mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
f85a7df189
Fixes the following vulnerabilities:
- CVE-2026-4046:
The iconv() function in the GNU C Library versions 2.43 and earlier
may crash due to an assertion failure when converting inputs from the
IBM1390 or IBM1399 character sets, which may be used to remotely crash
an application. This vulnerability can be trivially mitigated by
removing the IBM1390 and IBM1399 character sets from systems that do
not need them.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-4046
- glibc-2.41-135-g61737f43b1f0d9f64a6f16649625476b70f9f4d3
- CVE-2026-4437:
Calling gethostbyaddr or gethostbyaddr_r with a configured
nsswitch.conf that specifies the library's DNS backend in the GNU C
Library version 2.34 to version 2.43 could, with a crafted response
from the configured DNS server, result in a violation of the DNS
specification that causes the application to treat a non-answer
section of the DNS response as a valid answer.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-4437
- glibc-2.41-131-gdbd8335c8ce8af11226ee1514d7a020b15c63345
- CVE-2026-4438:
Calling gethostbyaddr or gethostbyaddr_r with a configured
nsswitch.conf that specifies the library's DNS backend in the GNU C
library version 2.34 to version 2.43 could result in an invalid DNS
hostname being returned to the caller in violation of the DNS
specification.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-4438
- glibc-2.41-132-g502861645bb1baf650d58e2ddd6b230bc26676c9
> git shortlog 2.41-123-gfb4db64a0..glibc-2.41-137-gb676adadb
Carlos O'Donell (2):
resolv: Count records correctly (CVE-2026-4437)
resolv: Check hostname for validity (CVE-2026-4438)
DJ Delorie (1):
include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
Florian Weimer (8):
Switch currency symbol for the bg_BG locale to euro
nss: Introduce dedicated struct nss_database_for_fork type
Linux: In getlogin_r, use utmp fallback only for specific errors
nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
posix: Run tst-wordexp-reuse-mem test
Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
Michael Jeanson (1):
tests: fix tst-rseq with Linux 7.0
Xi Ruoyao (1):
elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
Yury Khrustalev (1):
posix: Fix invalid flags test for p{write,read}v2
Acked-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e3c662eac9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches