Fixes CVE-2022-29162
Minor security issue (which appears to not be exploitable) related to process
capabilities.
A bug was found in runc where runc exec --cap executed processes with ble Linux
process capabilities, creating an atypical Linux environment. For more
information, see GHSA-f3fp-gc8g-vw66 and CVE-2022-29162.
runc spec no longer sets any inheritable capabilities in the created example OCI
spec (config.json) file.
https://github.com/opencontainers/runc/releases/tag/v1.1.2
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0295e9602f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised since bump to version 1.5 in
commit 41bbe8df54 and
be55282d71:
In file included from /nvmedata/autobuild/instance-22/output-1/host/bin/../sparc-buildroot-linux-uclibc/sysroot/usr/include/glib-2.0/glib.h:62,
from src/verity_hash.c:26:
src/verity_hash.c: In function 'verify_zero':
src/verity_hash.c:69:55: error: expected ')' before 'PRIu64'
69 | g_message("Spare area is not zeroed at position %" PRIu64 ".",
| ^~~~~~
Fixes:
- http://autobuild.buildroot.org/results/1a093c0e194a061836884419d2f50506105db01e
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ea79360907)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Update to a new major release which brings in improvements and a few new
features. Release notes:
https://wpewebkit.org/release/wpewebkit-2.36.0.html
None of the new features need additional dependencies. The build option
USE_SYSTEMD has been renamed to ENABLE_JOURNALD_LOG, though.
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7d258f81cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
If enabled at build time, WebKit's internal nested compositor can work
more efficiently when targeting Wayland, by avoiding one unneeded buffer
copy. The build option has been available for a few years in WebKitGTK
releases.
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7e8f0d95a0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised on uclibc and musl since the
addition of libexecinfo package in commit
eea8ba446c:
/home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arc-buildroot-linux-uclibc/10.2.0/../../../../arc-buildroot-linux-uclibc/bin/ld: ../lib/.libs/libboinc.a(libboinc_la-diagnostics.o): in function `boinc_catch_signal':
diagnostics.cpp:(.text+0x8a): undefined reference to `backtrace'
Fixes:
- http://autobuild.buildroot.org/results/4504379b464eb144a4c257001eb4d316bb1f5e44
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9e48c2d5f1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2021-29338: Integer Overflow in OpenJPEG v2.4.0 allows remote
attackers to crash the application, causing a Denial of Service (DoS).
This occurs when the attacker uses the command line option "-ImgDir" on
a directory that contains 1048576 files.
Fix CVE-2022-1122: A flaw was found in the opj2_decompress program in
openjpeg2 2.4.0 in the way it handles an input directory with a large
number of files. When it fails to allocate a buffer to store the
filenames of the input directory, it calls free() on an uninitialized
pointer, leading to a segmentation fault and a denial of service.
Drop patches (already in version)
https://github.com/uclouvain/openjpeg/blob/v2.5.0/NEWS.md
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 636f201062)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2022-1619: Heap-based Buffer Overflow in function
cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This
vulnerabilities are capable of crashing software, modify memory, and
possible remote execution
Fix CVE-2022-1620: NULL Pointer Dereference in function
vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior
to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at
regexp.c:2729 allows attackers to cause a denial of service (application
crash) via a crafted input.
Fix CVE-2022-1621: Heap buffer overflow in vim_strncpy find_word in
GitHub repository vim/vim prior to 8.2.4919. This vulnerability is
capable of crashing software, Bypass Protection Mechanism, Modify
Memory, and possible remote execution
Fix CVE-2022-1629: Buffer Over-read in function find_next_quote in
GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are
capable of crashing software, Modify Memory, and possible remote
execution
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit da66811e8e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Extract from
1bc60d4ba2:
"NOTE TO MAINTAINERS: libee is not used by rsyslog for quite some while.
However, we never included this info into the changelog. So if you still
make rsyslog depend on libee (some do this), you should stop doing so
now. Libee is dead and no longer been maintained nor hosted by us."
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 55d164bf5d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
With the change of the range of UIDs that is generated from the
automatic ID (-1), it became apparent that there is a potential problem
with these automatic IDs when upgrading: they may have changed, which
means that persistent files that exist outside of the rootfs suddenly
have a different owner.
Add a caveat section to the manual, as well as an explanation of how to
work around the problem.
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[yann.morin.1998@free.fr: slight rewording]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8b51205638)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following musl build failure:
In file included from /nvmedata/autobuild/instance-12/output-1/per-package/libfreeimage/host/armeb-buildroot-linux-musleabi/sysroot/usr/include/pthread.h:31,
from /nvmedata/autobuild/instance-12/output-1/per-package/libfreeimage/host/armeb-buildroot-linux-musleabi/include/c++/9.4.0/armeb-buildroot-linux-musleabi/bits/gthr-default.h:35,
from /nvmedata/autobuild/instance-12/output-1/per-package/libfreeimage/host/armeb-buildroot-linux-musleabi/include/c++/9.4.0/armeb-buildroot-linux-musleabi/bits/gthr.h:148,
from /nvmedata/autobuild/instance-12/output-1/per-package/libfreeimage/host/armeb-buildroot-linux-musleabi/include/c++/9.4.0/ext/atomicity.h:35,
from /nvmedata/autobuild/instance-12/output-1/per-package/libfreeimage/host/armeb-buildroot-linux-musleabi/include/c++/9.4.0/bits/basic_string.h:39,
from /nvmedata/autobuild/instance-12/output-1/per-package/libfreeimage/host/armeb-buildroot-linux-musleabi/include/c++/9.4.0/string:55,
from Source/Utilities.h:44,
from Source/FreeImage/PluginPSD.cpp:27:
Source/FreeImage/PluginPSD.cpp: In function 'BOOL Save(FreeImageIO*, FIBITMAP*, fi_handle, int, int, void*)':
Source/FreeImage/PluginPSD.cpp:130:10: error: cannot convert 'std::nullptr_t' to 'BOOL' {aka 'int'} in return
130 | return NULL;
| ^~~~
Fixes:
- http://autobuild.buildroot.org/results/f9c4ba83a506d374d8a28673aac619d8ff80f3da
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d3ee0c781e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Some corporate networks may be blocking access to Russian servers.
The server "strace.io" is in Russia, which will make it inaccessible
from some networks.
Use Github instead to download the sources.
Signed-off-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 45115ea557)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
On x86_64, libssl is a dependency for kselftests. selftests/sgx depends on
it. Thus, select it in "Config.in", and add it as a build dependency in
"linux-tool-selftests.mk.in".
Link: https://lore.kernel.org/buildroot/20220517224809.21f77949@gmx.net/
Suggested-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@iki.fi>
[yann.morin.1998@free.fr:
- in .mk: change condition to be on package being selected
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit de77516a2b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
