on host-gawk: if host-gawk is not
part of the build, or if it is built later than libgpg-error,
libgpg-error autotool tooling will eventually pick the build machine
awk. On top of this issue, despite the configure.ac suggesting that it
supports different implementations of awk, libgpg-error configure step
will not parse correctly the output from objdump when using mawk,
leading to a wrong lock-obj-pub.native.h header being generated:
With gawk:
typedef struct
{
long _vers;
union {
volatile char _priv[24];
long _x_align;
long *_xp_align;
} u;
} gpgrt_lock_t;
#define GPGRT_LOCK_INITIALIZER {1,{{0,0,0,0,0,0,0,0, \
0,0,0,0,0,0,0,0, \
0,0,0,0,0,0,0,0}}}
With mawk:
typedef struct
{
long _vers;
union {
volatile char _priv[0];
long _x_align;
long *_xp_align;
} u;
} gpgrt_lock_t;
#define GPGRT_LOCK_INITIALIZER {1,{{}}}
This issue has been observed for example on Debian 13 with mawk
installed: it fails to parse mtx_size, leading to a size 0, and so
generating crashes at runtime because of the invalid size embedded in
libgpg-error.
Side note: the lock-obj-pub.native.h header file is correctly
generated, when using mawk 1.3.4 20200120 from Debian 12.
The described issue happen with mawk 1.3.4 20250131 from Debian 13.
libgpg-error should be fixed upstream to properly handle this data
structure size guessing even when using mawk, but anyway the
corresponding buildroot package should not randomly use the build
machine host tooling or buildroot-provided host tooling depending on
whether host-gawk has been selected and built before it.
Enforce an explicit dependency on host-gawk for libgpg-error to make
sure that it systematically uses the buildroot-provided awk.
Co-developped-by: Bernard Gautier <bernard.gautier@nav-timing.safrangroup.com>
Signed-off-by: Bernard Gautier <bernard.gautier@nav-timing.safrangroup.com>
Co-developped-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
[Julien: add the side note that mawk from debian 12 works]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 21bf78411e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
libcamera has moved for a while now to gitlab.freedesktop.org. The
mirror on git.linuxtv.org is still active, but it isn't the canonical
repository and has less bandwidth than freedesktop.org. Switch the
libcamera source URL to gitlab.freedesktop.org.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
[Julien: removed trailing slash in _SITE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 138713f39a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: server: Don't allow -B (accept blank password) with
-t (two factor auth). If run with -t and -B a user configured with a
blank password would be allowed to log in without pubkey auth.
23ec782856
Reported by nvidia
- Security: server: Fix parsing of long authorized_keys lines.
The remainder of a long line would be handled as the start of a new line.
In the case where external programs add semi-trusted public keys to
authorized_keys, a crafted key might bypass restrictions such as "command=".
8d8e1930b8
Reported by nvidia
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ce9ed75bbc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The Debian 12 Bookworm snapshot we use, 20250203, uses the new deb822
format [0] for source list files; it carries a source list file that
points to the current repository, not to the snapshot.
Even though we do inject an old-style source list that points to the
snapshot repository, the packages in the current repository are more
recent than the one in the snapshot, so when we install our packages,
they get retrieved mostly from the current repository rather than from
the snapshot. The image is not reproducible.
Switch to using the new deb822-style source list file.
Note: we do not need to carry the "Latest just before" trick: the
snapshot repository will use the most recent actual snapshot before the
requested dated, so we can just use the date of the image we use (stuck
at midnight because we don't have better).
Since the snapshot repository can be really slow, while at the same time
the remote http server not dropping connections, it can take a very long
while to build the image; add a timeout so that stale connections are
detected and re-attemped early-ish (the timeout applies to both the
connect and the actual download, so it should be large enough to
accomodate slowish network connections).
Fixes: c95d5b8e1e (support/docker: move to current bookworm (Debian
12) snapshot)
[0] https://manpages.debian.org/trixie/apt/sources.list.5.en.html#DEB822-STYLE_FORMAT
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 3460675872)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Bump qt5 packages to latest submodule versions from
https://invent.kde.org/qt/qt/qt5/-/tree/kde/5.15
qtbase repo is a few commits after a tag named v5.15.18-lts-lgpl so
assume it's now 5.15.18.
qt5base patches are updated to make them apply silently and cleanly.
For qt5webengine-chromium:
- 0001-Add-python3-build-support.patc is removed as commit 68302c9ea158
("Enable building with Python 3") contains similar changes,
- 0004-Migrate-presubmit-to-python3.patch is only partially kept as
commit 68302c9ea158 ("Enable building with Python 3") contains similar
changes,
- 0006-Fix-build-in-Python-3.11-invalid-mode-rU.patch is only partially
kept as commit 68302c9ea158 ("Enable building with Python 3") contains
similar changes,
- 0007-Replace-imp.load_source-with-importlib-equivalent.patch is
removed as commit 68302c9ea158 ("Enable building with Python 3")
contains similar changes,
- 0010-Fix-building-with-system-libxml2.patch is removed as commit
c98d28f2f0f2 ("Fix building with system libxml2") contains similar
changes,
- 0012-Include-cstdint-for-uintptr_t-uint8_t-etc.patch is renamed
0009-Include-cstdint-for-uintptr_t-uint8_t-etc.patch and contains more
file patching to make qt5webengine build again,
Also make sure that the patches that have an upstream reference use the
proper Upstream: tag, so we can remove them from checkpackageignore.
For qt5webengine:
- 0002-Add-python3-build-support.patch is removed as commit 2294cc4ed5fd
("Add option to chose python version for building 5.15 WebEngine")
contains similar changes. It now supports both Python2 and Python3 and
defaults to Python2 if found first. This can be overridden with
-webengine-python-version python3 in QT5WEBENGINE_CONF_OPTS but this
was unnecessary in my tests as Python3 was properly selected from
$(HOST_DIR)/bin/.
qt5webengine-chromium is updated with qt5webengine following the logic
stated in Buildroot commit c53455ea4f
("package/qt5/qt5webengine-chromium: bump version after qtwebengine
bump").
I am unsure whether qt5webengine-chromium-catapult also requires an
update.
(cherry picked from commit ff4243147d)
[qt5webengine-chromium/0011-Shorted-printed-cmd-when-long-commands-fail.patch
doesn't exist in 2025.02.x, file renaming not done]
[qt5webengine-chromium/0012-Include-cstdint-for-uintptr_t-uint8_t-etc.patch
is named 0011-Include-cstdint-for-uintptr_t-uint8_t-etc.patch in
2025.02.x, adapt renaming]
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
[Arnout: fix Upstream: tags]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Release notes:
https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
Fixes the following security issues:
https://webkitgtk.org/security/WSA-2026-0003.html
Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, and CVE-2026-43660.
Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 013612b496)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
- CVE-2025-64503:
cups-filters contains backends, filters, and other software required
to get the cups printing service working on operating systems other
than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
`pdftoraster` tool to write beyond the bounds of an array. First, a
PDF with a large `MediaBox` width value causes `header.cupsWidth` to
become large. Next, the calculation of `bytesPerLine =
(header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
resulting in a small value. Then, `lineBuf` is allocated with the
small `bytesPerLine` size. Finally, `convertLineChunked` calls
`writePixel8`, which attempts to write to `lineBuf` outside of its
buffer size (out of bounds write). In libcupsfilters, the maintainers
found the same `bytesPerLine` multiplication without overflow check,
but the provided test case does not cause an overflow there, because
the values are different. Commit
50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
incorporated into cups-filters version 1.28.18.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64503
- 50d94ca0f2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit def2405f39)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
- CVE-2026-34933:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4,
any unprivileged local user can crash avahi-daemon by sending a single
D-Bus method call with conflicting publish flags. This issue has been
patched in version 0.9-rc4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-34933
- 0be89b6bb5
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 88f3b8366b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes: https://www.php.net/ChangeLog-8.php#8.3.32
This fixes 2 vulnerabilities:
- CVE-2026-12184: Segfault in file_get_contents w/ a https URL and a proxy set
- CVE-2026-14355: Memory corruption (zend_mm_heap corrupted) in
openssl_encrypt with AES-WRAP-PAD
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The 'mlkem.h' header is no longer present in wolfssl v5.9.2 [1] and the
content was merged in the 'wc_mlkem.h' header.
[1] 7a2cf5b655
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 275faf6d61)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Changes with nginx 1.30.3
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers off;"
and "large_client_header_buffers" with large configured values when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
a limited disclosure of worker process memory or segmentation fault
in a worker process (CVE-2026-48142).
Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9b8c65a6c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See here for a complete Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22-current.html
Security Fixes:
GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7f48325de6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
For more information on the release, see:
- https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18
It fixes the following vulnerabilities:
- CVE-2026-48163:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST
the donor node is interpolating parameters that the joiner sent into
the command line. Not all parameters were properly validated which
could allow a malicious joiner to execute arbitrary shell commands on
the donor side via the rsync SST method. This issue has been patched
in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48163
- CVE-2026-48165:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-
privileged MariaDB user could've used wsrep_sst_receive_address or
wsrep_sst_donor global system variables to execute shell commands as
the uid of the mariadbd process on the galera joiner node. This issue
has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48165
- CVE-2026-49261:
MariaDB server is a community developed fork of MySQL server. Versions
10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through
11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd`
enabled would execute shell commands embedded in the name of the
joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2. As a workaround, anyone who cannot upgrade now should disable
`wsrep_notify_cmd`.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-49261
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c69f28ae5c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
In the precedent patch "support/testing: test_gnupg2.py: use
assertRunNotOk()" [1] a small typo (OK instead of Ok) was introduced
in the test_gnupg2.py file, which caused a runtime failure.
This patch simply replace "self.assertRunNotOK(cmd)" with
"self.assertRunNotOk(cmd)" to correct this typo.
[1] cb791850ad
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Fiona: fix commit message formatting]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit cfd7483a26)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-55200:
libssh2 through 1.11.1, fixed in commit 97acf3df contains an out-of-
bounds write vulnerability in ssh2_transport_read() that fails to
enforce upper bounds on packet_length field. Remote attackers can send
crafted SSH packets with excessively large packet_length values to
corrupt heap memory and achieve remote code execution.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55200
- 97acf3dfda
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c5aa932745)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerability:
- CVE-2026-55199:
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
handler in src/packet.c that allows a malicious SSH server to cause a
client CPU exhaustion loop by sending a crafted extension count value.
A malicious server can set nr_extensions to 0xFFFFFFFF during key
exchange, causing the client to spin in a tight CPU loop for over 60
seconds because return values from _libssh2_get_string() are unchecked
and the session timeout does not apply to CPU-bound loops.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55199
- 17626857d2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 3c8cfad804)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-6192:
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This
impacts the function opj_pi_initialise_encode in the library
src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The
attack must be carried out locally. The exploit is publicly available
and might be used. The identifier of the patch is
839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a
patch to address this issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-6192
- 839936aa33
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 353007cf40)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The sample script would've passed even if the connections list was
empty. Check that there is at least one connection, and that the
sample script can read loopback device information.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f38f5bb593)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
