igh-ethercat is failing while attempting to apply patches,
with error:
Applying 0002-Linux-6.19.0-support.patch using patch:
patching file devices/generic.c
Reversed (or previously applied) patch detected! Skipping patch.
1 out of 1 hunk ignored -- saving rejects to file devices/generic.c.rej
The package patch 0002 was added in [1] in branch "master" while it
was in release client cycle. It was cherry-picked in [2] in branch
"next" to apply the bump [3] (which removes the package patches 0001
and 0002). When the branch "next" was merged in "master" in commit [4],
the patch 0002 was kept.
This commit removes this stale patch.
[1] e4cf512c39
[2] 8a5fc970b4
[3] 0a91e760f4
[4] 5f26877955
Fixes:
- https://autobuild.buildroot.org/results/4f509f1f788c1b8dc5a840ffa2e435c5ed7b6eea/
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d071817969)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libde265/releases/tag/v1.1.2
Security fixes:
(CVE numbers will be added when assigned.)
CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free
in multi-threaded (WPP) decoding. A crafted stream whose slice segments
repeat or rewind their slice_segment_address within a picture re-ran
CTB rows that were already marked finished, so the CABAC context handoff
between rows was no longer ordered and the shared context table was
released twice. Slice segments that do not follow the previous one in
tile-scan order are now rejected with the new warning
DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row
progress is reset for each slice segment. (medium)
CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after
de265_reset(): the pointer to the previous slice header was left
dangling when the DPB was cleared, and a dependent slice pushed after
the reset copied from freed memory. (medium)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e55cb31085)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libheif/releases/tag/v1.23.3
Fixes the following CVEs:
(CVE numbers will be added when assigned.)
CVE-2026-XXXXX (GHSA-x8r2-mggj-j6wr) Heap buffer overflow (write) in the
uncompressed (unci) mixed-interleave decoder when the two chroma
components declare different bit depths. Both the written bytes and the
overflow length are controlled by the file. (critical)
CVE-2026-XXXXX (GHSA-8fmq-r4pf-7m57) Permanent decoder deadlock through
a reference cycle between an image and its alpha auxiliary image. The
alpha edge was not covered by the cycle guard and re-entered a held
mutex. (high)
CVE-2026-XXXXX (GHSA-w7mc-p8jc-p853) Heap out-of-bounds read in the
YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma
planes have a lower bit depth than luma. Heap memory could end up in
the decoded image. YCbCr conversions with mismatched luma and chroma
bit depths are now rejected. (high)
CVE-2026-XXXXX (GHSA-4jqm-2x34-6f6r) Heap buffer overflow in the SVT-AV1
encoder plugin when encoding a high-bit-depth alpha channel, and a
double free on its send-picture error path. (high)
CVE-2026-84451 (GHSA-hh47-fhqr-cj2r) Incomplete fix for
GHSA-73p7-m7gg-w2jv: the tile range check of the unci decoder (without
icef) could still overflow, allowing an out-of-bounds read. (medium)
CVE-2026-XXXXX (GHSA-4h82-g446-83fm) Heap out-of-bounds read when
converting odd-height 4:2:0 frames of an uncompressed (uncv) image
sequence to RGB. (medium)
CVE-2026-XXXXX (GHSA-9rj8-5mp5-26c9) Out-of-bounds read in the RGB to
YCbCr identity-matrix color conversion when the R, G, and B planes
have different bit depths. (medium)
CVE-2026-84450 (GHSA-gh5q-69gg-c964) A clap property combined with an
oversized ispe reached an assert() in the Fraction arithmetic and
aborted the process (incomplete fix for GHSA-jc8f-p23p-5hjg). An error
is returned instead. (medium)
(GHSA-mw6f-29j3-76f4) Several smaller findings:
heif_image_handle_get_depth_image_handle() and
heif_image_handle_get_depth_image_representation_info() dereferenced a
null pointer on files without a depth image; the TIFF input decoder of
the example tools had an unbounded EXIF tag allocation and a division
by zero on zero YCbCr subsampling; assert()s in the PNG input decoder
are now error returns; integer overflow in the Go binding's
ImageAccess.GetPlane(); heif-view now verifies the decoded frame size
before display. (medium)
(GHSA-8857-r8x5-7499) Undefined behavior (negative shift) in the HDR
bit-depth up-conversion for target bit depths above 16. Such
conversions are now rejected. (low)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d148168e20)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot 262a7f6d2f added the package but
forgot to provide the hash for LICENSE.GPL3-EXCEPT, instead a hash for
a non-existing file was added to qt5knx.hash.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d2b7199dea)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Regenerate the Bootlin toolchain Kconfig and test configurations using
support/scripts/gen-bootlin-toolchains.
This adds BR2_USE_MMU to the affected uClibc entries and to the
architecture support conditions, and updates the generated tests.
The glibc and musl changes only reorder their existing BR2_USE_MMU
dependencies.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9c6eed9ec0)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The Bootlin uClibc toolchains for m68k-68xxx, riscv32-ilp32d, and
xtensa-lx60 require an MMU. However, their generated Kconfig entries
lack a BR2_USE_MMU dependency, allowing them to be selected for noMMU
configurations. External toolchain validation then fails with:
MMU support available in C library, please enable BR2_USE_MMU
Add the missing BR2_USE_MMU dependencies for these architectures to
prevent them from being selected for noMMU targets.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3469c6793c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Regenerate the Bootlin toolchain Kconfig file with
support/scripts/gen-bootlin-toolchains to remove duplicate
BR2_TOOLCHAIN_HAS_THREADS selections.
Commit 184d47a7ad ("support/scripts/gen-bootlin-toolchains: add new
script to support Bootlin toolchains") initially introduced this issue.
Although commit a33e1af4a0 ("support/scripts/gen-bootlin-toolchains:
avoid selecting _HAS_THREADS multiple times") fixed the generator script,
the Config.in.options file was not regenerated accordingly.
This is a non-functional cleanup, as repeated Kconfig select statements
are harmless.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9556895e78)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
DEJAVU_LICENSE is primarily BitstreamVera. The license file also
specifies that DejaVu-specific changes and certain math extensions are
in the Public Domain. This matches the licensing logic used by
OpenEmbedded/Yocto.
Signed-off-by: Martin Bachmann <martin.bachmann@designwerk.com>
[Fiona: wrap lines in commit message]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit df61b7e9bb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
See the changelogs:
- https://www.erlang.org/patches/OTP-26.2.5.16
- https://www.erlang.org/patches/OTP-26.2.5.17
- https://www.erlang.org/patches/OTP-26.2.5.18
- https://www.erlang.org/patches/OTP-26.2.5.19
- https://www.erlang.org/patches/OTP-26.2.5.20
- https://www.erlang.org/patches/OTP-26.2.5.21
This fixes the following vulnerabilities:
- CVE-2026-21620:
Relative Path Traversal, Improper Isolation or Compartmentalization
vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp
inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows
Relative Path Traversal. This vulnerability is associated with program
files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-21620
- CVE-2026-23941:
Inconsistent Interpretation of HTTP Requests ('HTTP Request
Smuggling') vulnerability in Erlang OTP (inets httpd module) allows
HTTP Request Smuggling. This vulnerability is associated with program
files lib/inets/src/http_server/httpd_request.erl and program routines
httpd_request:parse_headers/7. The server does not reject or
normalize duplicate Content-Length headers. The earliest Content-
Length in the request is used for body parsing while common reverse
proxies (nginx, Apache httpd, Envoy) honor the last Content-Length
value. This violates RFC 9112 Section 6.3 and allows front-end/back-
end desynchronization, leaving attacker-controlled bytes queued as the
start of the next request.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23941
- CVE-2026-23942:
Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path
Traversal. This vulnerability is associated with program files
lib/ssh/src/ssh_sftpd.erl and program routines
ssh_sftpd:is_within_root/2. The SFTP server uses string prefix
matching via lists:prefix/2 rather than proper path component
validation when checking if a path is within the configured root
directory. This allows authenticated users to access sibling
directories that share a common name prefix with the configured root
directory. For example, if root is set to /home/user1, paths like
/home/user10 or /home/user1_backup would incorrectly be considered
within the root.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23942
- CVE-2026-23943:
Improper Handling of Highly Compressed Data (Compression Bomb)
vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial
of Service via Resource Depletion. The SSH transport layer advertises
legacy zlib compression by default and inflates attacker-controlled
payloads pre-authentication without any size limit, enabling reliable
memory exhaustion DoS. Two compression algorithms are affected: *
zlib: Activates immediately after key exchange, enabling
unauthenticated attacks * zlib@openssh.com: Activates post-
authentication, enabling authenticated attacks Each SSH packet can
decompress ~255 MB from 256 KB of wire data (1029:1 amplification
ratio). Multiple packets can rapidly exhaust available memory, causing
OOM kills in memory-constrained environments. This vulnerability is
associated with program files lib/ssh/src/ssh_transport.erl and
program routines ssh_transport:decompress/2,
ssh_transport:handle_packet_part/4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23943
- CVE-2026-28810:
Generation of Predictable Numbers or Identifiers vulnerability in
Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache
Poisoning. The built-in DNS resolver (inet_res) uses a sequential,
process-global 16-bit transaction ID for UDP queries and does not
implement source port randomization. Response validation relies almost
entirely on this ID, making DNS cache poisoning practical for an
attacker who can observe one query or predict the next ID. This
conflicts with RFC 5452 recommendations for mitigating forged DNS
answers. inet_res is intended for use in trusted network environments
and with trusted recursive resolvers. Earlier documentation did not
clearly state this deployment assumption, which could lead users to
deploy the resolver in environments where spoofed DNS responses are
possible. This vulnerability is associated with program files
lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-28810
- CVE-2026-32147:
Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows
an authenticated SFTP user to modify file attributes outside the
configured chroot directory. The SFTP daemon (ssh_sftpd) stores the
raw, user-supplied path in file handles instead of the chroot-resolved
path. When SSH_FXP_FSETSTAT is issued on such a handle, file
attributes (permissions, ownership, timestamps) are modified on the
real filesystem path, bypassing the root directory boundary entirely.
Any authenticated SFTP user on a server configured with the root
option can modify file attributes of files outside the intended chroot
boundary. The prerequisite is that a target file must exist on the
real filesystem at the same relative path. Note that this
vulnerability only allows modification of file attributes; file
contents cannot be read or altered through this attack vector. If the
SSH daemon runs as root, this enables direct privilege escalation: an
attacker can set the setuid bit on any binary, change ownership of
sensitive files, or make system configuration world-writable. This
vulnerability is associated with program files
lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and
ssh_sftpd:handle_op/4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32147
- CVE-2026-42789:
Improper Following of a Certificate's Chain of Trust vulnerability in
Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate
to be accepted as an intermediate issuer, enabling certificate chain
forgery. In lib/public_key/src/pubkey_cert.erl,
pubkey_cert:validate_extensions/7 contains two flaws that together
allow a certificate with basicConstraints cA:false and no keyUsage
extension to be used as an intermediate issuer in a chain passed to
public_key:pkix_path_validation/3: the cA:false clause recurses into
the remaining extensions without rejecting the certificate when it is
in issuer position, and the keyUsage check only fires when the
extension is present, so a certificate lacking keyUsage entirely
bypasses the keyCertSign enforcement. Any party holding an end-entity
certificate with basicConstraints cA:false and no keyUsage extension,
issued by any CA in the victim's trust store, can use that
certificate's private key to sign forged leaf certificates for
arbitrary identities. public_key:pkix_path_validation/3 accepts the
resulting chain, and by extension every TLS or mTLS endpoint built on
the OTP ssl application that relies on the default verifier is
affected, including server identity verification on the client side
and client certificate verification on mTLS servers.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42789
- CVE-2026-42790:
Improper Certificate Validation vulnerability in Erlang OTP public_key
(pubkey_cert and public_key modules) allows a DNS nameConstraints
bypass via subject CommonName fallback in TLS hostname verification.
Two flaws combine to allow a subordinate CA whose DNS nameConstraints
are restricted (e.g. permitted;DNS:allowed.example.com) to issue a
leaf certificate that an OTP TLS client accepts as a valid identity
for an out-of-scope hostname (e.g. victim.example.com): First,
pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl
only checks SAN DNS entries against nameConstraints. Per RFC 5280, a
permitted DNS subtree only restricts certificates that contain a DNS-
typed name. A leaf with no subjectAltName therefore trivially
satisfies any permitted;DNS:... constraint regardless of its subject
commonName. Second, public_key:pkix_verify_hostname/3 in
lib/public_key/src/public_key.erl falls back to the subject commonName
when no subjectAltName is present, extracting id-at-commonName
attributes as presented IDs and matching them against the reference
hostname. The strict pkix_verify_hostname_match_fun(https) matcher
does not suppress this fallback. The result is that path validation
accepts a CN-only leaf under a DNS-constrained intermediate (no SAN
means the nameConstraints are not triggered), and hostname
verification then accepts it via the CN fallback. The bypass is
reachable from stock ssl:connect with verify_peer, a trusted CA, SNI,
and the canonical strict https hostname matcher.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42790
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dfc909b1cd)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This patch fixes a build error with OpenSSL-enabled libcurl which was
detected by the Gitlab pipelines:
checking for openssl options with pkg-config... found
configure: pkg-config: SSL_LIBS: "-lssl -lcrypto -pthread"
configure: pkg-config: SSL_LDFLAGS: "-L/builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib"
configure: pkg-config: SSL_CPPFLAGS: ""
checking for HMAC_Update in -lcrypto... no
checking for HMAC_Init_ex in -lcrypto... no
checking OpenSSL linking with -ldl... no
checking OpenSSL linking with -ldl and -lpthread... no
checking for SSL_set_quic_use_legacy_codepoint... no
checking for SSL_set_quic_tls_cbs... no
configure: OpenSSL version does not speak any known QUIC API
configure: OPT_OPENSSL: /builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/host/m68k-buildroot-uclinux-uclibc/sysroot/usr
configure: OPENSSL_ENABLED:
configure: error: --with-openssl was given but OpenSSL could not be detected
make[1]: *** [package/pkg-generic.mk:263: /builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/build/libcurl-8.21.0/.stamp_configured] Error 1
Although OpenSSL was found using pkg-config the build tests fail.
A local build shows the concrete error in config.log, for example:
configure:27577: checking for HMAC_Update in -lcrypto
configure:27599: /home/bernd/buildroot/output/host/bin/m68k-linux-gcc
-o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
-D_FILE_OFFSET_BITS=64 -O2 -g0 -fno-dwarf2-cfi-asm -Wl,-elf2flt=-r
-static -Werror-implicit-function-declaration -Wno-system-headers
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
-D_GNU_SOURCE -Wl,-elf2flt=-r -static
-L/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib
-L/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib
conftest.c -lcrypto -lssl -lcrypto -lz -pthread -lz >&5
/home/bernd/buildroot/output/host/opt/ext-toolchain/m68k-buildroot-uclinux-uclibc/bin/ld.real:
/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib/libcrypto.a(libcrypto-lib-threads_pthread.o):
in function `ossl_rcu_read_lock':
threads_pthread.c:(.text+0xa4): undefined reference to `__atomic_fetch_add_8'
This error occurs many times for various atomic operations:
$ grep "undefined reference to \`__atomic" output/build/libcurl-8.20.0/config.log | sort -u | grep -v real
threads_pthread.c:(.text+0x28a): undefined reference to `__atomic_fetch_sub_8'
threads_pthread.c:(.text+0x3b4): undefined reference to `__atomic_fetch_add_8'
threads_pthread.c:(.text+0x9c8): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xa4): undefined reference to `__atomic_fetch_add_8'
threads_pthread.c:(.text+0xa9c): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xb66): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xc30): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xcdc): undefined reference to `__atomic_is_lock_free'
The build error can be reproduced with the current buildroot tree using
this defconfig:
BR2_m68k=y
BR2_m68k_cf5208=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_M68K_COLDFIRE_UCLIBC_STABLE=y
BR2_PACKAGE_OPENSSL=y
BR2_PACKAGE_LIBCURL=y
Although the toolchain lacks atomics support
$ grep ATOMIC .config
$
it emits atomic-related defines, for example:
$ echo | output/host/bin/m68k-linux-gcc -dM -E - | grep __ATOMIC_ACQ_REL
#define __ATOMIC_ACQ_REL 4
$
This specific define __ATOMIC_ACQ_REL is used in OpenSSL to enable
atomic support at various places:
https://github.com/openssl/openssl/blob/openssl-3.6.3/crypto/threads_pthread.c
causing the build errors we see with the mentioned defconfig.
To fix the problem we use an OpenSSL-provided define to forcefully
disable the usage of atomic intrinsics.
The misdetection of atomic intrinsics for m68k coldfire is not a new
problem:
https://lists.buildroot.org/pipermail/buildroot/2017-May/180841.htmlhttps://lists.buildroot.org/pipermail/buildroot/2026-May/803110.html
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5f8d0b78ec)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The mdnsd runtime test can randomly fail on slow runners.
It's hard to reproduce locally (only one failure after a few attempts)
but we can reproduce it easily by removing the while loop entirely.
It turns out that mdnsd is started by S50mdnsd before the
emulator.login() change the system date:
[BRTEST# date -s @1788032864
Sat Aug 29 19:47:44 UTC 2026
Since the minimal rootfs.cpio generated for TestMdnsd doesn't have any
ntp client installed, it start with "January 1, 1970".
The date change may cause some issue to the mdnsd daemon which blocks
any response from mquery command.
When the problem occurs, "mquery -T _http._tcp" reply is empty:
# mquery -T _http._tcp
Querying _http._tcp.local. for PTR (12) ... press Ctrl-C to stop
To workaround the issue, restart mdnsd manually.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16185948555
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45636d67c9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Dracut-internal executables were linked against system libraries,
instead of Buildroot host packages. For example:
$ ldd host/lib/dracut/dracut-install
linux-vdso.so.1 (0x00007f578cf06000)
libc.so.6 => /usr/lib/x86_64-linux-gnu/libc.so.6 (0x00007f578cccd000)
libkmod.so.2 => /usr/lib/x86_64-linux-gnu/libkmod.so.2 (0x00007f578ccb1000)
/lib64/ld-linux-x86-64.so.2 (0x00007f578cf08000)
libcrypto.so.3 => /usr/lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007f578c600000)
libz.so.1 => /usr/lib/x86_64-linux-gnu/libz.so.1 (0x00007f578cc92000)
libzstd.so.1 => /usr/lib/x86_64-linux-gnu/libzstd.so.1 (0x00007f578c536000)
The reason is that Dracut is not a "real" autoconf package, and the
hand-written ./configure script does not preserve LDFLAGS for
make. Pass the environment variables directly to fix this.
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
[Julien: add comment in dracut.mk]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45acb281ca)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
examples/vm_power_manager/meson.build in DPDK detects the presence of
libvirt:
opt_dep = cc.find_library('virt', required : false)
and then builds some examples or not depending on the availability of
libvirt. Let's make this optional dependency explicit in dpdk.mk, even
if there's no explicit enable/disable option for it.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 55a7ece9e5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When libvirt is present before DPDK is built, some additional examples
are compiled. One of them fails to build due to a missing <stdlib.h>
include. Let's import a patch from OpenSuse, that we have submitted
upstream, to fix this issue.
We couldn't find any autobuilder failure for this issue, but the
following defconfig allows to reproduce the failure:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_DPDK=y
BR2_PACKAGE_DPDK_EXAMPLES=y
BR2_PACKAGE_LIBVIRT=y
The problem exists since DPDK v19.11, so it has been in Buildroot
since DPDK was introduced in commit
d17d1b6bde.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit db3d0d44ac)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit [1] (package/perl: fix build issue with musl)
introduced a patch that is meant to be applied on top of perl-cross,
which is extracted on top of perl only in the target variant.
Since the patch was introduced as a normal package patch, the Buildroot
infra is trying to always apply it, even for the host package variant.
Since perl-cross is not extracted for the host variant, some patched
files are missing. In that case, the host-perl is failing with error:
>>> host-perl 5.42.3 Patching
Applying 0001-configure-keep-_GNU_SOURCE-in-build-flags.patch using patch:
can't find file to patch at input line 46
This commit fixes the issue by moving the package patch in a dedicated
"perl-cross" subdirectory, to make sure it will no longer be applied by
the infra. We apply the patch only for the target package variant using
a _POST_PATCH_HOOKS hook.
Fixes:
- [1]
- https://gitlab.com/buildroot.org/buildroot/-/jobs/16185948610 (TestPerlXMLLibXML)
- ...and few other tests requiring host-perl
[1] d950fff290
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8dea6e7c08)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When OpenSSL is enabled, if DES support is enabled, OpenSSH uses
DES_crypt. However, without OpenSSL or its DES support, there is no
available crypt() implementation for OpenSSH libopenbsd-compat xcrypt()
function, resulting in the following error:
.../host/bin/i686-buildroot-linux-gnu-gcc -o sshd-auth sshd-auth.o
auth2-methods.o auth-rhosts.o auth-passwd.o sshpty.o sshlogin.o
servconf.o serverloop.o auth.o auth2.o auth-options.o session.o
auth2-chall.o groupaccess.o auth-bsdauth.o auth2-hostbased.o
auth2-kbdint.o auth2-none.o auth2-passwd.o auth2-pubkey.o
auth2-pubkeyfile.o auth2-gss.o gss-serv.o gss-serv-krb5.o
monitor_wrap.o auth-krb5.o audit.o audit-bsm.o audit-linux.o
platform.o loginrec.o auth-pam.o auth-shadow.o auth-sia.o
sandbox-null.o sandbox-rlimit.o sandbox-darwin.o
sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-solaris.o
sftp-server.o sftp-common.o uidswap.o ssh-pkcs11-client.o
ssh-sk-client.o -L. -Lopenbsd-compat/ -D_LARGEFILE_SOURCE
-D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0
-D_FORTIFY_SOURCE=1 -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
-fstack-protector-strong -pie -lssh -lopenbsd-compat
-L.../host/bin/../i686-buildroot-linux-gnu/sysroot/usr/lib
-lssl -lcrypto -lcrypto -lz
.../host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../
i686-buildroot-linux-gnu/bin/ld:
openbsd-compat//libopenbsd-compat.a(xcrypt.o): in function `xcrypt':
xcrypt.c:(.text+0x51): undefined reference to `crypt'
.../host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../
i686-buildroot-linux-gnu/bin/ld:
openbsd-compat//libopenbsd-compat.a(xcrypt.o): in function `xcrypt':
xcrypt.c:(.text+0x51): undefined reference to `crypt' collect2: error:
ld returned 1 exit status make[2]: *** [Makefile:233: sshd-auth] Error
1 make[2]: *** Waiting for unfinished jobs.... collect2: error: ld
returned 1 exit status make[2]: *** [Makefile:230: sshd-session] Error
1 make[1]: *** [package/pkg-generic.mk:273:
.../build/openssh-10.4p1/.stamp_built]
Error 2 make: *** [Makefile:83: _all] Error 2
This commit enables BR2_PACKAGE_LIBXCRYPT with OpenSSH as long as
glibc is used. Since "sshd-auth" is compiled regardless of
BR2_PACKAGE_OPENSSH_SERVER, we need to enable it with BR2_PACKAGE_OPENSSH.
Signed-off-by: Jimmy Durand Wesolowski <jimmy.wesolowski@mobileye.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 913512e302)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the website accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2eefcb245f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the manual accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2d7d9d8200)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This fixes the following known vulnerabilities:
- CVE-2026-19499
- CVE-2026-77117
- CVE-2026-80489
(alternative to commit be382f6061)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When BR2_PACKAGE_OPENCV4_WITH_WEBP=y we need to enable mux and demux
support in webp, otherwise the build of OpenCV fails as follows:
CMake Error: The following variables are used in this project,
but they are set to NOTFOUND.
Please set them or make sure they are set and tested correctly
in the CMake files:
WEBP_DEMUX_LIBRARY
linked by target "opencv_imgcodecs"
in directory [...]/build/opencv4-4.13.0/modules/imgcodecs
WEBP_MUX_LIBRARY
linked by target "opencv_imgcodecs"
in directory [...]/build/opencv4-4.13.0/modules/imgcodecs
The issue already exists in 2025.02.x.
Fixes:
https://autobuild.buildroot.net/results/d3e0446a87d32469267e241866c4224143170f31/
Signed-off-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e1ec936cf7)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Even though it's only documentation, the form of the names of the
post-image.sh and post-build.sh scripts should be consistent with the
names of those scripts used in the code base, using hyphen, not
underscore.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c529a2c286)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
host-erlang build can fail with the following error:
make[5]: Nothing to be done for 'opt'.
MAKE opt
CC ../priv/bin/x86_64-pc-linux-gnu/odbcserver
/usr/bin/ld: ../priv/obj/x86_64-pc-linux-gnu/odbcserver.o: in function `encode_column_dyn':
odbcserver.c:(.text+0x6b4): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x6c2): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x6d4): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x6e7): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x6fa): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x708): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x71b): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x72e): undefined reference to `ei_x_encode_ulong'
[...]
This can be reproduced with the following minimal defconfig (and
libei.so present on host, see details below):
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_ERLANG=y
Those missing symbols are part of the erl_interface, exposed by libei.a.
host-erlang builds correctly libei.a _before_ odbcserver.c (it can be
found in lib/erl_interface/obj/x86_64-pc-linux-gnu/libei.a), but the
failure is actually due to the build command generated and used for
odbcserver.c, especially the link arguments:
/usr/bin/gcc \
[...]
-o ../priv/bin/x86_64-pc-linux-gnu/odbcserver \
../priv/obj/x86_64-pc-linux-gnu/odbcserver.o \
-L/usr/lib64 \
-lodbc \
-L/home/alexis/src/buildroot/erlang-master/build/host-erlang-custom/lib/erl_interface/obj/x86_64-pc-linux-gnu \
-lpthread -lei
/usr/lib64 is searched before the path where libei.a has been built, so
if whether a valid libei.a or libei.so is found there, it shadows the
expected libei.a. In the build from which the logs above come, the
notable point is that the host system indeed have a valid libei.so, but
is completely unrelated to erl_interface; it rather exposes the Emulated
Input protocol aimed at Wayland stack; and so it obviously contains none
of the expected ei_* symbols.
Upstream has already identified and fixed the issue, the fix is already
released in versions >= 27.x.y. Erlang 26 (the version currently
packaged in buildroot), isn't supported anymore (only the three latest
releases are supported, see
https://github.com/erlang/otp/blob/master/SECURITY.md), so there won't
be any new minor update that will release this fix.
Pick and backport the fixing patch so that the current version packaged
in buildroot can still build.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ea2135a56)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libheif/releases/tag/v1.23.2
Fixes the following CVEs:
(CVE numbers will be added upstream when assigned.)
CVE-2026-XXXXX (GHSA-g89c-p67h-r497)
Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha
planes from nested iden/auxl items. (critical)
(GHSA-2jg2-4ch7-h545)
Out-of-bounds read and write in derived-item and pixel-plane handling.
Through iden and auxl item chains, a crafted file could attach pixel
planes whose size differs from the image geometry; crop, scale, and
plane-extraction code then indexed those planes with the wrong size.
A working code-execution exploit was confirmed. Plane sizes are now
validated wherever they are consumed. (critical)
CVE-2026-XXXXX (GHSA-24wx-9w62-c96w)
brotli/zlib decompression of mime metadata and unci image data had no
effective output-size limit, so a decompression bomb could exhaust
memory. Decompressed output is now bounded by the security limits.
(high)
CVE-2026-XXXXX (GHSA-x8xm-cm2c-cfc8)
Chains of derived-image references (grid, iovl, iden) bypassed decode
caching and memory limits, causing CPU and memory amplification. (high)
CVE-2026-XXXXX (GHSA-xw34-mjcp-jqh8)
Sequence sample-timing initialization could produce non-terminating
decode loops and unbounded memory, bypassing max_sequence_frames.
(high)
CVE-2026-XXXXX (GHSA-j264-xvrp-5v7q)
Out-of-bounds write in the unci encoder when
heif_context_add_image_tile() is given a tile whose planes do not match
its declared size. (high)
CVE-2026-XXXXX (GHSA-p58j-h3vm-3fp5)
Heap out-of-bounds read in the inline-mask region API when
mask_data_len does not match the region geometry. (medium)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0fe2d74ffd)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since the bump of libxml2 from 2.13.8 to 2.15.0 in Buildroot commit
d81922c1ef, the "virt" plugin of
collectd no longer builds:
src/virt.c:2208:49: error: expected ';', ',' or ')' before 'ATTRIBUTE_UNUSED'
2208 | static void virt_eventloop_timeout_cb(int timer ATTRIBUTE_UNUSED,
| ^~~~~~~~~~~~~~~~
src/virt.c: In function 'register_event_impl':
src/virt.c:2221:26: error: 'virt_eventloop_timeout_cb' undeclared (first use in this function)
2221 | virt_eventloop_timeout_cb, NULL, NULL) < 0) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~
src/virt.c:2221:26: note: each undeclared identifier is reported only once for each function it appears in
This is due to the fact that the virt plugin code was incorrectly
using the ATTRIBUTE_UNUSED define, which was supposed to be an
internal define of libxml2. But it turns out that up to libxml2 2.14.0
and its commit 208f27f9641a59863ce1f7d4992df77f7eb0ea9d, this define
had been made publicly available. It could therefore mistakenly be
used by collectd's virt plugin... until libxml2 was upgraded.
We backport an upstream patch from collectd that fixes the issue.
Fixes:
https://autobuild.buildroot.net/results/4c8463f0372560f4c3a20b0f67854460f0d1c400/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 83fc4aa55e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit adds a simple bpftrace test that ensures that not only it
builds fine, but it also runs properly on a minimal test scenario.
Assisted-by: GPT-5.6
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien:
- reindent emulator.boot() options
- add a call to "bpftrace --version"
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e06cfae9cb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since Buildroot commit 25cb3813e7 which
bumped LLVM from 21.x to 22.x, the build of bpftrace is broken as
bpftrace 0.24.2 only supports LLVM up to 21.
We tried backporting the bpftrace patch that allows using LLVM up to
version 22 but the patch didn't apply cleanly but more importantly it
wasn't clear if this patch was sufficient. Therefore, we opt for
bumping bpftrace entirely to fix the issue.
Packaging changes:
- The new version of bpftrace no longer needs host-bison/host-flex,
because bpftrace is now using a handwritten parser.
- Pass -DUSE_SYSTEM_LIBBPF:BOOL=ON to ensure the system libbpf version
is used, and not the bundled version
- Now depends on kernel headers >= 5.10 because it needs CAP_BPF and
CAP_PERFMON
Upstream changelog:
https://github.com/bpftrace/bpftrace/blob/v0.26.1/CHANGELOG.md
Fixes:
https://autobuild.buildroot.net/results/a3e3fd696685864977c688aa11c2653357cf6207/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: add link to upstream changelog]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cc25888c88)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
bpftrace often needs very recent kernel headers, more recent than the
runtime version actually needed. We already had a workaround in
libbpf making sure that if the kernel headers are older than 6.1, we
would install the libbpf provided headers instead.
As we are about to update bpftrace to a newer version that uses
BPF_TRACE_KPROBE_SESSION, which was introduced in Linux 6.10, we need
to update this workaround accordingly and ensure that the libbpf
header is installed if the kernel headers are older than 6.10.
This is necessary for the update of bpftrace to 0.26.1.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e9c540ddd2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Based on the lighttpd test case. Verify that we can download index.html
from haproxy in front of lighttpd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 211cfafa16)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
haproxy has a runtime test to verify that it is built with -fwrapv:
haproxy
FATAL ERROR: invalid code detected -- cannot go further, please recompile!
The source code was miscompiled by the compiler, which usually indicates that
some of the CFLAGS needed to work around overzealous compiler optimizations
were overwritten at build time. Please do not force CFLAGS, and read Makefile
and INSTALL files to decide on the best way to pass your local build options.
Build options :
TARGET = custom
CPU = generic
CC = /home/peko/source/buildroot/output-haproxy/host/bin/arm-linux-gcc
CFLAGS = -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1
OPTIONS = USE_THREAD=1 USE_DL=1
DEBUG = -DDEBUG_STRICT -DDEBUG_MEMORY_POOLS
Which comes from:
https://github.com/haproxy/haproxy/blob/v2.6.0/src/haproxy.c#L3008-L3037
So build it with -fwrapv to fix that.
Notice that this message also embeds the build path (through CC), breaking
reproducible builds.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 94aa7f40b5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since upstream commit
e42e3193137d1b21e84b499336e7a8887b8a8689 ("intel: add Jay"), a C23
construct is used in the intel driver code:
enum jay_predication : uint8_t
This causes a build issue with GCC < 13:
In file included from ../src/intel/compiler/jay/jay_builder.h:12,
from ../src/intel/compiler/jay/jay_from_nir.c:23:
../src/intel/compiler/jay/jay_ir.h:582:22: error: expected identifier or ‘(’ before ‘:’ token
582 | enum jay_predication : uint8_t {
| ^
../src/intel/compiler/jay/jay_ir.h:637:25: error: field ‘predication’ has incomplete type
637 | enum jay_predication predication;
| ^~~~~~~~~~~
We fix that by integrating a patch already available in
OpenEmbedded. It changes the code to not use the C23 construct.
This build issue was encountered on host-mesa3d while building an
allyespackageconfig configuration inside our standard Docker
container.
Buildroot commit
c073c97617 ("package/{mesa3d,
mesa3d-headers}: bump version to 26.1.0") that switched to mesa3d
26.1.0, which contains the problematic commit. Therefore 2026.05 is
affected, but not earlier Buildroot versions.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 79554a4520)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
perl does not build with musl due to memrchr() being unavailable. This
is caused by a perl-cross bug, which does function availability
detection with _GNU_SOURCE defined, but then does the build without
_GNU_SOURCE defined. At least OpenEmbedded and NixOS have faced the
same issue, and worked it around in slightly different ways.
On our side, we create a patch, which was submitted upstream, to solve
the issue.
This issue has been introduced in perl-cross commit b40c560f5d5e,
which was first merged in perl-cross release 1.4.1. From a Buildroot
perspective, we bumped from perl-cross 1.4 to 1.4.1 in commit
8a289667f5, which was merged
2023.05. And indeed the build failure can be reproduced even on our
LTS 2025.02.x, so the fix needs to be backported there.
It should be noted that even if the patch is against perl-cross, we
add it to package/perl/ directly, as patches in perl are applied after
perl has been extracted *and* perl-cross has been extracted on top.
Fixes:
https://autobuild.buildroot.net/results/3e47ade0963642988fd8e1be9a6e8042700619ec/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d950fff290)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The BR2_PACKAGE_QT6DECLARATIVE_QUICK option has some logic to select
network support in host-qt6base if network support is enabled in
qt6base. However, it turns out that this is actually required at the
top level BR2_PACKAGE_QT6DECLARATIVE option: as soon as network
support is available in qt6base, the qt6declarative build will assume
that qmlprofiler is available... but that requires network support in
host-qt6base.
This fixes the following build failure:
CMake Error at /home/thomas/autobuild/instance-2/output-1/build/qt6base-6.9.1/cmake/QtToolHelpers.cmake:784 (message):
Failed to find the host tool "Qt6::qmlprofiler". It is part of the
Qt6QmlTools package, but the package did not contain the tool. Make sure
that the host module Qml was built with all features enabled (no explicitly
disabled tools).
Call Stack (most recent call first):
/home/thomas/autobuild/instance-2/output-1/build/qt6base-6.9.1/cmake/QtToolHelpers.cmake:83 (qt_internal_find_tool)
tools/qmlprofiler/CMakeLists.txt:11 (qt_internal_add_tool)
Fixes:
https://autobuild.buildroot.net/results/72c956fdf982382d2981c649c456d1edc2c9d6b2/
We did not trace back exactly since when the problem exists, but we
verified that the problem exists in 2025.02.x. It can be reproduced
with the following defconfig:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_QT6BASE_NETWORK=y
BR2_PACKAGE_QT6DECLARATIVE=y
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 50a1dd2676)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The commit "Enable host test module to ensure that qmltestrunner is
built" in qt6declarative's Config.in feels lonely under
BR2_PACKAGE_QT6DECLARATIVE. It's because it's actually related to a
select done in the sub-option BR2_PACKAGE_QT6DECLARATIVE_QUICK, so
move it there.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29add67666)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit [1] (package/apache: use "Debian" filesystem
layout to fix read-only rootfs) changed the filesystem layout.
This had the effect of installing files to different locations
and breaking the test_php runtime test.
This commit fixes the issue by updating the file paths to their
right locations. The "httpd.conf" was updated by following the
same recipe described in the comment (starting from a config
file as installed by the apache Buildroot package).
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152979
[1] 1006666f67
Signed-off-by: Julien Olivain <ju.o@free.fr>
Tested-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 23fd881bdb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In commit 54f96add94 ("package/bind:
security bump version to 9.20.24") the depends on
BR2_TOOLCHAIN_HAS_THREADS_NPTL was incorrectly downgraded to
BR2_TOOLCHAIN_HAS_THREADS:
- depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # libuv
+ depends on BR2_TOOLCHAIN_HAS_THREADS # liburcu, libuv
This is wrong because libuv depends on
BR2_TOOLCHAIN_HAS_THREADS_NPTL. This causes unmet dependencies:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_LIBUV
Depends on [n]: BR2_TOOLCHAIN_HAS_THREADS_NPTL [=n] && BR2_USE_MMU [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y] && BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 [=y]
Selected by [y]:
- BR2_PACKAGE_BIND [=y] && BR2_USE_MMU [=y] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y] && BR2_TOOLCHAIN_HAS_THREADS [=y] && BR2_INSTALL_LIBSTDCPP [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 [=y] && BR2_PACKAGE_LIBURCU_ARCH_SUPPORTS [=y]
Fix that by switching back to the BR2_TOOLCHAIN_HAS_THREADS_NPTL
dependency.
Fixes: 54f96add94 ("package/bind: security bump version to 9.20.24")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d8dde961bc)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
- CVE-2026-19654:
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw
in the optional imptcp module. A crafted input sequence during
oversize-frame recovery can cause an invalid internal message length
and terminate rsyslogd. No confidentiality or integrity impact,
privilege escalation, or code execution has been identified. imtcp and
the default imptcp framing modes are not affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-19654
- 07b3c40a5a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 52ae04257a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
See the changelog:
- https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2
It fixes the following vulnerabilities:
- CVE-2026-14586: Assertion in libngtcp2 when under pressure in high
concurrency DNS-over-QUIC environments.
- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to
`quic-size` budget bypass.
- CVE-2026-40691: Packet of death for DNSCrypt over TCP.
- CVE-2026-41637 Degradation of resolution service from improperly
accounted client-terminated DNS-over-QUIC queries.
- CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the TTL of
A/AAAA records disallowing a one-time 'ghost domain' delegation
renewal via glue records.
- CVE-2026-44621: Libunbound applications configured with
'unwanted-reply-threshold' could eventually be abruptly terminated.
- CVE-2026-44687: Off-by-one error in 'harden-below-nxdomain' logic can
shadow a stub/forward zone by a legitimate parent's NXDOMAIN.
- CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels
manipulation.
- CVE-2026-46582: A wildcard replay, as another piece of data, triggers
poisoning in the serve expired reply path.
- CVE-2026-50045: 'max-global-quota' reset by DNSSEC validation
restarts.
- CVE-2026-50046: Possible heap use-after-free in an error path when a
DoT forwarded query is jostled out.
- CVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers instead
of returning SERVFAIL.
- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in
auth/rpz zones.
- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers
defensive full-cache flush.
- CVE-2026-50252: Possible cache poisoning attack by mapping source port
population per thread.
- CVE-2026-52863: Memory corruption could lead to crash and denial of
service.
- CVE-2026-54478: DNS Cookie bypass when combined with proxy-protocol
use.
- CVE-2026-55708: Privacy/configuration issue when adding local data in
views through 'unbound-control'.
- CVE-2026-55717: 'serve-expired-client-timeout' and 'response-ip' CNAME
redirect could lead to a crash.
- CVE-2026-55973: 'dns-error-reporting: yes' leads to stack buffer
overflow.
- CVE-2026-55990: Packet of death for a DNSCrypt misconfigured Unbound.
- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion
failure in libngtcp2.
- CVE-2026-56416: Possible heap buffer overflow when validator
canonicalizes RDATA that contains domain name.
- CVE-2026-56444: Degradation of resolution service when
'discard-timeout' and 'serve-expired-client-timeout' are combined in
unusual configuration.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d0619dfc6b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This release includes a broad round of hardening against malformed and
adversarial input across the Python SDK (bounding allocations and enforcing
decompression limits before trusting size fields read from the input).
See the release notes https://avro.apache.org/blog/2026/08/12/avro-1.12.2/
Also update the download url, because www-eu.apache.org/dist/...
is a redirection to downloads.apache.org/...
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 02d8a41f09)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/openssl/openssl/releases/tag/openssl-3.6.4
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
Fixed RPK server signature algorithm selection being able to dereference
a missing certificate.
(CVE-2026-14457)
Fixed excessive memory use buffering DTLS records for a future epoch.
(CVE-2026-54874)
Fixed client-side memory leak in OCSP response checking.
(CVE-2026-54876)
Fixed untrusted Sender DN being used as a format string in CMP response
validation.
(CVE-2026-63073)
Fixed CMP indefinite cache growth of extraCerts.
(CVE-2026-63074)
Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
(CVE-2026-63075)
Fixed possibility of AEAD forgeries with empty ciphertext when using
EVP_Cipher().
(CVE-2026-75803)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 198317785a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In some situations (old Linux <3.17 or glibc <2.25), expat fail at
compilation time with the error:
xmlparse.c:150:4: error: #error You do not have support for any sources of high quality entropy enabled.
For end user security, that is probably not what you want. Your options include:
* Linux >=3.17 + glibc >=2.25 (getrandom): HAVE_GETRANDOM,
* Linux >=3.17 + glibc (including <2.25) (syscall SYS_getrandom): HAVE_SYSCALL_GETRANDOM,
* BSD / macOS >=10.7 / glibc >=2.36 (arc4random_buf): HAVE_ARC4RANDOM_BUF,
* BSD / macOS (including <10.7) / glibc >=2.36 (arc4random): HAVE_ARC4RANDOM,
* BSD / macOS >=10.12 / glibc >=2.25 (getentropy): HAVE_GETENTROPY,
* Linux (including <3.17) / BSD / macOS (including <10.7) / Solaris >=8 (/dev/urandom): XML_DEV_URANDOM,
* Windows >=Vista (rand_s): _WIN32.
If you insist on not using any of these, bypass this error by defining XML_POOR_ENTROPY and be vulnerable to hash flooding;
you have been warned. If you have reasons to patch this detection code away or need changes to the build system, please open a bug. Thank you!
This is caused by the upstream commit [1] "Autotools: Stop using
/dev/urandom by default", first included in expat 2.8.2. The
Buildroot expat package was bumped to that version in commit [2].
But since all Linux systems have /dev/urandom, we can just enable
it by default.
Note: this commit does not globally switch the entropy source to
/dev/urandom. It is rather enabling it in the list of available
sources. On more recent Linux systems (linux >= 3.17, glibc >= 2.25),
other sources will be chosen. The entropy source preference order
amongst the enabled sources is defined in [3].
This commit also changes the _CONF_OPTS to multiline layout to fit
within the 80 characters.
[1] d30eca113a
[2] 6b1f6f7a48
[3] https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/lib/xmlparse.c#L1115-L1142
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add extra info in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c22fc74f2b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since gdb 9.x, gdb can optionally use the xxhash library. Since we
currently don't do anything about it, it's a potential "silent"
dependency.
In particular, for host-gdb, this means host-gdb might end up being
linked with the system-provided xxhash library if available.
This patch handles this dependency:
- For the target package, by looking at the value of
BR2_PACKAGE_XXHASH
- For the host package, by looking at the value of a newly introduced
BR2_PACKAGE_HOST_GDB_XXHASH
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9dc567aa78)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
For target gdb, we properly enable/disable lzma support depending on
BR2_PACKAGE_XZ.
However, for host-gdb we don't do anything, which can lead the gdb
configure script to detect and use a system-provided xz library, which
is not desired.
Instead, add an explicit option BR2_PACKAGE_HOST_GDB_LZMA, which when
enabled pulls in host-xz, but also when disabled ensures gdb doesn't
try to use a system-provided xz library.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c3adba81d1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In commit a2380157f6 ("toolchain: enable
libquadmath for PowerPC with VSX"), the definition of
BR2_TOOLCHAIN_HAS_LIBQUADMATH has been extended to also be true when
BR2_POWERPC_CPU_HAS_VSX.
However, practical experiments show that when 64-bit VSX-capable cores
are used in 32-bit mode, libquadmath is not built by GCC, causing
build failures:
cp: cannot stat '/home/autobuild/autobuild/instance-3/output-1/host/powerpc-buildroot-linux-musl/lib*/libquadmath*': No such file or directory
We did an extensive testing, building the 27 combinations of:
- GCC versions: 14, 15, 16
- C library: glibc, uclibc, musl
- PowerPC 32-bit, PowerPC 64-bit, PowerPC 64-bit little endian
This testing provides the following results:
| gcc14 | powerpc64 | glibc | OK |
| gcc14 | powerpc64le | glibc | OK |
| gcc14 | powerpc64le | musl | OK |
| gcc14 | powerpc64le | uclibc | SKIPPED |
| gcc14 | powerpc64 | musl | OK |
| gcc14 | powerpc64 | uclibc | SKIPPED |
| gcc14 | powerpc | glibc | FAILED |
| gcc14 | powerpc | musl | FAILED |
| gcc14 | powerpc | uclibc | FAILED |
| gcc15 | powerpc64 | glibc | OK |
| gcc15 | powerpc64le | glibc | OK |
| gcc15 | powerpc64le | musl | OK |
| gcc15 | powerpc64le | uclibc | SKIPPED |
| gcc15 | powerpc64 | musl | OK |
| gcc15 | powerpc64 | uclibc | SKIPPED |
| gcc15 | powerpc | glibc | FAILED |
| gcc15 | powerpc | musl | FAILED |
| gcc15 | powerpc | uclibc | FAILED |
| gcc16 | powerpc64 | glibc | OK |
| gcc16 | powerpc64le | glibc | OK |
| gcc16 | powerpc64le | musl | OK |
| gcc16 | powerpc64le | uclibc | SKIPPED |
| gcc16 | powerpc64 | musl | OK |
| gcc16 | powerpc64 | uclibc | SKIPPED |
| gcc16 | powerpc | glibc | FAILED |
| gcc16 | powerpc | musl | FAILED |
| gcc16 | powerpc | uclibc | FAILED |
The "SKIPPED" are when the configuration is not possible: uClibc
doesn't support powerpc64 or powerpc64le.
Then, as we can see, the build fails for all "powerpc"
configuration. Our conclusion is therefore that libquadmath is not
supported on PowerPC 32-bit. While we were not able to find direct
evidence in the gcc code base, this practical experiment shows that is
simply doesn't work on PowerPC 32-bit.
So, we take the logical action of adjusting
BR2_TOOLCHAIN_HAS_LIBQUADMATH so that it is true only on
powerpc64/powerpc64le.
Fixes:
https://autobuild.buildroot.org/results/46d435c9f5086a8695f4f6cd4026bb0d194de13c/
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 06426297c4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Fixes a build error caught by the Gitlab pipelines:
/builds/bkuhls/buildroot/br-test-pkg/bootlin-aarch64-glibc-old/build/taglib-2.3/taglib/mpeg/mpegfile.cpp:113:10:
error: expected primary-expression before ‘const’
if(const Header header(&file, headerOffset + i, true); header.isValid()) {
which was introduced by code format changes in upstream commit
dfe2aa5253
which was first released with taglib 2.0, added to buildroot with commit
9cd3464afa.
This "init-statement" C++17 language feature was described in proposal
P0305R1, and according to
https://en.cppreference.com/cpp/compiler_support/17, this feature was
only supported in gcc starting from gcc 7.x.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d16e4939ca)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
host-libxml-parser-perl compiles XS modules against the system perl
headers, which #include <crypt.h>. On build hosts without libcrypt-dev
installed, the build fails:
.../CORE/reentr.h:126:16: fatal error: crypt.h: No such file or directory
Declaring host-libxcrypt ensures crypt.h is present in the per-package
host sysroot before the build.
This can for example be reproduced on a minimal Debian Forky system,
where libc6-dev no longer pulls libxcrypt-dev.
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7e036c739f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit bb38f6f720 bumped the
package to 3.2.0. This version first included upstream commit
ed00e0f4b3
which removed the dependency to libm causing build errors detected by
the autobuilders.
Disabling the build of tests by the previous patch of this series is not
enough because the build will fail on other tools like
[ 98%] Linking C executable djpeg-static
/home/bernd/buildroot/output/per-package/jpeg-turbo/host/bin/../lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
src/spng/CMakeFiles/spng-static.dir/spng.c.o: in function
`spng_decode_image':
spng.c:(.text+0x4c62): undefined reference to `__fpclassifyf'
Add upstream commit to fix the problem.
Fixes:
https://autobuild.buildroot.net/results/981/98114d4ea7afe62bb4cef934a06bf289d863ad3f/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c0a51767a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit c531fe6520 bumped the
package to 3.1.2. This version first included upstream commit
942ac87e47
which added configure options to disable the build of command-line
tools and tests.
This patch replaces the current _POST_INSTALL_TARGET_HOOK with the new
configure option and disables the build of tests.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d74a065a16)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit 8b1d8dd25d bumped the
package from 1.4.3 to 1.5.1 which includes upstream commit
8d485b9bfd
that adds the usage of the OpenSSL crate from rust.
This crate depends on DES and causes build errors when missing:
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cfb8'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cbc'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cfb64'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_ecb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ecb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_ofb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_cbc'
Fixes:
https://autobuild.buildroot.net/results/b93/b9359c5c177f3e4bcef991cde3c2dcf412dee5de/https://autobuild.buildroot.net/results/300/300721a882f3410528878db730aaff1aa6822986/https://autobuild.buildroot.net/results/a16/a163a9229c04f638a46e6250dc135c475e5d1576/https://autobuild.buildroot.net/results/7e8/7e88cba9974f6f5acd125b69b95b7269d8128886/
A backport to LTS branches should be considered.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c4f41f4f3f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Commit 713d63b "package/webkitgtk: add option to enable MiniBrowser",
added support to select BR2_PACKAGE_WEBKITGTK_MINIBROWSER, but forgot
to drop the default -DENABLE_MINIBROWSER=ON entry.
Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Acked-By: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9f292bb7a1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
For change log since v2.4.7, see:
https://github.com/FluidSynth/fluidsynth/releases
According to:
https://github.com/FluidSynth/fluidsynth/blob/master/doc/wiki/ChangeLog.md
FluidSynth 2.5.6 fixes:
CVE-2026-58264 - a heap-based buffer overrun in command handler (GHSA-mqmq-w63q-cj94)
CVE-2026-61714 - a heap-based buffer overflow in MIDI player (GHSA-976m-35rw-h3m6)
CVE-2026-61721 - a heap-based buffer overrun for DLS samples (GHSA-59ph-rx8r-8p4j)
CVE-2026-61723 - a DLS ptbl chunk integer overflow (GHSA-r4mc-v3p8-pv47)
CVE-2026-61722 - a DLS articulation chunk integer overflow (GHSA-hp72-35pr-6h6r)
CVE-2026-61720 - a SF2 DMOD chunk integer underflow (GHSA-rmc4-c8hw-455w)
FluidSynth 2.5.2 fixes:
CVE-2025-68617 - a heap-based use-after-free involving DLS files (GHSA-ffw2-xvvp-39ch)
SDL2 audio support was removed upstream in commit:
89145b004a
It was replaced by the newer SDL3. This commit reflects that change
(update option name and comments, add legacy option entry).
Also, dynamic library dependency was added in Buildroot commit:
111a1c7091
This commot removes the duplicate dependency for SDL3.
FluidSynth also added a native DLS soundfont support in:
c959f8d208
It is enabled by default and uses C++17. This commit adds a new
option with a dependency on gcc >= 7.
The license option hash is also updated, after the FSF address
update in:
db42fa333b
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 566bdcb97f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
In both start() and stop(), ret is only assigned on failure. When
hypervkvpd starts or stops successfully, return "$ret" expands to an
empty string and causes:
/etc/init.d/S10hyperv: return: line 31: Illegal number:
Those double quotes were added in Buildroot commit [1], to fix a
new ShellCheck warning at that time. This was not a complete fix.
Only removing the double quote would reintroduce the ShellCheck
warning. This would also reintroduce a check-package error.
Since a bare return is equivalent to a "return 0", this commit
also initializes with ret=0. Doing so will tell ShellCheck "ret" is
an integer. Therefore, the ShellCheck warning will no longer be
reported.
This commit fixes the invalid return value by removing the double
quotes and initialzing "ret=0".
[1] c4173d8b08
Signed-off-by: Benjamin DeCamp <benjamin8532@protonmail.com>
[Julien:
- add "ret=0" initialization in script to fix check-package error
- add extra info in the commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 667335cd18)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
enscript currently fails to build with musl with gcc >= 15. In order
to fix this, we need to bring a number of patches from upstream, and
add 2 others that were submitted upstream.
From upstream, we bring
0002-Add-CFLAG-std-c89-so-it-compiles-with-the-old-standa.patch, which
switches to -std=c89 to get the compiler back to "old" behavior.
However, as this commit patches configure.ac, we need to autoreconf,
but autoreconf is broken, so we also take
0003-Automake-1.12-and-up-no-longer-supports-pre-ANSI.patch from
upstream, which drops a problematic autoconf macro.
However, once you drop this problematic autoconf macro, the PROTOTYPES
define is never set by anything, causing the __P macro to no longer be
defined properly. This is fixed by
0004-Fix-prototype-detection-when-__STDC__-is-defined-but.patch that
we have submitted upstream.
Once you're there, you realize that switching to -std=c89 has the side
effect that musl's <limits.h> no longer defines PATH_MAX, because it
needs one of:
#if defined(_POSIX_SOURCE) || defined(_POSIX_C_SOURCE) \
|| defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) || defined(_BSD_SOURCE)
and a side effect of -std=c89 is that none of these is defined
anymore. So we introduce 0005-Use-std-gnu89-instead-of-std-c89.patch,
which switches to -std=gnu89. This patch has also been submitted
upstream.
With all of these efforts, we get a successful build on musl with gcc
>= 15.
This commit needs to be backported to Buildroot versions that support
gcc 15.x, so that means the currently maintained 2026.x branches, but
not 2025.02 as only up to gcc 14.x was supported then.
Fixes:
https://autobuild.buildroot.org/results/d39d14bbbb3a51d67fe962b877c7f66ff1204ecf/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit edffc0bc50)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66035.
The ETM decrypt path does not validate the received packet length before
calculating the decrypt buffer size. A malformed packet can therefore
lead to a heap overflow.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 03757abfce)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66034.
The publickey subsystem does not sufficiently validate the length of a
server-controlled comment field. A malformed response can therefore
cause an out-of-bounds read.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 58581deeca)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66033.
The OpenSSL AES-GCM cipher path lacks runtime bounds checks around the
input block size. A malformed packet can therefore lead to an
out-of-bounds read or write.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6755a00cd2)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the fix for CVE-2026-66032.
A SFTP error path can leave a dangling pointer after freeing the
response buffer, which may result in a double free on subsequent error
handling.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 05c13e87e9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the SFTP symlink bounds checking fix for CVE-2025-15661.
The initial fix requires the LIBSSH2_UNCONST compatibility backport on
libssh2 1.11.1. Also include the upstream follow-up fixing
SSH_FXP_STATUS handling introduced by the initial security fix.
The patches are based on the upstream fixes and Debian's libssh2 1.11.1
backports.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 546fd31c70)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Since upstream commit 89a86dcb0a3248606824de50f5c63f61cfe0369c (first
release: 106) if cargo exists on PATH the Dracut configure script
enables building dracut-cpio by default, and calls "cargo --version"
to check if cargo works. This fails on the autobuilders:
error: rustup could not choose a version of cargo to run, because one wasn't specified explicitly, and no default is configured.
help: run 'rustup default stable' to download the latest stable release of Rust and set it as your default toolchain.
dracut couldn't find cargo for dracut-cpio build
The affected configs either don't have BR2_PACKAGE_HOST_RUSTC enabled,
or build-time.log.gz shows host-rustc was not installed before the
host-dracut build, so presumably the "cargo" that produces the rustup
error is an external one already installed on the autobuilders.
To fix this, enable dracut-cpio only if BR2_PACKAGE_HOST_RUSTC=y, and
add a dependency on host-rustc in that case. According to the
documentation [1, see "enhanced_cpio"] dracut-cpio is supposed to
optimize archive creation for copy-on-write filesystems, so it should
not matter much for Buildroot. The --disable-dracut-cpio option was
added in upstream commit 4a4ab928a49e81e02104ec5466160664e59c3965
(same release).
Fixes: https://autobuild.buildroot.org/results/5f557d708cce997e7f039f17e30640b02ba9180a/
Fixes: https://autobuild.buildroot.org/results/f04ca3c4598f62a7e87d84bc111eb8b161b34a70/
(and more)
[1] https://dracut-ng.github.io/dracut/man/dracut.conf.5.html#_configuration_options
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ff7f973a16)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the upstream fix for a heap buffer overflow in
convert_fname() when growing the iconv output buffer.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e991fa0716)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the upstream fix for integer overflows while parsing
Content-Range headers, together with the follow-up fix using
strtoll() for wgint values.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 89485adb29)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Backport the upstream fix for a buffer underflow in
clean_metalink_string(), together with the two required follow-up
fixes for the inverted whitespace check and missing ctype.h include.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 937e33237e)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The Arc specific gdb version was removed by commit [1]
but we still have the TestGdbArc that was testing this
version of gdb.
We can now safely remove TestGdbArc.
[1] 0b3d526226
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2f6b34f851)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
When a package defines $(PKG)_FLAT_STACKSIZE, ELF2FLT_FLAGS contains
-Wl,-elf2flt="-r -s<stack-size>". The embedded quotes are needed to
keep both elf2flt options in single linker argument.
However, many package Makefiles wrap $(TARGET_CFLAGS) in double quotes,
for example:
CFLAGS="$(TARGET_CFLAGS)"
After expansion, the embedded quote terminates the outer CFLAGS quote.
As a result, the shell interprets "-s<stack-size> ..." as a command
instead of passing it to the compiler.
Pass -r and -s<stack-size> in separate -Wl arguments instead. This
avoids embedded quotes; GCC forwards both -elf2flt options to
ld-elf2flt, which collects them before invoking elf2flt.
This got broken by commit
04d7ea4720 ("package: Makefile.in: fix
elf2flt invocation options"), which by adding -r as an elf2flt
argument, did not correctly handle -s$($(PKG)_FLAT_STACKSIZE).
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
[Thomas: improve commit message]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e913afbeb1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wine.mk passes --with-wayland whenever BR2_PACKAGE_WAYLAND is enabled,
but nothing guarantees the rest of what wine's Wayland test needs is in
the configuration. That test is:
WINE_NOTICE_WITH(wayland, [test -z "$WAYLAND_CLIENT_LIBS" \
-o -z "$WAYLAND_SCANNER" -o -z "$XKBCOMMON_LIBS" \
-o -z "$XKBREGISTRY_LIBS" -o "$ac_cv_header_linux_input_h" = "no"], ...)
and because --with-wayland is passed explicitly, WINE_NOTICE_WITH turns
into AC_MSG_ERROR rather than a notice.
So wine needs libxkbcommon, and it needs the libxkbregistry part of it,
which is only built when libxml2 is available. Select both when Wayland
support is enabled, and add libxkbcommon to the build dependencies.
Note that libxml2 is not a direct dependency of wine, it only has to be
in the configuration so that libxkbcommon builds libxkbregistry; the
build ordering is handled by libxkbcommon's own dependency on libxml2.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a5e7f7af9f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
libxkbregistry is the keyboard layout catalogue half of the library. It
parses the XML layout registry and so needs libxml2, which is presumably
why it was disabled unconditionally rather than wired to a dependency.
wine needs it. Its configure.ac requires XKBREGISTRY_LIBS alongside
wayland-client, wayland-scanner, xkbcommon and linux/input.h before it
will build the Wayland driver, and wine.mk passes --with-wayland for any
build with BR2_PACKAGE_WAYLAND - which turns that notice into a hard
error:
checking for wayland-client.h... yes
checking for wl_display_connect in -lwayland-client... yes
checking for wayland-scanner... .../host/bin/wayland-scanner
checking for xkb_context_new in -lxkbcommon... yes
checking for wayland-egl.h... yes
checking for wl_egl_window_create in -lwayland-egl... yes
configure: error: Wayland development files not found, the Wayland
driver won't be supported.
This is an error since --with-wayland was requested.
Every other term of that test passes; only XKBREGISTRY_LIBS is empty, so
wine and wayland together could not be built on any architecture.
Gated on BR2_PACKAGE_LIBXML2 rather than turned on outright, because
meson.build takes dependency('libxml-2.0') unconditionally once
enable-xkbregistry is set, so a target without libxml2 would fail to
configure.
Regarding since when this is broken, three pieces had to come together:
- libxkbcommon has passed -Denable-xkbregistry=false since commit
1791bc30a5 ("package/libxkbcommon: bump version to 1.0.1", Sep 2020),
i.e. Buildroot 2020.11. libxkbregistry has therefore never been built
in Buildroot.
- wine's configure gained the XKBREGISTRY_LIBS term in its Wayland
test in wine 9.0, with upstream commit d64ea8e4a6c9
("winewayland.drv: Enumerate Xkb layouts and create matching HKL.",
Nov 2023).
- wine.mk started passing --with-wayland in commit 7cb49e7712
("package/wine: bump to version 9.19", Oct 2024), which is what turns
the missing XKBREGISTRY_LIBS from a notice into a hard error.
The breakage therefore dates from Buildroot 2024.11, and every branch
since is affected, including the LTS one: 2025.02.x carries wine 10.0,
whose configure has the XKBREGISTRY_LIBS check, together with
libxkbcommon 1.9.2 built with -Denable-xkbregistry=false, and its wine.mk
passes --with-wayland. 2025.05.x and 2025.08.x are in the same state.
A backport to 2025.02.x is thus needed.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4349b22b91)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Fixes the following security issues:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging up to two sumdb
tiles that allow for a requested module to bypass the GOSUMDB check and
persist attacker-controlled module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve malicious module
content that cannot be detected by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.
- x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup
A malicious GOSUMDB was capable of serving arbitrary module content not
contained within the transparency log.
This attack allows for a coordinating GOPROXY and GOSUMDB to serve a
client malicious module content that cannot be detected by evaluating
the transparency log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.
- encoding/xml: add recursion depth guard during decode
Previously, DecodeElement would reset the depth counter causing it to
never fire; this could lead to stack exhaustion.
This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.
- net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check
When a server is configured to support unencrypted HTTP/2, it reads a few
bytes from each new connection to see if they contain the HTTP/2 client
preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.
This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.
- net/url: avoid quadratic complexity in resolvePath
Previously, resolving relative paths containing parent directory (..)
segments performed string conversions and buffer rewrites on each step,
resulting in quadratic time complexity and high memory allocation
overhead.
Now, path resolution operates on a byte buffer using index-based
backtracking for .. segments, eliminating the quadratic time complexity
and significantly reducing memory allocations.
This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.
- golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record
Parsing an invalid SVCB or HTTPS RR can panic when the size of a
parameter value overflows the message buffer.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.
- crypto/tls: limit handshake messages we are willing to accept post-handshake
Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.
Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.
- html/template: fix Javascript regexp context tracking
Previously, pathological inputs could close an unescaped / early,
allowing for attack-controlled data to inject arbitrary content,
potentially leading to XSS.
Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.
- x/net/idna: failure to reject ASCII-only Punycode-encoded labels
The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded
labels that decode to an ASCII-only label. For example,
ToUnicode("xn--example-.com") incorrectly returned the name "example.com"
rather than an error.
The idna package implements the processing algorithm from UTS 46. Older
versions of UTS 46 included a specification bug which permitted multiple
ASCII labels to decode to the same Unicode label. UTS 46 revision 33
fixed the specification bug. The idna package now implements the updated
specification.
This behavior can lead to privilege escalation in programs using the idna
package. For example, a program which performs privilege checks on the
ASCII hostname may reject "example.com" but permit "xn--example-.com".
If that program subsequently converts the ASCII hostname to Unicode, it
will inadvertently permits access to the Unicode name "example.com".
Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.
- encoding/asn1: enforce maximum recursion depth
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9e9110bf23)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Bugfix release with large number of (security) fixes.
HAProxy 2.6.32 was released on 2026/07/29. It added 33 new commits
after version 2.6.31.
As for the 2.8.27, the announce is an expurgated copy-paste of the 3.4.3
announce:
* stats: Two issues about the stats page, reported by Red Hat/AISLE
Research, were fixed.
Proxies updated through the stats page while in "stats admin" mode were
not subject to the "stats scope" filtering, meaning a scope meant to
restrict which proxies are visible/actionable could be silently bypassed
on POST requests.
Separately, POST requests to the stats interface did not validate that the
Origin (or Referer) header matched the Host, which is now checked to
mitigate CSRF attacks.
* ssl-gencert: A memory leak on every certificate generation was fixed.
Two temporary buffers were not freed after generating a certificate on the
fly, leaking memory each time a new SNI triggered certificate
generation. This issue was reported by Red Hat/AISLE Research.
* sample/protobuf: buffer overflows after pointer-shift converters, reported
by Red Hat/AISLE Research and Charles Vosburgh, were fixed.
Several converters (protobuf/ungrpc field extraction, ltrim())
move the sample's data pointer forward on success but did not shrink the
sample's recorded buffer capacity accordingly. A converter chained
afterwards that relies on that capacity (e.g. padding via memset()) could
then write past the end of the buffer, leading to heap corruption or a
worker crash. All the affected converters now adjust the capacity
together with the pointer.
* protobuf: A nested-path validation bypass reported by Red Hat/AISLE
Research was fixed.
The protobuf field lookup used for the protobuf()/ungrpc() converters did
not strictly enforce hierarchical boundaries, so a flat sibling field
could incorrectly satisfy a nested-path lookup (e.g. matching a root-level
field as if it were nested under a parent). The lookup was rewritten as a
strict, non-recursive path walker that correctly bounds each nesting
level.
Separately, a crash because of deprecated protobuf group wire types was
fixed. These wire types are now explicitly rejected.
* http-fetch: Two crashes reachable from health-check configurations were
fixed.
"res.body"/"res.hdr"/... and similar response fetches assumed the
health-check receive buffer always held an HTX message, which is only true
for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server
could craft the first bytes of its reply to be misinterpreted as HTX
internal fields, causing a wild read and worker crash (or leaking
arbitrary process memory).
Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper
bound of their index argument, so a negative capture id was accepted at
boot and dereferenced an out-of-bounds array entry at runtime, crashing
the worker on the very first request.
* slz: Several issues were fixed in the SLZ library.
A stream alternating many literals in the 144-255 range with cheap
back-references could keep inflating indefinitely instead of falling
back to a stored block, exceeding the library's documented worst-case
output size by several percent. A new accounting mechanism now bounds
this overhead. Practical impact on haproxy requires tune.bufsize above
~43 kB with the default reserve.
Five small correctness fixes inherited from upstream libslz were also
backported: Avoid reading up to a few bytes past the end of very short
inputs on architectures without fast unaligned access; stop appending an
extra, misplaced block to an already-finished deflate/gzip/zlib stream
(which could corrupt the trailing checksum in ~2% of fuzzed streams); fix
the Adler32 checksum accumulator sign handling on 32-bit systems
(affecting the zlib format only); avoid an undefined-behaviour signed left
shift when assembling input words byte by byte; and use the exact bit cost
when deciding whether to emit the last literals of a block as a stored
block, avoiding compressed output slightly larger than the documented
worst case.
* peers: A heap overflow when replicating large stick-table dictionary
entries was fixed.
peer_prepare_updatemsg() never verified that a stick-table entry's
dictionary value (e.g. server_key, up to ~16 kB) actually fit in the
update message being built. Since the peers protocol is plain-text and
unauthenticated, a rogue or compromised peer could plant an oversized
entry that overflows the 16 kB trash buffer as soon as the victim
replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The
function now checks the available room before encoding and fails cleanly
if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo
Inc.
And, as usual, the bunch of minor fixes here and there, mainly raised during
AI-assisted code reviews. Most were never noticed:
* HTX API: Some bugs about how the HTX API was used were fixed here and
there.
* http-act: Double-frees and a couple of state bugs on parsing errors were
fixed.
* http-fetch/http-ana/http-htx: Few out-of-bounds reads were fixed.
* http-conv: The last input character could be lost when calling url-dec
converter, when the input buffer was full. This was fixed by failing the
converter in that case.
* mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages
because the end of the message was not always properly detected. This
case is now properly handled.
* sample: An edge case in be2hex() was fixed.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47353.html
Signed-off-by: Fred Lefranc <fred.lefranc.evs@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 335a57525f)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
With this the test verifies not only that Apache can work in
principle, but also that it works with a read-only rootfs. Because of
the read-only rootfs the test itself cannot write to /root, so store
the test download in /tmp.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0c349a8813)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The previous configuration placed both logs and PID file in /var/logs,
which is not writable with a read-only rootfs (e.g. squashfs), as well
as non-standard. Starting HTTPD during boot failed with:
(30)Read-only file system: AH00091: httpd: could not open error log file /var/logs/error_log.
AH00015: Unable to open logs
An additional issue was that the Buildroot-default --prefix=/usr
override meant various Apache-internal directories (e.g. htdocs) were
placed directly in /usr. Note that the upstream default prefix is
/usr/local/apache2, not /usr/local.
Using the "Debian" layout provides a standard-compatible layout with
logs in /var/log/apache2 and PID file in /var/run/apache2 (both in
tmpfs with the default Buildroot fstab). Both directories need to
exist when the server starts, so handle that in the init script.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1006666f67)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
https://www.openssh.org/releasenotes.html#10.5p1
Changes since OpenSSH 10.4
==========================
This release contains a number of security fixes and small bugfixes.
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind@openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
Reported by sn0x-sharma
* ssh(1): avoid potential realloc use-after-free in the client if a
remote forwarding is added via the local session multiplexing
socket while a remote forwarding open request is pending with the
server. Report and fix from Brian Mingus of Cognatory
* sshd(8): make the authorized_keys "restrict" keyword apply
correctly to tunnel forwarding too (which is administratively
disabled by default). Reported by Erichen, Institute of Computing
Technology, Chinese Academy of Sciences
[...]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 054358ba9b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
host-flex/host-bison are needed when building GCC from Git or from a
snapshot, not from release tarballs. The condition for the dependency
was actually incorrect: it was needed for the ARC-specific gcc
version (BR2_GCC_VERSION_ARC) but not for the ARC architecture in
general: building upstream GCC release tarballs for ARC does not
require host-flex/host-bison.
Cc: ARC Maintainers <arc-buildroot@synopsys.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4f867f1039)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
A new (and hopefully definitive) CPE is to be used for TF-A:
cpe:2.3:o:trustedfirmware:trusted_firmware-a:
as reported in TF-A directly[1]. NVD correctly reports[2] the new CPE
deprecates the "old" one Buildroot was using.
CVEs for projects under the TrustedFirmware umbrella are now seemingly
handled under the CPE vendor "trustedfirmware".
[1] efd7b189fa%5E%21/
[2] https://nvd.nist.gov/products/cpe/detail/2E1BD3E8-DF65-42E3-A0BA-747137D6DEF2
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b7cf802ace)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Changes:
Security and robustness release. Notable cramfsck changes:
* Reject dirent names containing "/", "." or ".." to close a path
traversal during `cramfsck -x` (reported in issue #12).
* Open regular files with O_CREAT|O_EXCL during extraction to
prevent duplicate-dirent attacks from truncating files reached
via a previously-extracted symlink.
* Fix outbuffer NUL termination and a 1-byte overflow in
do_symlink when running with both -v and -x.
* Harden romfs_read against truncated/malformed images by
zero-filling the window buffer and checking lseek/read returns.
* Reject directory entries that extend past their parent's size.
Documentation: README now documents cramfsck and lists all current
mkcramfs options; stale hard-link and endianness claims corrected;
NOTES trimmed of the 25-year-old Future Development section.
(See https://github.com/npitre/cramfs-tools/releases/tag/v2.2)
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2c96a67d9b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 949063f92b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9a7cd39c5d)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 47464cfbe1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 16c5253138)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 19d11b5235)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 55cb1e8eea)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d7f835a4cb)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3eda260ff4)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15c4abfa52)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8f0f84a400)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The Github repository has been renamed from dracut-ng to dracut. The
wiki still exists, but the actual documentation has been moved to
dracut-ng.github.io.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ec8c6e4487)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The patch `0008-awk.c-fix-CVE-2023-42366-bug-15874.patch` was introduced
in [1]. The IGNORE_CVES entry was removed while the patch is still
present in [2].
Re-introduce this IGNORE_CVES entry.
[1] 75c594d446 package/busybox: fix pending CVEs
[2] f88537c46b package/busybox: drop stale IGNORE_CVES entries
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix patch number in comment (s/0008/0007/)]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 092abbe035)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
When adding the libldns and python_scp, the corresponding tests were not
added to DEVELOPERS, preventing correct notifications in case of tests
failures.
Add the missing entries to enable proper author notifications in case of
failing tests.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1209f3f7a1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Fixes following CVE's:
CVE-2026-70368: Fixed an out-of-bounds memory
access triggered by logging attacker-controlled protocol messages longer
than 1,024 bytes (thanks to AISLE Research and Clemens Lang).
CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
destination filter using alternate local-address encodings and
interface-scoped IPv6 destinations (thanks to AISLE Research and Clemens
Lang).
Complete Changelog is here:
https://www.stunnel.org/NEWS.html
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8b6eea299b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Upstream removed configure option INSTALL_EXAMPLE_CODE with commit
8434de3cbc
which was first released with version 2.11.0.
Upstream re-added a similar configure option named INSTALL_EXAMPLE_CODE
with commits
f8d989160e7c803c8538
which were first released with version 2.15.0.
Buildroot bumped the package to 2.15.0 with
8e713dcc88 and forgot to rename the
configure option.
Remove libva/x11/wayland-related configure option due to upstream commit
8434de3cbc
which was first released with version 2.11.0. Remove the selection of
optional packages for these dependencies as well.
Removed unneeded libatomic handling.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 53c29cf046)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
- Update BOTAN_VERSION to 3.11.1
- Remove 0001-Add-more-value-barriers-to-avoid-compiler-induced-side-channels.patch
as it is already integrated upstream in this version.
Fixed in 3.11.1:
- CVE-2026-34580: Resolve certificate verification bypass bug introduced
in 3.11.0 (GH #5500)
- CVE-2026-34582: Resolve TLS 1.3 client authentication bypass (GH #5599)
Fixed in 3.11.0:
- CVE-2026-32877: Fix a heap over-read during SM2 decryption (GH #5450)
- CVE-2026-32883: Fix an OCSP response forgery vulnerability (GH #5449)
- CVE-2026-32884: Fix a name constraints bypass for DNS names (GH #5448)
- Remove the --disable-altivec configuration option as it has been removed
from the Botan build system in version 3.x
- Optimize the --disable-neon logic using the yx pattern.
In Botan 3.x, the --disable-neon flag is specifically targeted at the
arm32 architecture. Furthermore, Buildroot's BR2_ARM_CPU_HAS_NEON
variable is only defined for 32-bit ARM, which previously caused a
false-positive --disable-neon flag to be passed on AArch64 builds
- Update license.txt hash in botan.hash due to the copyright year update
to 2026
https://botan.randombit.net/news.html#version-3-11-1-2026-03-31
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: fix CVE numbers in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 402c94c2d7)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
- botan dropped the usage of Boost.Filesystem in 2.10.0 [0]
- botan never actively searched for Boost.System, as it is header-only
the dependecy can be dropped too
The only part of boost botan currently uses is asio. So use --with-boost option
when boost is selected.
[0] aff8cc8a7a
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8ff577bb35)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Changes made in this release:
Ben Wolsieffer (1):
nptl: fix getting main stack size on no-MMU
Max Filippov (4):
stdio: fix %a formatting of inf and nan
stdio: fix radix point output for %a
stdio: output sign with NaNs
stdio: restrict first digit of %a output to 0 or 1
Ramin Moussavi (19):
libintl.h: route stubs through format_arg inlines; fix gettext_noop
build: scope .NOTPARALLEL to locale targets only, restore parallel build
limits.h: define PAGE_SIZE/PAGESIZE like musl, fixing the gdb build
wait4: fall back to waitid(2) at runtime when wait4 returns ENOSYS
pagesize: restore PAGE_SHIFT fallback for binfmt_flat (no auxv)
buildsys: build locale headers in-tree, not via a recursive sub-make
extra/locale: skip locales the build host cannot provide
csky: fix struct semid_ds layout for TIME64
csky: make __kernel_uid_t/__kernel_gid_t 32-bit
hppa: fix inotify/signalfd/timerfd flag values
hppa: do not set IPC_64 for the SysV IPC *ctl commands
x86: fix struct semid_ds layout for TIME64
i386: add CFI to __libc_i386_syscall6 for cancellation unwinding
i386: do not set IPC_64 for the SysV IPC *ctl commands on 5.1+ kernels
buildsys: terminate .eh_frame in shared objects
m68k: make the __jmp_buf layout match what setjmp.S actually saves
inet: use the direct accept4 syscall when __NR_accept is missing
m68k: implement atomic operations with the CAS instruction
libc: fix struct shmid_ds layout for TIME64
Waldemar Brodkorb (10):
netinet/in.h: sync with glibc
bits/fcntl-linux.h: sync with glibc
add copy_file_range syscall wrapper
sys/fanotify.h: drop include to fix c-sky compilation
adjtimex: fix for architectures lacking __NR_clock_adjtime, f.e. frv
sys/user.h: restore required macros
netinet/tcp.h: sync with glibc
loongarch: add basic static only support
riscv: setcontext: fix linking error
bump version for 1.0.59 release
ramin (16):
ldso: harden _dl_tls_get_addr_soft against an unusable DTV
microblaze: implement atomic operations with lwx/swx
ldso: microblaze: add missing addend to R_MICROBLAZE_TLSDTPREL32
ldso: make the _dl_tls_get_addr_soft DTV check microblaze-specific
microblaze: fix struct semid_ds layout for TIME64
m68k: fix struct semid_ds layout for TIME64
mips: fix fallocate() 64-bit argument passing on n32
mips: fix mmap64() for large offsets on n32
mips: fix setjmp() on n32/n64 (.cpreturn, not .cprestore)
mips: always set IPC_64 for the SysV IPC *ctl commands
libc: fix struct msqid_ds layout for TIME64 on all common-header arches
linuxthreads: fix SIGSEGV in MIPS cancellable wrappers (waitpid, nanosleep)
ldso: serialize dl_iterate_phdr to fix concurrent unwind hang on SMP
nptl: cancel the current thread directly instead of via SIGCANCEL
mips: only n32/n64 always need IPC_64, not o32
m68k: use the kernel cmpxchg helper for atomics on ColdFire
Patch 0001 is applied upstream and is removed here.
Fixes:
- https://autobuild.buildroot.net/results/2bd/2bd73b0060cad4f44649ffe4ea60c4775160d86e
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b94d3eb728)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
New release with following changes:
Adam Lackorzynski (1):
termios.h: Add IBSHIFT
Charles Mirabile (11):
riscv: add defconfigs
riscv: add support for static pie binaries
riscv: add support for ucontext functions
pipe: directly invoke pipe2 from kernel when !UCLIBC_LINUX_SPECIFIC
Fix {g,s}ettimeofday when !UCLIBC_HAS_REALTIME
Fix build with static-pie but without nptl threads
do not remove bits/uClibc_ctype.h when !UCLIBC_HAS_CTYPE_TABLES
getopt-susv3: remove call to gettext `_` macro
readdir{,_r}: remove loop to skip files with d_ino == 0
spawn: allow file actions on no-mmu targets
getopt-susv3: add support for reseting the scan by setting optind to zero
Marcus Haehnel (1):
aarch64/fpu_control.h: Don't use gcc-internal types
Jan Klötzke (1):
elf/dl-support.c: remove unnecessary memset
Ramin Moussavi (9):
libsanitizer: arm/ucontext: fix VFP save/restore to use uc_regspace area
libsanitizer: arm/ucontext.h: add glibc-style REG_R0..REG_R15 aliases
libsanitizer: link.h/dl-iterate-phdr: expose dl_phdr_info TLS fields
libsanitizer: ldso: track _dl_load_adds/_dl_load_subs counters
libsanitizer: ldso: implement _dl_tls_get_addr_soft for dl_phdr_info::dlpi_tls_data
libsanitizer: drop __pagesize, make _dl_pagesize the single source of truth
libsanitizer: sys/user.h: remove obsolete BFD trad-core NBPG/UPAGES defines
libsanitizer: features.h: hard-wire _FILE_OFFSET_BITS=64 to match library's 64-bit off_t/ino_t
libsanitizer: fts.h: drop the bogus _FILE_OFFSET_BITS==64 #error
Waldemar Brodkorb (7):
bits/statx.h: add some missing defines
bits/statx.h: sync struct with glibc
sys/fanotify.h: sync with musl
libiconv: fix typedef of iconv_t
misc: add unicode character functions (c11)
netinet/tcp.h: sync with glibc
bump version for 1.0.58 release
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c7fef3704c)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
It has been good practice for a while to describe the kind of change
in the commit message of any patch that changes license file
hashes. This is important so any substantial changes don't go
unnoticed. However it wasn't explicitly stated in the manual, fix
that.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ef655b53dd)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Localedef is built from the glibc source code, so license information
is the same.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 187d329d1d)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The COPYINGv3 license file was added with upstream commit
e067e53080386e93dcf8b07e25fb6656f2c8941e, it applies to scripts used
during build.
LGPL-3.0+ applies to sysdeps/htl/raise.c, which is used for the Hurd
platform. Buildroot builds only Linux, so the file should not be
compiled, but it is part of the downloaded (and possibly shared, if
"make legal-info" is used) archive. The same applies to the manual.
Checked against the copyright file of the Debian "libc6" package (as
of 2.42-17 and 2.43-2), note that Debian excludes the manual.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45b24c43a0)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
This fixes the following vulnerability:
- CVE-2026-6368
(alternative to commit a4d4c7527a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
This configuration for the s6lx9 microboard was added back in March 2012
(commit 49084a1982), and has not been
updated in any significant way since then.
This defconfig still use a 4.4.7 (no longer maintained) and out of tree
devicetree (lx9_mmu.dts).
Remove its support.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728914045 (s6lx9_microboard_defconfig)
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81490b9592)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
librsvg project on gitlab.gnome.org instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c01426fe96)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
A start script has been missing since the package was added, so the
daemon was not started automatically on sysv/busybox systems.
This also fixes a regression in systemd builds introduced in fccdc6bd,
when the package switched from local unit file to upstream.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 54485e075d)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
libgtk4 passes -Dintrospection=disabled unconditionally, so Gtk-4.0.gir is
never installed. webkitgtk depends on gobject-introspection and generates
WebKit-6.0.gir, which includes Gtk-4.0.gir, so building both fails:
FAILED: WebKit-6.0.gir
Couldn't find include 'Gtk-4.0.gir' (search path:
'['.../usr/share/gir-1.0', ...]')
Tie the option to BR2_PACKAGE_GOBJECT_INTROSPECTION and add the dependency,
the way package/libgtk3 already does. Systems without introspection keep the
previous behaviour.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 8c5f774172)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Whether the host libglib2 picks up sysprof support depends on whether
libsysprof-capture happens to be installed on the build machine, which
makes the host build depend on the host environment. Disable sysprof
explicitly for the host build so the result is deterministic.
Keep sysprof enabled for the target build: it is useful to profile and
measure the performance of applications running on the target.
Signed-off-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>
[Fiona: also apply to package/libglib2/libglib2-bootstrap]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c92dc611e5)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Since NetworkManager 1.54, packaged since commit 24827ae398
(package/network-manager: bump to 1.56.0), new services related to
running in an initrd are now installed, which prevents proper startup,
with systemd reporting that two units declare the same BusName.
When systemd is configured without initrd support, drop the
NetworkManager initrd-related services.
Fixes: 24827ae398
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Fiona Klute <fiona.klute@gmx.de>
Cc: Marcus Hoffmann <buildroot@bubu1.eu>
Acked-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 32bdc4710a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Running TestUsbIp may fail when checking if two QEMU USB Keyboards are
reported by lsusb. On fast host, the second QEMU USB keyboard may not
aleady detected when lsusb is executed. So wait a bit, to let the new
keyboard be detected.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 933a591d8a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Duplicate of lua-argparse.
Note: the argparse package was introduced in Buildroot commit [1].
lua-argparse was introduced in [2]. For consistency with other Lua
packages which has the "lua-" prefix, this commit removes the package
without the prefix.
[1] 169d1632d5
[2] e70abe9716
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 59f9c25d70)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Buildroot commit aedf131da6 bumped the
package to 8.5.0 which made opcache a mandatory dependency but kept the
CFLAGS added in 2015 with buildroot commit
e054764917.
As it turns out we need to remove the CFLAGS to fix the build with the
bootlin-aarch64-glibc-old defconfig as detected by the Gitlab pipelines:
ext/opcache/shared_alloc_posix.o: In function `create_segments':
shared_alloc_posix.c:(.text+0xcc): undefined reference to `shm_open'
shared_alloc_posix.c:(.text+0x11c): undefined reference to `shm_unlink'
shared_alloc_posix.c:(.text+0x19c): undefined reference to `shm_unlink'
shared_alloc_posix.c:(.text+0x1b8): undefined reference to `shm_unlink'
as they seem to disturb the detection of librt.
It is unclear which upstream commits added since 2015 fixed the original
problem so a backport to LTS branches is not advised.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 623ed7c8c7)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Upstream bumped the minimum required gcc version from 6.1 to 8.1 in
commit 84ec3ddf9fd3 ("bump minimum gcc version to 8.1"), so the build
now fails with "Compiler too old; need at least gcc 8.1" on older
toolchains.
There is no gcc 8.0.x release (the 8.x series starts at 8.1.0), so
BR2_TOOLCHAIN_GCC_AT_LEAST_8 is enough to express this dependency.
While at it, add the gcc version to the openblas-arch comment, which
only checked for C++ support and would therefore stay hidden on
toolchains that are too old.
Fixes: 597d5d10ec ("package/armadillo: bump to version 15.0.1")
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cec50f48d6)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
BR2_ARCH_IS_64 is set for mips64/mips64el even when the n32 ABI is
used, so openblas was built with BINARY=64. Its build system then
passes -mabi=64, which conflicts with the n32 sysroot:
gnu/stubs.h:35:11: fatal error: gnu/stubs-n64_hard.h: No such file
or directory
For openblas, BINARY refers to the pointer size rather than to the
architecture, and n32 uses 32-bit pointers, so BINARY=32 is correct
there.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fd685fc8c2)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Changelog since 1.0.7
- 1.0.9: This is a bugfix release, fixing minor vulnerabilities
and expanding the test suite.
- 1.0.8: This is a bugfix release, fixing minor security
vulnerabilities and expanding the test suite.
Signed-off-by: Michele Comignano <mcdev@playlinux.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cd8161a374)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Add upstream patch to fix the following build issue:
In file included from [...]/sysroot/usr/include/sys/types.h:26,
from atopsar.c:36:
[...]/sysroot/usr/include/features.h:167:22: error: operator '<' has no left operand
167 | # if _POSIX_C_SOURCE < 200809L
| ^
Tested with:
$ ./utils/test-pkg -p atop -n 1
bootlin-armv5-uclibc [1/1]: OK
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Since Buildroot commit [1] "package/gcc: switch to GCC 15.x as the
default", compiling freescale_imx91frdm_defconfig fails in TF-A with
error:
include/drivers/nxp/trdc/imx_trdc.h:7: error: header guard 'IMX_TRDC_H' followed by '#define' of a different macro [-Werror=header-guard]
7 | #ifndef IMX_TRDC_H
include/drivers/nxp/trdc/imx_trdc.h:8: note: 'IMX_XRDC_H' is defined here; did you mean 'IMX_TRDC_H'?
8 | #define IMX_XRDC_H
The issue happen because this defconfig is using a Buildroot
(internal) toolchain which uses gcc version 15 by default.
This issue was fixed upstream in [2], first included in TF-A v2.13.
This commit updates U-Boot, TF-A and Linux to use the NXP
tag lf-6.18.20-2.0.0, which include this fixes.
Note that, as described in the commit log of [3] which was used as a
base for this defconfig, U-Boot and Linux were forks. Now the
necessary patches are included in the vendor BSP, this commit
switches those repos to use the vendor ones.
This commit also removes the linux-headers.hash custom hash file
which was never needed, because the defconfig used an external
toolchain.
Also, due to the upstream uboot commit [4], this commit adds a uboot
config fragment to disable CONFIG_EFI_CAPSULE_AUTHENTICATE, to
remove the dependency on the command "cert-to-efi-sig-list", provided
the host efitools package, which is not yet in Buildroot.
This commit was run tested on board 700-94610 Rev A1.
[1] a75b8623f5
[2] 2e9198d0e0%5E%21/
[3] 2e05f22ff8
[4] fd58c275f6
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 25c65e0428)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Since Buildroot commit [1] "package/gcc: switch to GCC 15.x as the
default", compiling freescale_imx93frdm_defconfig fails in TF-A with
error:
include/drivers/nxp/trdc/imx_trdc.h:7: error: header guard 'IMX_TRDC_H' followed by '#define' of a different macro [-Werror=header-guard]
7 | #ifndef IMX_TRDC_H
include/drivers/nxp/trdc/imx_trdc.h:8: note: 'IMX_XRDC_H' is defined here; did you mean 'IMX_TRDC_H'?
8 | #define IMX_XRDC_H
The issue happen because this defconfig is using a Buildroot
(internal) toolchain which uses gcc version 15 by default.
This issue was fixed upstream in [2], first included in TF-A v2.13.
This commit updates U-Boot, TF-A and Linux to use the NXP
tag lf-6.18.20-2.0.0, which include this fixes.
Note that, as described in the commit log of [3] which introduced
this defconfig, U-Boot and Linux were forks. Now the necessary
patches are included in the vendor BSP, this commit switches those
repos to use the vendor ones.
While at it, this commit also switches the defconfig to use an
external glibc stable Bootlin toolchain, to follow recommendations
from [4]. Since an external toolchain is used, the linux-headers.hash
custom hash file is no longer needed and is also removed. At the
time of this commit, the Bootlin stable toolchain is a gcc 14.
Also, due to the upstream uboot commit [5], this commit adds a uboot
config fragment to disable CONFIG_EFI_CAPSULE_AUTHENTICATE, to
remove the dependency on the command "cert-to-efi-sig-list", provided
the host efitools package, which is not yet in Buildroot.
This commit was run tested on board 700-94611 Rev B1.
[1] a75b8623f5
[2] 2e9198d0e0%5E%21/
[3] 2e05f22ff8
[4] https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs
[5] fd58c275f6
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Tested-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fcc6df2e10)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Commit [1] "package/uboot-tools: fix host FIT signature support"
slightly changed the logic in which the file
$(@D)/include/generated/autoconf.h is created.
When there is no Kconfig sub-option selected, the file is no longer
created and the build fails with error:
include/linux/kconfig.h:4:10: fatal error: generated/autoconf.h: No such file or directory
The issue can be reproduced with the with the simple commands:
cat >.config <<EOF
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
EOF
make olddefconfig
make host-uboot-tools
This commit fixes the issue by simply adding a touch of the file
at the beginning to make sure it will always exist.
[1] 928cc5dc5c
Cc: James Hilliard <james.hilliard1@gmail.com>
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Tested-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9f17ac02b8)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
U-Boot host tools use the tools configuration namespace when code calls
CONFIG_IS_ENABLED(). With USE_HOSTCC, CONFIG_IS_ENABLED(FIT_SIGNATURE)
resolves to CONFIG_TOOLS_FIT_SIGNATURE, while
CONFIG_VAL(FIT_SIGNATURE_MAX_SIZE) resolves to
CONFIG_TOOLS_FIT_SIGNATURE_MAX_SIZE.
The host-uboot-tools package only generates the old CONFIG_FIT_SIGNATURE
define. This makes tools/Makefile include fit_check_sign, but the host code
sees FIT signature support as disabled and the OpenSSL-backed signing and
verification objects are omitted. As a result, mkimage accepts a signature
node without writing its value or injecting a required public key.
fit_check_sign then has no required key and reports success without
checking the configuration signature.
A FIT-support-only configuration never exercises this path, which is why
the existing hash-only runtime test still passes.
Generate the tools FIT signature options needed by the host code and pass
CONFIG_TOOLS_LIBCRYPTO=y so the OpenSSL-backed signing, verification and
cipher objects are selected. Keep CONFIG_FIT_SIGNATURE=y in the make
options because U-Boot tools/Makefile still uses it to build
fit_check_sign.
Extend TestHostUbootTools to create an RSA-signed FIT, require a 256-byte
configuration signature and a required public key, verify the FIT, corrupt
the signature, and require verification to fail.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add comments in runtime test]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 928cc5dc5c)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
https://www.samba.org/samba/history/samba-4.24.5.html
This is a security release in order to address the following defects:
o CVE-2026-6949:
TSIG packet with name compression can crash DNS
Incorrect size calculations when a TSIG record contains
compressed names can lead to a large out-of-bounds write
causing the server to crash.
https://www.samba.org/samba/security/CVE-2026-6949.html
o CVE-2026-58216:
An authenticated user could possibly crash a KDC process
A kpasswd packet that contains malformed ASN.1 might cause
the server to access 6 bytes of unallocated memory. This
memory is not exposed to the user, but in some
circumstances the server could crash.
https://www.samba.org/samba/security/CVE-2026-58216.html
o CVE-2026-58218:
DNS signing DoS via TKEY name cache exhaustion
An unauthenticated user can repeatedly register names TKEY
names, which floods a cache causing legitimate TKEYs to be
expunged. This can practically block the use DNS TSIG
signing.
https://www.samba.org/samba/security/CVE-2026-58218.html
o CVE-2026-58221:
Samba AD authenticated LDAP access domain takeover
Samba AD low-privilege authenticated LDAP access allows
modifications to internal LDB special DNs, which permits a
domain takeover.
https://www.samba.org/samba/security/CVE-2026-58221.html
o CVE-2026-58222:
Samba AD LDAP Compare filter injection and trusted-request
confusion disclose protected attributes
An ordinary authenticated domain user can bypass access
checks and query confidential Active Directory attributes
(such as KDS root keys) via LDAP Compare requests. Due to a
filter injection flaw and trusted execution context, the
LDAP Compare operation can be turned into a
protected-attribute disclosure oracle.
https://www.samba.org/samba/security/CVE-2026-58222.html
o CVE-2026-58224:
The CTDB protocol has bounds checking issues
CTDB fails to do integrity checking of received packets.
This includes failure to check field lengths against packet
lengths when unmarshalling packets.
https://www.samba.org/samba/security/CVE-2026-58224.html
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b5e6133eab)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The --with-systemd option controls only if systemd units are
installed, so there is no build time dependency. Disable systemd
unconditionally for the host package because Buildroot cannot and
should not install systemd units on the host.
Fixes host-p11-kit install error:
install: reguläre Datei '/usr/lib/systemd/user/p11-kit-server.socket' kann nicht angelegt werden: Keine Berechtigung
install: reguläre Datei '/usr/lib/systemd/user/p11-kit-server.service' kann nicht angelegt werden: Keine Berechtigung
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a0cadb4552)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Changelog since 1.0.6:
This is a bugfix release, fixing modest security vulnerabilities
discovered by A. Ramos.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 81f7c82740)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Changelog since 1.0.5:
Fix various minor issues, like theoretical
integer overflows for extreme inputs or NULL
dereferences if the application passes NULL
where it should not.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6d8a1bb4c8)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
https://github.com/strukturag/libheif/releases/tag/v1.23.1
Fixes the following CVEs:
CVE-2026-62289 (GHSA-jc8f-p23p-5hjg)
Integer underflow in Fraction constructor via double clap transform
application
CVE-2026-62291 (GHSA-xpw3-9rhw-482x)
Heap out of bounds write in libheif uncompressed encoder when writing
images with mismatched auxiliary alpha dimensions
CVE-2026-62292 (GHSA-73p7-m7gg-w2jv)
Out-of-bounds read in uncompressed unci tile range slicing
CVE-2026-62377 (GHSA-9ww4-9v47-m7pj)
Reachable assertion in HeifContext::get_track() aborts on a valid-but-
empty HEIF sequence file
(GHSA-46rp-pcq2-rpmr)
Heap out-of-bounds write in the uncompressed encoder for RRGGBB images
with interleaved bit-depth ≤ 8
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bcb48623fa)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://downloads.isc.org/isc/bind9/9.20.26/doc/arm/html/notes.html#notes-for-bind-9-20-26https://downloads.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.htmlhttps://seclists.org/oss-sec/2026/q3/208
Fixes
CVE-2026-10723: Incorrect acceptance of NSEC3 records
CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit
CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass
CVE-2026-11605: Unnecessary validation of DNSSEC signed records
CVE-2026-11622: Potential memory usage beyond configured limits
CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
CVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAME
CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present
CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: update pgp key id in hash file comment]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8c96a8981f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
A few headers outside libiberty use LGPL-2.1+, too, and other headers
and some scripts use GPL-2.0+.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 95b77f7a71)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BSD-0-Clause is not a recognized SPDX license identifier. 0BSD is used
in the source SPDX-License-Identifier headers, and the associated text
[1] matches the COPYING.0BSD file.
FSFUL and FSFULLR are the "few permissive licenses" of certain build
system files mentioned in COPYING.
Move "Public Domain" to the end of the list because it applies only to
a few files.
[1] https://spdx.org/licenses/0BSD.html
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15e2433e1f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0f80126bfe)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c19a7fad93)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9b8a2d8633)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 770b684426)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
All these packages are part of Buildroot and thus under
GPL-2.0-or-later unless stated otherwise, as described in COPYING.
package/skeleton-custom is excluded because it provides a way to copy
skeleton data from any location chosen by the user, the license of
which is unknown to Buildroot.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 927c575964)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: Fix a use-after-free in X11 forwarding that could possibly lead
to memory corruption. This is vulnerable to authenticated users if X11
forwarding is enabled. By default X11 forwarding is not built.
In 2026.89 the server is running as the authenticated user for X11
forwarding, in earlier versions it runs as root.
This removes X11 "single connection" which has probably never been used.
Reported by @peter-pe
882f83806d
Added patch to fix build errors which would be introduced by this bump:
86baa66fc9
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0c8bd5739c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://gitlab.com/libssh/libssh-mirror/-/tags/libssh-0.11.5https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-release
s/
Fixes the following security problems:
CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
CVE-2026-59843: Denial of service via zero advertised channel packet size
CVE-2026-59844: Denial of service via oversized SFTP read length
CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
CVE-2026-59849: Denial of service via automatic certificate authentication loop
CVE-2026-59850: Use-after-free via data callbacks on closed channels
Zero-initialize every ssh_string
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 93e7a673e8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
"bzip2-1.0.4" is not a valid SPDX license identifier. The license text
in archival/libarchive/bz/LICENSE in the busybox source matches the
text associated with the bzip2-1.0.6 identifier [1].
[1] https://spdx.org/licenses/bzip2-1.0.6.html
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f9687af626)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The Nettle manual (nettle.html in the source archive) states:
> Nettle is dual licenced under the GNU General Public License version
> 2 or later, and the GNU Lesser General Public License version 3 or
> later. When using Nettle, you must comply fully with all conditions
> of at least one of these licenses. [...]
This means "or" is the correct description. Ellipsis covers a note
that a few files are licensed more permissively.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9a77d5547a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
All these bundled subprojects explicitly give "Apache-2.0 OR
LGPL-2.1-or-later" in their README.md files.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0c2b14a8b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The patch 0002-Makefile.am-fix-build-without-makeinfo.patch is not longer
needed since it builds even if 'makeinfo' is not installed, so it's removed.
For release annoucne, see:
https://lists.gnu.org/archive/html/info-gnu/2025-12/msg00002.html
Changelog:
Changes are detailed in the git repo logs:
$ git clone git://git.sv.gnu.org/guile.git
$ git whatchanged
Signed-off-by: Pedro Aguilar <paguilar@paguilar.org>
[Julien:
- remove .checkpackageignore entry to fix check-package error
- add link to release announce
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 643f480f43)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
When building pahole using a modern GCC (e.g. when building
host-pahole), discarded-qualifiers and unused-but-set-variable warnings
are produced. In builds that don't set CMAKE_BUILD_TYPE=Release, -Werror
gets set and causes a build failure.
Fix this by backporting an unreleased upstream patch (for
discarded-qualifiers) and adding another pending one for
unused-but-set-variable (and, arguably, a correctness issue).
Fixes: https://autobuild.buildroot.org/results/ba7/ba79fb9d08b2c6ec573b79fdbb6b4880bf603a57
Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8419f0f0c7)
[Thomas: backport to v1.28]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit fabcd7c8cc bumped the
package from 28.0 to 30.0 which includes upstream commit
a01cb6e63f
that was first included in version 29.0 and added among others
-fstack-protector-all to cxx_flags guarded with a new configure option
ENABLE_HARDENING which default to ON.
This commit causes build errors with toolchains with SSP support:
[ 44%] Linking CXX executable ../bin/bitcoin
/home/autobuild/autobuild/instance-40/output-1/host/lib/gcc/i686-buildroot-linux-musl/15.2.0/../../../../i686-buildroot-linux-musl/bin/ld:
CMakeFiles/bitcoin.dir/bitcoin.cpp.o:
in function `fs::PathToString(fs::path const&)':
bitcoin.cpp:(.text+0x4c):
undefined reference to `__stack_chk_fail_local'
Upstream later removed the forementioned configure option with commit
00ba3ba303
that was first included in version 30.0 so we need to remove
-fstack-protector-all from CMakeLists.txt.
Fixes:
https://autobuild.buildroot.net/results/093/093253c79fed1c5b93decc3124e9ef4622168efe/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ed51b4b691)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Boot an armv5 image running the mdnsd responder alongside the mquery
client, then check that service discovery works: mquery browses for the
bundled _http._tcp service and mdnsd, on the same host, answers over the
loopback of the eth0 multicast group.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
[Julien: add "mdnsd -v" invocation to show version]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4cd5559163)
[Thomas: remove last test that requires v1.1]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-Historyhttps://seclists.org/oss-sec/2026/q3/152
Multiple vulnerabilities have been discovered in ntfs-3g.
A new version 2026.7.7 is now available at https://github.com/tuxera/ntfs-3g
(ntfscat) Fix heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616)
Fix heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617)
Fix single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618)
Fix heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569)
Fix out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571)
Fix heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570)
Fix heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572)
Fix heap buffer overflow when building inherited ACL data. (CVE-2026-56135)
Fix out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)
Switched to sha256 tarball hash provided by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 26811cb110)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
During its configure step, libgpg-error needs awk:
configure -> src/gen-lock-obj.sh -> objdump + awk on test binary
This call is used on the output from objdump on a test binary to
retrieve the size of some data structure, and generate accordingly an
internal header (lock-obj-pub.native.h). However, libgpg-error buildroot
package does not depend explicitely on host-gawk: if host-gawk is not
part of the build, or if it is built later than libgpg-error,
libgpg-error autotool tooling will eventually pick the build machine
awk. On top of this issue, despite the configure.ac suggesting that it
supports different implementations of awk, libgpg-error configure step
will not parse correctly the output from objdump when using mawk,
leading to a wrong lock-obj-pub.native.h header being generated:
With gawk:
typedef struct
{
long _vers;
union {
volatile char _priv[24];
long _x_align;
long *_xp_align;
} u;
} gpgrt_lock_t;
#define GPGRT_LOCK_INITIALIZER {1,{{0,0,0,0,0,0,0,0, \
0,0,0,0,0,0,0,0, \
0,0,0,0,0,0,0,0}}}
With mawk:
typedef struct
{
long _vers;
union {
volatile char _priv[0];
long _x_align;
long *_xp_align;
} u;
} gpgrt_lock_t;
#define GPGRT_LOCK_INITIALIZER {1,{{}}}
This issue has been observed for example on Debian 13 with mawk
installed: it fails to parse mtx_size, leading to a size 0, and so
generating crashes at runtime because of the invalid size embedded in
libgpg-error.
Side note: the lock-obj-pub.native.h header file is correctly
generated, when using mawk 1.3.4 20200120 from Debian 12.
The described issue happen with mawk 1.3.4 20250131 from Debian 13.
libgpg-error should be fixed upstream to properly handle this data
structure size guessing even when using mawk, but anyway the
corresponding buildroot package should not randomly use the build
machine host tooling or buildroot-provided host tooling depending on
whether host-gawk has been selected and built before it.
Enforce an explicit dependency on host-gawk for libgpg-error to make
sure that it systematically uses the buildroot-provided awk.
Co-developped-by: Bernard Gautier <bernard.gautier@nav-timing.safrangroup.com>
Signed-off-by: Bernard Gautier <bernard.gautier@nav-timing.safrangroup.com>
Co-developped-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
[Julien: add the side note that mawk from debian 12 works]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 21bf78411e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit 2774502344 bumped the
package from 4.2.2 to 6.2.3. Upstream added the usage of
std::scoped_lock in version 6.2.0:
a760b3278a
causing a build error detected by the Gitlab pipelines for the
bootlin-aarch64-glibc-old defconfig:
../src/inc/upnpapi.h:132:22: error:
‘scoped_lock’ is not a member of ‘std’
scoped_lock was introduced in gcc 7.1:
https://gcc.gnu.org/onlinedocs/libstdc++/manual/status.html#status.iso.2017
so we raise the minimum required gcc version accordingly.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5f543cfcda)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
CVE-2026-39822: os: root escape via symlink plus trailing slash
go1.26.5 (released 2026-07-07) includes security fixes to the
crypto/tls and os packages, as well as bug fixes to the compiler,
the runtime, the go command, and the net, os, and syscall packages.
https://go.dev/doc/devel/release#go1.26.5
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6e12744652)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
libcamera has moved for a while now to gitlab.freedesktop.org. The
mirror on git.linuxtv.org is still active, but it isn't the canonical
repository and has less bandwidth than freedesktop.org. Switch the
libcamera source URL to gitlab.freedesktop.org.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
[Julien: removed trailing slash in _SITE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 138713f39a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: server: Don't allow -B (accept blank password) with
-t (two factor auth). If run with -t and -B a user configured with a
blank password would be allowed to log in without pubkey auth.
23ec782856
Reported by nvidia
- Security: server: Fix parsing of long authorized_keys lines.
The remainder of a long line would be handled as the start of a new line.
In the case where external programs add semi-trusted public keys to
authorized_keys, a crafted key might bypass restrictions such as "command=".
8d8e1930b8
Reported by nvidia
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ce9ed75bbc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The Debian 12 Bookworm snapshot we use, 20250203, uses the new deb822
format [0] for source list files; it carries a source list file that
points to the current repository, not to the snapshot.
Even though we do inject an old-style source list that points to the
snapshot repository, the packages in the current repository are more
recent than the one in the snapshot, so when we install our packages,
they get retrieved mostly from the current repository rather than from
the snapshot. The image is not reproducible.
Switch to using the new deb822-style source list file.
Note: we do not need to carry the "Latest just before" trick: the
snapshot repository will use the most recent actual snapshot before the
requested dated, so we can just use the date of the image we use (stuck
at midnight because we don't have better).
Since the snapshot repository can be really slow, while at the same time
the remote http server not dropping connections, it can take a very long
while to build the image; add a timeout so that stale connections are
detected and re-attemped early-ish (the timeout applies to both the
connect and the actual download, so it should be large enough to
accomodate slowish network connections).
Fixes: c95d5b8e1e (support/docker: move to current bookworm (Debian
12) snapshot)
[0] https://manpages.debian.org/trixie/apt/sources.list.5.en.html#DEB822-STYLE_FORMAT
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 3460675872)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://www.openssh.org/releasenotes.html#10.4p1
Changes since OpenSSH 10.3
==========================
This release contains a number of security fixes as well as general
bugfixes and a couple of new features.
Security
========
* sftp(1): when downloading files on the command-line using
"sftp host:/path .", a malicious server could cause the file to
be downloaded to an unexpected location. This issue was identified
by the Swival Security Scanner.
* scp(1): when copying files between two remote destinations, do
not allow a malicious server to write files to the parent
directory of the intended target directory. This issue was
identified by the Swival Security Scanner.
* sshd(8): when using the "internal-sftp" SFTP server implementation
(this is not the default), long command lines were previously
truncated silently after the 9th argument. If a security-relevant
option was in the 10th or later position, it would be discarded.
Reported by Steve Caffrey.
* sshd(8): add a documentation note to mention that the
GSSAPIStrictAcceptorCheck option is ineffective when the server
is joined to a Windows Active Directory. Reported by Yarin Aharoni
of Safebreach.
* sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
as it was documented to do. Note that PermitTunnel is not enabled
by default. Reported independently by Huzaifa Sidhpurwala of
Redhat and Marko Jevtic.
* sshd(8): avoid a potential pre-authentication denial of service
when GSSAPIAuthentication was enabled (this feature is off by
default). This was not mitigated by MaxAuthTries, but would be
penalised by PerSourcePenalties. This was reported by Manfred
Kaiser of the milCERT AT (Austrian Ministry of Defence).
* sshd(8): fix a number of cases where the minimum authentication
delay was not being enforced. Reported by the Orange Cyberdefense
Vulnerability Team.
* ssh(1): fix a possible client-side use-after-free if the server
changes its host key during a key reexchange. This was reported by
Zhenpeng (Leo) Lin of Depthfirst.
[...]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 90add0c09e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Release notes:
https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
Fixes the following security issues:
https://webkitgtk.org/security/WSA-2026-0003.html
Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, and CVE-2026-43660.
Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 013612b496)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
- CVE-2025-64503:
cups-filters contains backends, filters, and other software required
to get the cups printing service working on operating systems other
than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
`pdftoraster` tool to write beyond the bounds of an array. First, a
PDF with a large `MediaBox` width value causes `header.cupsWidth` to
become large. Next, the calculation of `bytesPerLine =
(header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
resulting in a small value. Then, `lineBuf` is allocated with the
small `bytesPerLine` size. Finally, `convertLineChunked` calls
`writePixel8`, which attempts to write to `lineBuf` outside of its
buffer size (out of bounds write). In libcupsfilters, the maintainers
found the same `bytesPerLine` multiplication without overflow check,
but the provided test case does not cause an overflow there, because
the values are different. Commit
50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
incorporated into cups-filters version 1.28.18.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64503
- 50d94ca0f2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit def2405f39)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
- CVE-2026-34933:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4,
any unprivileged local user can crash avahi-daemon by sending a single
D-Bus method call with conflicting publish flags. This issue has been
patched in version 0.9-rc4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-34933
- 0be89b6bb5
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 88f3b8366b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://blog.clamav.net/2026/07/clamav-153-and-145-security-patch.html
Fixes CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243 & CVE-2026-20244.
"Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency
to resolve CVE-2026-41676."
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 31cd41c84b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Removed patch which is included in this bump.
Fixes CVE-2026-5435, CVE-2026-6238 & CVE-2026-6791.
git shortlog 4070d808bea1c077eb7e7d52b52b91cae98205d5..
Adhemerval Zanella (3):
math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
Florian Weimer (8):
iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
resolv: Declare __p_class_syms, __p_type_syms for internal use
resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
resolv: Improve formatting of unknown records in ns_sprintrrf
resolv: Check for inet_ntop failure in ns_sprintrrf
resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
Jakub Jelinek (1):
Rename __unused fields to __glibc_reserved.
John David Anglin (1):
hppa: Fix missing call to __feraiseexcept (BZ 34306)
Pino Toscano (1):
Hurd: comment PF_LINK/AF_LINK defines
Sam James (1):
elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
Samuel Thibault (3):
Hurd: comment PF_ROUTE/AF_ROUTE defines
Hurd: comment ioctls which cannot currently compile
Hurd: restore some SIOC ioctls
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 42d63edf4c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The 'mlkem.h' header is no longer present in wolfssl v5.9.2 [1] and the
content was merged in the 'wc_mlkem.h' header.
[1] 7a2cf5b655
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 275faf6d61)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Changes with nginx 1.30.3
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers off;"
and "large_client_header_buffers" with large configured values when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
a limited disclosure of worker process memory or segmentation fault
in a worker process (CVE-2026-48142).
Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9b8c65a6c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See here for a complete Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22-current.html
Security Fixes:
GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7f48325de6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
For more information on the release, see:
- https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18
It fixes the following vulnerabilities:
- CVE-2026-48163:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST
the donor node is interpolating parameters that the joiner sent into
the command line. Not all parameters were properly validated which
could allow a malicious joiner to execute arbitrary shell commands on
the donor side via the rsync SST method. This issue has been patched
in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48163
- CVE-2026-48165:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-
privileged MariaDB user could've used wsrep_sst_receive_address or
wsrep_sst_donor global system variables to execute shell commands as
the uid of the mariadbd process on the galera joiner node. This issue
has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48165
- CVE-2026-49261:
MariaDB server is a community developed fork of MySQL server. Versions
10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through
11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd`
enabled would execute shell commands embedded in the name of the
joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2. As a workaround, anyone who cannot upgrade now should disable
`wsrep_notify_cmd`.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-49261
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c69f28ae5c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
In the precedent patch "support/testing: test_gnupg2.py: use
assertRunNotOk()" [1] a small typo (OK instead of Ok) was introduced
in the test_gnupg2.py file, which caused a runtime failure.
This patch simply replace "self.assertRunNotOK(cmd)" with
"self.assertRunNotOk(cmd)" to correct this typo.
[1] cb791850ad
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Fiona: fix commit message formatting]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit cfd7483a26)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-55200:
libssh2 through 1.11.1, fixed in commit 97acf3df contains an out-of-
bounds write vulnerability in ssh2_transport_read() that fails to
enforce upper bounds on packet_length field. Remote attackers can send
crafted SSH packets with excessively large packet_length values to
corrupt heap memory and achieve remote code execution.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55200
- 97acf3dfda
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c5aa932745)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following vulnerability:
- CVE-2026-55199:
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
handler in src/packet.c that allows a malicious SSH server to cause a
client CPU exhaustion loop by sending a crafted extension count value.
A malicious server can set nr_extensions to 0xFFFFFFFF during key
exchange, causing the client to spin in a tight CPU loop for over 60
seconds because return values from _libssh2_get_string() are unchecked
and the session timeout does not apply to CPU-bound loops.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55199
- 17626857d2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 3c8cfad804)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-6192:
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This
impacts the function opj_pi_initialise_encode in the library
src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The
attack must be carried out locally. The exploit is publicly available
and might be used. The identifier of the patch is
839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a
patch to address this issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-6192
- 839936aa33
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 353007cf40)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The sample script would've passed even if the connections list was
empty. Check that there is at least one connection, and that the
sample script can read loopback device information.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f38f5bb593)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
In 11aa1cfa5a the patch was accidentally
moved into a versioned directory with the wrong version (2.82.0
instead of 2.82.4) and thus not applied. However, there have been no
issues reported.
The patch description mentions being needed to fix build errors in
package/atk and package/libnice. It was originally added in
b094f88a4d, and amended for libnice in
2c916b400b. package/atk was removed in
2c3ca7bea1, because atk has been merged
into at-spi2-core. Both at-spi2-core and libnice are Meson packages,
as was atk at the time of its removal.
Both current packages build with the following configuration (tested
using utils/test-pkg):
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_GOBJECT_INTROSPECTION=y
BR2_PACKAGE_LIBNICE=y
BR2_PACKAGE_AT_SPI2_CORE=y
Evidently the patch is no longer needed, presumably because the
correct search path for GIR files is set by other means, and we can
remove it instead of fixing the version number of the patch directory.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9fabfcb9f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Libglib2-bootstrap is only used as dependency to build
gobject-introspection and then libglib2 with GOI support. It should
not be installed to target, even if in practice libglib2 should
overwrite anything it has installed.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 866462e8dd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit f89ca996b6 fixed the
build of linux-pam with musl in 2020 but did not remove the restric-
tions in place for login/runuser/su which were added earlier with
these commits:
login (2015): 25ecd24579
runuser (2017): 09860f354a
su (2017): c6488923fb
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 91d356ee7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
TestIptables expect netfilter legacy tables enabled in the kernel.
Make sure we use iptables-legacy:
iptables --version
iptables v1.8.11 (legacy)
The test would fail if nftables compat (iptables-nft) is enabled.
iptables --version
iptables v1.8.11 (nf_tables)
Add the following configuration fragment to enable iptables-nft:
BR2_PACKAGE_IPTABLES_NFTABLES=y
BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y
Acked-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 1b2f65bbe9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Since kernels 6.17, support for netfilter legacy tables were disabled
by default [1] but iptables package needs Netfilter legacy tables
support enabled in the kernel when nftables compat is not enabled.
Make sure to enable CONFIG_IP_NF_IPTABLES_LEGACY and
CONFIG_NETFILTER_XTABLES_LEGACY for kernels >= 6.17.
Fixes:
[BRTEST# iptables --flush
modprobe: module ip_tables not found in modules.dep
iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
On the other hand, when nftables compat (iptables-nft) is used by
default (BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y) we have to enable
nft protocol support in the kernel.
iptables --version
iptables: Failed to initialize nft: Protocol not supported
Enable CONFIG_NF_TABLES and CONFIG_NF_TABLES_INET as for
NFTABLES_LINUX_CONFIG_FIXUPS and complete the list with
CONFIG_NFT_SOCKET needed to pass the TestIptables with
nftables compat (iptables-nft) enabled.
Without CONFIG_NFT_SOCKET:
iptables --policy INPUT ACCEPT
iptables v1.8.11 (nf_tables): TABLE_ADD failed (Operation not supported): table filter
So, enable kernel support for iptables-legacy only if nftables compat
is not enabled by default. Enable iptables-nft support when nftables
compat is enabled, even if not used by default.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9fce66583f06c212e95e4b76dd61d8432ffa56b6
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Fiona: fix typo in commit message]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c57bcf0d43)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
With an older cmake version, like the 3.25.1 as available in the docker
reference image, mosquitto fails to build when ccache is enabled:
[ 98%] Building CXX object lib/cpp/CMakeFiles/mosquittopp.dir/mosquittopp.cpp.o
In file included from [...]/buildroot/output/build/mosquitto-2.1.2/lib/cpp/mosquittopp.cpp:17:
[...]/buildroot/output/host/opt/ext-toolchain/i686-buildroot-linux-gnu/include/c++/15.1.0/cstdlib:83:15: fatal error: stdlib.h: No such file or directory
83 | #include_next <stdlib.h>
| ^~~~~~~~~~
compilation terminated.
Officially, mosquitto only requires cmake 3.18, but that proves to not
be enough, in fact...
We workaround that by requiring cmake 4.3, which is the one version that
could be tested with our host-cmake.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit da9dcddff1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Libepoxy is a library for handling OpenGL function pointer management.
It has backends for egl/glx, which may at one point have been mandatory
to enable, but the library now builds with none of the above enabled
features, as seen below.
libepoxy 1.5.10
User defined options
Cross files : /home/joseph/br-test-pkg/arm-aarch64/build/libepoxy-1.5.10//buildroot-build/cross-compilation.conf
b_pie : false
b_staticpic : true
buildtype : release
build.cmake_prefix_path: /home/joseph/br-test-pkg/arm-aarch64/host/lib/cmake
default_library : shared
docs : false
egl : no
glx : no
libdir : lib
build.pkg_config_path : /home/joseph/br-test-pkg/arm-aarch64/host/lib/pkgconfig
prefix : /usr
strip : false
tests : false
x11 : false
Removing these dependencies allows for some applications that require it
as a build dependency, but otherwise can run headless or without GL, to
build and function, using other graphics APIs or display pipelines.
Weston, for example, can still use Vulkan and DRM when linked to
libepoxy without GL/EGL/X11 support.
Acked-by: Arnout Vanecappelle <arnout@rnout.be>
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit cd2583ca0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Upstream passt only documents runtime dependencies; and they advertise
being able to run on kernel 3.8 or later. However, they do not document
the build dependencies.
Since 2025_06_11.0293c6f, upstream requires kernel headers >= 5.9, as
they make use of linux/close_range.h, only introduced in 5.9.
Add a dependency to kernel headers, and propagate it to podman's passt
backend.
Fixes: 6a192b0d28
Cc: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 113def3696)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Commit e8c54ffb3d ("utils/generate-cyclonedx: generate vcs
externalReferences for source repos") added externalReferences to the source
code of packages.
This unfortunately causes issues with packages (in br2-external) fetching
from git using the scp-like syntax, E.G.:
FOO_SITE_METHOD = git
FOO_SITE = git@github.com:<project>/<repo>.git
Which ends up in the SBOM as:
[
{
"type": "vcs",
"url": "git@github.com:<project>/<repo>.git",
"comment": "git repository"
}
]
This (correctly) causes Dependency track to reject the SBOM import with:
{
"status": 400,
"title": "The uploaded BOM is invalid",
"detail": "Schema validation failed",
"errors": [
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the regex pattern ^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",
]
}
The CycloneDX spec indeed requires a URI:
The URI (URL or URN) to the external reference. External references are
URIs and therefore can accept any URL scheme including https (RFC-7230),
mailto (RFC-2368), tel (RFC-3966), and dns (RFC-4501)
https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_url
The user@host:project/repo.git is a git-specific shorthand for a git-over-ssh URL. From man git-clone:
Git supports ssh, git, http, and https protocols (in addition, ftp and ftps
can be used for fetching, but this is inefficient and deprecated; do not use
them).
The native transport (i.e. git:// URL) does no authentication and should
be used with caution on unsecured networks.
The following syntaxes may be used with them:
• ssh://[user@]host.xz[:port]/path/to/repo.git/
• git://host.xz[:port]/path/to/repo.git/
• http[s]://host.xz[:port]/path/to/repo.git/
• ftp[s]://host.xz[:port]/path/to/repo.git/
An alternative scp-like syntax may also be used with the ssh protocol:
• [user@]host.xz:path/to/repo.git/
So convert the scp-like syntax to ssh:// URLs in parse_uris() for spec
compliance.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ebcfdb8b0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
There are a number of runtime tests that checks that a command fails as
expected, so add an assertRunNotOk() similar to the existing assertRunOk()
to handle that instead of open coding it everywhere.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 03783de150)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Security fixes:
CVE-2026-53613 - mount(8) TOCTOU race on target path.
The SUID mount does not pin the mount target directory, allowing a
race between path resolution and the actual mount syscall. A local
attacker can swap an ancestor directory component between these
steps to redirect a mount to an arbitrary location.
Reported-by: Xinyao Hu
CVE-2026-53612 - mount(8) TOCTOU race on post-mount owner/mode change.
The X-mount.owner, X-mount.group, and X-mount.mode options use
path-based lchown()/chmod() after mounting. An attacker can swap
the target between mount and the ownership/mode change to gain
control of arbitrary files.
Reported-by: Xinyao Hu
CVE-2026-53614 - mount(8) SUID bypass via LIBMOUNT_FORCE_MOUNT2.
The environment variable LIBMOUNT_FORCE_MOUNT2 is not filtered
via safe_getenv() in SUID context. A local attacker can force
the legacy mount(2) code path, which uses a two-step bind+remount
or propagation sequence with a window where security flags (nosuid,
noexec, ...) are not yet applied.
Reported-by: Xinyao Hu
Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.5-ReleaseNotes
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 40ce6355c9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
* Explicitly set shell type. Shellcheck doesn't know OpenRC, but the
script as such is POSIX shell.
* Override warnings not applicable in context.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 3e2cc4e46f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
With the action function as the last command in the script its return
code automatically becomes that of the script, and without explicit
exit shellcheck does not complain about unused functions.
Also wait for the process to stop in "stop", and simplify restart.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b4884a2937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
If sending the stop signal failed for whatever reason, waiting for an
existing PID file to disappear is likely to block indefinitely.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b2d84525f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The exit status of the last command automatically becomes the exit
status of the script. And if there is no explicit exit shellcheck
accepts unused functions (here: start/stop/... called via variable).
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 118ffb20b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Upstream commit
a00a3cce3c
added the code of gli & glm in-tree and removed the usage as external
packages.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8bcb156d33)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes build error not caught by the autobuilders with this defconfig:
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_FORCE_HOST_BUILD=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_KODI_SCREENSAVER_RSXS=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y
BR2_PACKAGE_LIBUDEV_ZERO=y
Raised minimum version for all addons as requested by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 09fcae1588)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Our docker image was finally updated to Debian 12 and now provide Qemu
7.2.15 [1]. We can safely revert this workaround for older Qemu version.
[1] e5bbe020ca
This reverts commit 37e23e0dd7.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4834f18c69)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The NVD database schema has the following entry
```
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.2.8",
},
```
Which make every patch revision of the package ntp match to the
CVE-2015-7977.
This commit ignore this entry.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00e4a03348)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.6/
This fixes the following vulnerabilities:
- CVE-2026-6873 : Signed cookie salt namespace collision
- CVE-2026-7666 : Potential unencrypted email transmission via STARTTLS
in the SMTP backend
- CVE-2026-8404 : Potential exposure of private data via case-sensitive
Cache-Control directives
- CVE-2026-35193: Potential exposure of private data via missing
Vary: Authorization
- CVE-2026-48587: Potential exposure of private data via whitespace padding
in Vary header
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00b9069f46)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
(CVE-2026-34183)
Fixed double-free when checking OCSP stapled response.
(CVE-2026-35188)
Fixed NULL pointer dereference in QUIC server initial packet handling.
(CVE-2026-42764)
Fixed AES-OCB IV ignored on EVP_Cipher() path.
(CVE-2026-45445)
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
(CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
(CVE-2026-34181)
Fixed NULL dereference in certificate verification with OCSP Checking.
(CVE-2026-42765)
Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
(CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
and PKCS7_decrypt().
(CVE-2026-42768)
Fixed trust anchor substitution via cert/issuer typo in CMP
rootCaKeyUpdate.
(CVE-2026-42769)
Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV
and AES-SIV modes.
(CVE-2026-45446)
For more details, see the release notes and advisory:
https://github.com/openssl/openssl/releases/tag/openssl-3.6.3https://openssl-library.org/news/secadv/20260609.txt
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b0ea6e310f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
*) SECURITY: CVE-2026-49975: mod_http2 denial of service
(cve.mitre.org)
Memory Allocation with Excessive Size Value vulnerability in
Apache HTTP Server's mod_http leads to denial of service via
malicious HTTP requests.
This issue affects Apache HTTP Server: from 2.4.17 through
2.4.67.
Credits: Quang Luong of Calif.IO in collaboration with OpenAI
Codex
*) SECURITY: CVE-2026-48913: mod_http2 memory corruption when file
handles exhausted (cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server module
mod_http2 when file handles are already exhausted.
This issue affects Apache HTTP Server: from 2.4.55 through
2.4.67.
Credits: Sam Lovejoy, IBM X-Force Offensive Research (XOR)
*) SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via
Signed Char Overflow (cve.mitre.org)
Buffer Underwrite vulnerability in Apache HTTP Server on crafted
regular expressions in the configuration.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in
mod_proxy_ftp (cve.mitre.org)
Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability in the mod_proxy_ftp module in Apache HTTP Server
with an attacker controlled backend FTP server.
This issue affects undefined: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP
`send_request` (cve.mitre.org)
Buffer Over-read vulnerability in Apache HTTP Server via
outbound OCSP requests to an attacker controlled OCSP server
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44119: escalation of privilege through
expressions in .htaccess in multiple modules (cve.mitre.org)
Improper Privilege Management vulnerability in Apache HTTP
Server 2.4.67 and earlier allows local .htaccess authors to read
files with the privileges of the httpd user.
This issue affects Apache HTTP Server: from through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Lucian Nitescu
*) SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers`
can cause crash (cve.mitre.org)
Out-of-bounds Read vulnerability in Apache HTTP Server with
mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42536: mod_xml2enc heap overflow
(cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with mod_xml2enc, xml2StartParse, and untrusted content
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42535: mod_dav_fs protected directory access
(cve.mitre.org)
A path handling issue in mod_dav_fs in Apache 2.4.67 and
earlier allows a WebDAV content author to directly manipulate
trusted DAV property databases, potentially causing child
process crashes.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer
overflow (cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with malicious backend servers and ProxyPassReverseCookie*
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Arkadi Vainbrand
*) SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow
(cve.mitre.org)
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67
and earlier allows an attack by an untrusted backend.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org)
A cross-site scripting vulnerability exists in mod_proxy_ftp's
HTML directory list generation in Apache HTTP Server 2.4.67 and
earlier when listing FTP directory contents either via forward
or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free
(cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server with mod_ldap
in per-directory configuration
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
For more details, see the CHANGES file:
https://downloads.apache.org/httpd/CHANGES_2.4.68
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 07a690f00b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes:
https://github.com/redis/redis/blob/8.6.4/00-RELEASENOTES
This fixes the following vulnerabilities:
- CVE-2026-23479:
Redis is an in-memory data structure store. In redis-server from 7.2.0
until 8.6.3, the unblock client flow does not handle an error return
from `processCommandAndResetClient` when re-executing a blocked
command. If a blocked client is evicted during this flow, an
authenticated attacker can trigger a use-after-free that may lead to
remote code execution. This has been patched in version 8.6.3.
https://www.cve.org/CVERecord?id=CVE-2026-23479
- CVE-2026-23631:
Redis is an in-memory data structure store. In all versions of redis-
server with Lua scripting, an authenticated attacker can exploit the
master-replica synchronization mechanism to trigger a use-after-free
on replicas where replica-read-only is disabled or can be disabled,
which may lead to remote code execution. A workaround is to prevent
users from executing Lua scripts or avoid using replicas where
replica-read-only is disabled. This is patched in version 8.6.3.
https://www.cve.org/CVERecord?id=CVE-2026-23631
- CVE-2026-25243:
Redis is an in-memory data structure store. In versions of redis-
server up to 8.6.3, the RESTORE command does not properly validate
serialized values. An authenticated attacker with permission to
execute RESTORE can supply a crafted serialized payload that triggers
invalid memory access and may lead to remote code execution. A
workaround is to restrict access to the RESTORE command with ACL
rules. This is patched in version 8.6.3.
https://www.cve.org/CVERecord?id=CVE-2026-25243
- CVE-2026-25588:
RedisTimeSeries is a time-series module for Redis. In all versions
before 1.12.14 of RedisTimeSeries, the module does not properly
validate serialized values processed through the Redis RESTORE
command. An authenticated attacker with permission to execute RESTORE
on a server with the RedisTimeSeries module loaded can supply a
crafted serialized payload that triggers invalid memory access and may
lead to remote code execution. A workaround is to restrict access to
the RESTORE command with ACL rules. This has been patched in version
1.12.14.
https://www.cve.org/CVERecord?id=CVE-2026-25588
- CVE-2026-25589:
RedisBloom is a probabilistic data structures module for Redis. In all
versions of RedisBloom before 2.8.20, the module does not properly
validate serialized values processed through the Redis RESTORE
command. An authenticated attacker with permission to execute RESTORE
on a server with the RedisBloom module loaded can supply a crafted
serialized payload that triggers invalid memory access and may lead to
remote code execution. A workaround is to restrict access to the
RESTORE command with ACL rules. This issue is fixed in version 2.8.20.
https://www.cve.org/CVERecord?id=CVE-2026-25589
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit be7b7821c6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-18 14:38:26 +02:00
570 changed files with 6923 additions and 5878 deletions
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
