mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-09 17:03:35 -09:00
cdd1c5ca55
This contains many bug and security fixes since v22.12.0. See the release notes: https://poppler.freedesktop.org/releases.html In addition: - Drop patch that has been applied upstream - Update a few cmake configuration options that changed upstream There is currently a build failure when enabling gpgme, so disable it unconditionally for now. Finally, this fixes the following vulnerabilities: - CVE-2024-6239: A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service. https://www.cve.org/CVERecord?id=CVE-2024-6239 - CVE-2024-56378: libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. https://www.cve.org/CVERecord?id=CVE-2024-56378 - CVE-2025-32364: A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. https://www.cve.org/CVERecord?id=CVE-2025-32364 - CVE-2025-32365: Poppler before 25.04.0 allows crafted input files to trigger out-of- bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. https://www.cve.org/CVERecord?id=CVE-2025-32365 - CVE-2025-43903: NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. https://www.cve.org/CVERecord?id=CVE-2025-43903 - CVE-2025-50420: An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS). https://www.cve.org/CVERecord?id=CVE-2025-50420 - CVE-2025-52886: Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue. https://www.cve.org/CVERecord?id=CVE-2025-52886 Signed-off-by: Titouan Christophe <titouan.christophe@mind.be> [Julien: mark commit as "security" in commit log title] Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at http://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches