mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-25 10:22:41 -09:00
57f40e5f6e
Fixes the following vulnerabilities: - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification https://curl.se/docs/CVE-2026-86410.html - CVE-2026-86412: server-set cookie erases cookie jar https://curl.se/docs/CVE-2026-86412.html - CVE-2026-86413: Negotiate credentials sent to redirected origin https://curl.se/docs/CVE-2026-86413.html - CVE-2026-86414: leaking host credentials to HTTP proxy https://curl.se/docs/CVE-2026-86414.html - CVE-2026-86415: auto client cert connection reuse mixup https://curl.se/docs/CVE-2026-86415.html - CVE-2026-87861: cross-origin reuse of a Negotiate connection https://curl.se/docs/CVE-2026-87861.html - CVE-2026-87862: HSTS cache import drops longer-lived child https://curl.se/docs/CVE-2026-87862.html - CVE-2026-87863: HSTS response erases persisted entries https://curl.se/docs/CVE-2026-87863.html - CVE-2026-87865: knownhost callback mismatches key as missing https://curl.se/docs/CVE-2026-87865.html - CVE-2026-87866: wolfSSL public-key pinning bypass https://curl.se/docs/CVE-2026-87866.html - CVE-2026-92386: server-set cookie aborts cookie jar load https://curl.se/docs/CVE-2026-92386.html - CVE-2026-92387: never-ending loop via server response omission https://curl.se/docs/CVE-2026-92387.html - CVE-2026-92388: FTP wildcard write callback mixup https://curl.se/docs/CVE-2026-92388.html - CVE-2026-92389: TFTP direction confusion https://curl.se/docs/CVE-2026-92389.html - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints https://curl.se/docs/CVE-2026-92390.html - CVE-2026-92391: curl_mime_free stack overflow by recursion https://curl.se/docs/CVE-2026-92391.html - CVE-2026-92392: HTTP/2 upload Use-After-Free https://curl.se/docs/CVE-2026-92392.html - CVE-2026-94265: Authorization: Negotiate sent to foreign origin https://curl.se/docs/CVE-2026-94265.html - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL https://curl.se/docs/CVE-2026-94266.html - CVE-2026-107928: info leak uploading over WebSockets with GnuTLS https://curl.se/docs/CVE-2026-107928.html - CVE-2026-107929: local interface connection reuse mixup https://curl.se/docs/CVE-2026-107929.html - bump to version 8.23.0 (for details see [1], [2]) - drop '--enable-smb'/'--disable-smb' as smb support is gone (see [1]) [1] https://curl.se/changes.html [2] https://daniel.haxx.se/blog/2026/10/14/curl-8-23-0/ Signed-off-by: Peter Seiderer <ps.report@gmx.net> [Peter: add CVE info] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches