Commit Graph

60463 Commits

Author SHA1 Message Date
Francois Perrad
494611a172 package/libxslt: security bump to version 1.1.35
- fix CVE-2021-30560
- remove merged patch, drop autoreconf
- moved from xmlsoft.org to gnome.org
- spaces in hash file

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[yann.morin.1998@free.fr:
  - drop autoreconf as no longer patching
  - also switch home in Config.in
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit acf5b437cc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-16 08:28:44 +01:00
Fabrice Fontaine
50e83f59bd package/libvirt: fix build without libvirtd
Fix the following build failure without libvirtd raised since the
addition of the package in commit
ccfc90e101 and
89064c9e37:

../output-1/build/libvirt-7.10.0/meson.build:1518:2: ERROR: Problem encountered: Requested the Interface driver without netcf or udev and libvirtd support

Fixes:
 - http://autobuild.buildroot.org/results/e43101c6d7f626439ef800263b8f5dfa99ce850b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 87f1dd7b52)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-16 08:28:13 +01:00
Fabrice Fontaine
c80e612f5e docs/manual: remove override in conditional
Remove override of FOO_{CONF_OPTS,DEPENDENCIES} in conditional

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3d7f852ac5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-16 08:27:37 +01:00
Peter Korsgaard
ec2eea8e7b {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 10, 15, 16}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 949aee6377)
[Peter: drop 5.16.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-16 08:25:28 +01:00
Peter Seiderer
6001c72e6f package/util-linux: bump version to 2.37.4 (fixes CVE-2022-0563)
For details see [1] and [2].

[1] https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.4-ChangeLog
[2] https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.4-ReleaseNotes

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a586f0a283)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-16 08:15:56 +01:00
Thomas Petazzoni
8434bf32fa package/gdb: bump 11.x version to 11.2
This is a minor corrective release over GDB 11.1, fixing the following issues:

  PR sim/28302 (gdb fails to build with glibc 2.34)
  PR build/28318 (std::thread support configure check does not use
  CXX_DIALECT)
  PR gdb/28405 (arm-none-eabi: internal-error: ptid_t
  remote_target::select_thread_for_ambiguous_stop_reply(const
  target_waitstatus*): Assertion `first_resumed_thread != nullptr'
  failed)
  PR tui/28483 ([gdb/tui] breakpoint creation not displayed)
  PR build/28555 (uclibc compile failure since commit 4655f8509fd44e6efabefa373650d9982ff37fd6)
  PR rust/28637 (Rust characters will be encoded using DW_ATE_UTF)
  PR gdb/28758 (GDB 11 doesn't work correctly on binaries with a SHT_RELR (.relr.dyn) section)
  PR gdb/28785 (Support SHT_RELR (.relr.dyn) section)

Drop patch 0006-sim-filter-out-SIGSTKSZ-PR-sim-28302.patch, which was
merged upstream as commit 17d6f2152b583cdc7defafa7813b727a304bac5b.

Drop patch 0008-Fix-build-on-rhES5.patch, which was merged upstream as
commit df9ebc472a162306dee8ba6e02b99963c2babb7c?

Drop patch 0009-gdbserver-aarch64-support.patch, which was merged
upstream as commit eb79b2318066cafb75ffdce310e3bbd44f7c79e3.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 8cfbda109f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-16 08:14:27 +01:00
Christian Stewart
ab6016db98 package/go: security bump to 1.17.8
go1.17.8 includes a security fix to the regexp/syntax package, as well as bug
fixes to the compiler, runtime, the go command, and the crypto/x509, and net
packages.

https://go.dev/doc/devel/release#go1.17.minor

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1cd8faa8d3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-15 23:18:45 +01:00
Fabrice Fontaine
7a1463d88f package/xscreensaver: add gdk-pixbuf-xlib dependency
gdk-pixbuf-xlib dependency is needed since bump of gdk-pixbuf to version
2.42.2 in commit a7b51ed301 to avoid the
following "hidden" warnings:

   Warning: GTK version 2.24.33 was found, but at least one supporting
            library (gdk-pixbuf-xlib-2.0) was not, so GTK can't be used.
            Perhaps some of the development packages are not installed?

   Warning: The GTK libraries do not seem to be available; the
            `xscreensaver-demo' program requires them.

   Warning: The GDK-Pixbuf library was not found.

            The PNG library is being used instead.

            Some of the demos will not use images as much as they could.
            You should consider installing GDK-Pixbuf and re-running
            configure.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 35f02050be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-15 22:53:12 +01:00
Fabrice Fontaine
5b71eb2b09 package/gdk-pixbuf-xlib: new package
Deprecated Xlib integration for GdkPixbuf.

gdk-pixbuf-xlib has been deprecated and split off of gdk-pixbuf since
version 2.42.0 and
3362e94c25
resulting in the following "hidden" warnings with xscreensaver since
commit a7b51ed301:

   Warning: GTK version 2.24.33 was found, but at least one supporting
            library (gdk-pixbuf-xlib-2.0) was not, so GTK can't be used.
            Perhaps some of the development packages are not installed?

   Warning: The GTK libraries do not seem to be available; the
            `xscreensaver-demo' program requires them.

   Warning: The GDK-Pixbuf library was not found.

            The PNG library is being used instead.

            Some of the demos will not use images as much as they could.
            You should consider installing GDK-Pixbuf and re-running
            configure.

https://gitlab.gnome.org/Archive/gdk-pixbuf-xlib

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 559df4ef28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-15 22:49:49 +01:00
Adrian Perez de Castro
6e5536ce36 package/seatd: security bump to version 0.6.4
This release contains a security fix in seatd-launch which prevents
removal of files that the calling user did not have privileges to
remove. Release notes:

  https://git.sr.ht/~kennylevinsen/seatd/refs/0.6.4

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 41139cb099)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-14 14:19:41 +01:00
Fabrice Fontaine
845c2d2669 package/dbus: bump to version 1.12.22
https://gitlab.freedesktop.org/dbus/dbus/-/blob/dbus-1.12.22/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7af7acabe0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-14 14:19:26 +01:00
Fabrice Fontaine
cbb6baf8ba package/gnutls: fix build without threads
Fix the following build failure without threads raised since bump to
version 3.7.3 in commit 212b020bb4:

kx.c: In function '_gnutls_nss_keylog_write':
kx.c:164:33: error: 'keylog_mutex' undeclared (first use in this function); did you mean 'keylog_once'?
  164 |   if (gnutls_static_mutex_lock(&keylog_mutex) < 0) {
      |                                 ^~~~~~~~~~~~
      |                                 keylog_once

Fixes:
 - http://autobuild.buildroot.org/results/e092bc11ce4b5908cb6285aa77a3594b8626eeec

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2f4f57b62b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-14 10:15:59 +01:00
Francois Perrad
9250201b56 package/gnutls: security bump to version 3.7.3
see https://www.gnutls.org/security-new.html#GNUTLS-SA-2022-01-17

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 212b020bb4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-14 10:15:47 +01:00
Fabrice Fontaine
7b20502662 package/vim: security bump to version 8.2.4450
Fix CVE-2022-0554: Use of Out-of-range Pointer Offset in GitHub
repository vim/vim prior to 8.2.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 28c9cb5ff3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-14 10:15:24 +01:00
Peter Korsgaard
ae76fa4469 package/samba4: security bump to version 4.14.12
Release notes: https://www.samba.org/samba/history/samba-4.14.12.html

Fixes CVE-2021-44142 & CVE-2022-0336.

Notice that upstream has decided that the fix for CVE-2021-44141 is too
complex to backport, so it is NOT fixed:

https://www.samba.org/samba/security/CVE-2021-44141.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-14 10:09:16 +01:00
Fabrice Fontaine
77545c497e package/mariadb: security bump to version 10.3.34
Fix CVE-2021-46665, CVE-2021-46664, CVE-2021-46661, CVE-2021-46668,
CVE-2021-46663, CVE-2022-24052, CVE-2022-24051, CVE-2022-24050,
CVE-2022-24048, CVE-2021-46659, CVE-2021-35604, CVE-2021-46667,
CVE-2021-46662, CVE-2021-2372, CVE-2021-2389 and CVE-2021-46658

Update hash of README.md (changes not related to license:
773a07b655)

https://mariadb.com/kb/en/mariadb-10334-release-notes/
https://mariadb.com/kb/en/mariadb-10333-release-notes/
https://mariadb.com/kb/en/mariadb-10332-release-notes/
https://mariadb.com/kb/en/mariadb-10331-release-notes/

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e7a9a1bce4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-13 22:25:12 +01:00
Fabrice Fontaine
909acef27b package/libpjsip: security bump to version 2.12
Fix the following security issues (i.e. CVE-2021-37706, CVE-2021-41141,
CVE-2021-43804, CVE-2021-43845, CVE-2022-21722 and CVE-2022-21723):
- Potential integer underflow upon receiving STUN message
  (GHSA-2qpg-f6wf-w984)
- Use after free of dialog set (GHSA-ffff-m5fm-qm62)
- Missing unreleased of locks in failure cases (GHSA-8fmx-hqw7-6gmc)
- Potential out-of-bounds read when parsing RTCP BYE message
  (GHSA-3qx3-cg72-wrh9)
- Prevent OOB read for RTCP XR block (GHSA-r374-qrwv-86hh)
- Potential buffer overflow in pjsua_player_create(),
  pjsua_recorder_create(), pjmedia_wav_player_create(), and
  pjsua_call_dump() (GHSA-qcvw-h34v-c7r9)
- Potential out-of-bound read during RTP/RTCP parsing
  (GHSA-m66q-q64c-hv36)
- Prevent OOB read in multipart parsing (GHSA-7fw8-54cv-r7pm)
- Use after free of dialog set (GHSA-ffff-m5fm-qm62)

https://github.com/pjsip/pjproject/releases/tag/2.12

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5ed26bb378)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-13 22:22:35 +01:00
Fabrice Fontaine
8691a82932 package/libxml2: security bump to version 2.9.13
Fix the following security issues:
- [CVE-2022-23308] Use-after-free of ID and IDREF attributes
- Use-after-free in xmlXIncludeCopyRange
- Fix Null-deref-in-xmlSchemaGetComponentTargetNs
- Fix memory leak in xmlXPathCompNodeTest
- Fix null pointer deref in xmlStringGetNodeList
- Fix several memory leaks found by Coverity

https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.9.13

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4b67038473)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-13 22:16:17 +01:00
Fabrice Fontaine
a1f98ccd7c package/wolfssl: security bump to version 5.2.0
Fix CVE-2021-44718, CVE-2022-23408, CVE-2022-25638 and CVE-2022-25640

https://www.wolfssl.com/docs/security-vulnerabilities
https://github.com/wolfSSL/wolfssl/blob/v5.2.0-stable/ChangeLog.md

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 14e0c4de71)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-13 22:12:19 +01:00
Fabrice Fontaine
f29b1ab92e package/exempi: security bump to version 2.6.1
Extract from NEWS:
- Changes in v2021.08
  - Security Fixes
- Changes in v2021.07
  - Security Fixes

https://gitlab.freedesktop.org/libopenraw/exempi/-/blob/2.6.1/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 55f1d0a359)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-13 22:08:31 +01:00
Fabrice Fontaine
ed5497beda package/xterm: security bump to version 371
Fix CVE-2022-24130: xterm through Patch 370, when Sixel support is
enabled, allows attackers to trigger a buffer overflow in set_sixel in
graphics_sixel.c via crafted text.

Update hash of COPYING (update in year)

https://invisible-island.net/xterm/xterm.log.html#xterm_371

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2de5cd8542)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-13 22:05:35 +01:00
Fabrice Fontaine
91339db0ee package/wireshark: security bump to version 3.4.12
Fix CVE-2021-4190, CVE-2022-0581, CVE-2022-0582, CVE-2022-0583,
CVE-2022-0585 and CVE-2022-0586

https://www.wireshark.org/security/wnpa-sec-2021-22.html
https://www.wireshark.org/security/wnpa-sec-2022-01.html
https://www.wireshark.org/security/wnpa-sec-2022-02.html
https://www.wireshark.org/security/wnpa-sec-2022-03.html
https://www.wireshark.org/security/wnpa-sec-2022-04.html
https://www.wireshark.org/security/wnpa-sec-2022-05.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit db0f8006c1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-13 22:02:43 +01:00
Peter Korsgaard
d8cb00a283 Makefile: unexport 'DEVICE_TREE' environment variable
U-Boot looks for the environment variable DEVICE_TREE and uses its value if
set instead of the CONFIG_DEFAULT_DEVICE_TREE configuration option since
v2021.01, more specifically commit c0f1ebe9c1b9745e (binman: Allow selecting
default FIT configuration) - So unexport it like we do for other
"troublesome" environment variables to ensure consistent behaviour.

Reported-by: Neal Frager <nealf@xilinx.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d3910057c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-11 22:56:22 +01:00
Fabrice Fontaine
37683e06b9 package/flac: security bump to version 1.3.4
This release mostly fixes (security related) bugs including:
 - Fix 12 decoder bugs found by oss-fuzz, including CVE-2020-0499
 - Fix encoder bug CVE-2021-0561

Also:
 - Replace first patch which was reverted by
   4fbb6d4f2e
 - Disable stack protection (enabled by default since
   f706f28322)
 - Drop md5 which is not provided anymore
 - Update indentation in hash file (two spaces)

https://github.com/xiph/flac/releases/tag/1.3.4

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4c7e250c69)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-11 22:22:32 +01:00
Fabrice Fontaine
fe570807b0 package/python-ipython: security bump to version 7.31.1
Fix CVE-2022-21699: IPython (Interactive Python) is a command shell for
interactive computing in multiple programming languages, originally
developed for the Python programming language. Affected versions are
subject to an arbitrary code execution vulnerability achieved by not
properly managing cross user temporary files. This vulnerability allows
one user to run code as another on the same machine. All users are
advised to upgrade.

Also update indentation in hash file (two spaces)

https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aeb138911e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-11 22:17:02 +01:00
Fabrice Fontaine
d3ddfdf64c package/librsvg: fix loaders.cache with with per-package directories
host-librsvg install a gdk-pixbuf module (aka plugin). As such, it needs
to update [0] the modules cache (a kind of registry of which modules are
installed and what the can handle). To that effect, it calls the utility
gdk-pixbuf-queryloaders, which generates the cache of existing modules.

gdk-pixbuf-queryloaders, from the gdk-pixbuf package, has been
configured to be relocatable. However, it still embeds the path to where
it was instaled, and thus where to look modules from. If it is run from
its install location, then gdk-pixbuf-queryloaders looks modules in that
location, and generates a modules cache with relative paths; otherwise,
it still looks at that location, but generates a cache with absolute
paths. In the later case, it will miss the modules that have not been
installed by gdk-pixbuf itself.

In the case of host-librsvg, that will miss the fact that librsvg just
happened to have installed a module. Further down the road, packages
that depend on host-librsvg, will get their PPD prepared, the path fixup
hook run, so that the cache properly points to the current package's
PPD, but the cache will not include the SVG module, which causes
failures to load CVG images:

    Can't load file: Unrecognized image file format

So, we need to tell gdk-pixbuf-queryloaders where the module path is,
which restores the relativity of the paths it reports, by specifying the
modules path pointing to the current package's PPD, passed in the
environement variable GDK_PIXBUF_MODULEDIR.

We need to do that at install time, so that the SVG module is properly
listed in the cache, so that dependees can use it.

A temporary cache is also generated at build time, but its usefullness
is dubious; it seem to only be used by the test tool, which we do not
run. However, for consistency-sake, we also fix that.

Fixes:
 - http://autobuild.buildroot.org/results/0e00059b09b4445eaaec1030997883187c6a80d6

[0] This will trigger file-overwrite detection in the future... But we
currently do not have infrastructure to properly handle such a cache.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: reword and extend an already-good commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 63b780f5e9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-11 21:51:17 +01:00
Fabrice Fontaine
2ecadb5fca package/expat: bump to version 2.4.6
This release fixes a regression introduced by one of the security fixes
in 2.4.5.

https://blog.hartwork.org/posts/expat-2-4-6-released
https://github.com/libexpat/libexpat/blob/R_2_4_6/expat/Changes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 46390b3a7c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 23:35:55 +01:00
Romain Naour
be2ef38faa package/python-twisted: add missing python typing extensions runtime dependency
# python sample_python_txtorcon.py
 Traceback (most recent call last):
   File "/root/sample_python_txtorcon.py", line 1, in <module>
     import txtorcon  # noqa
   File "/usr/lib/python3.10/site-packages/txtorcon/__init__.py", line 11, in <module>
   File "/usr/lib/python3.10/site-packages/txtorcon/router.py", line 10, in <module>
   File "/usr/lib/python3.10/site-packages/txtorcon/util.py", line 17, in <module>
   File "/usr/lib/python3.10/site-packages/twisted/internet/defer.py", line 42, in <module>
 ModuleNotFoundError: No module named 'typing_extensions'

python typing_extensions is required since python-twisted 22.1.0 [1]

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/2116202537

[1] 6e768da0a1

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b43ba475cf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 22:52:31 +01:00
Fabrice Fontaine
e12ce1a6b9 package/python-twisted: security bump to version 22.1.0
Fix CVE-2022-21712: twisted is an event-driven networking engine written
in Python. In affected versions twisted exposes cookies and
authorization headers when following cross-origin redirects. This issue
is present in the `twited.web.RedirectAgent` and `twisted.web.
BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There
are no known workarounds.

Update hash of license file (author added and update in year:
13aa59746a
adfdf23477
7e65fbeed3)

https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
https://github.com/twisted/twisted/releases/tag/twisted-22.1.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit af37e96f3d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 22:52:17 +01:00
Fabrice Fontaine
d9395a06b1 package/gdk-pixbuf: fix run with per-package directory
gdk-pixbuf is based on plugins (modules in gdk-pixbuf parlance) that are
provided either by the gdk-pixbuf package itself, or be installed by
third-party packages, like librsvg. At runtime, those plugins get loaded
by helper function in the gdk-pixbuf library.

The location where to find those modules is currently hard-coded at
build time, to the location where gdb-pixbuf is installed.. This means
that host-packages that install image-conversion utilities will try to
look in the path where gdk-pixbuf was installed.

With per-package directories, this fails to find any module that was
installed bu a third-party package. For example, the module for loading
an SVG provided by librsvg, so it is not present in the PPD of
gdk-pixbuf, and thus loading an SVG (e.g. to convert it to another
format, like adwaita-icon-theme does) will fail with:

    Can't load file: Unrecognized image file format

However, gdk-pixbuf can be configured so as to look for the modules
relative to where the program is run from, rather than hard-coding the
location at build time. This is exactly what we need in the PPD case

Additionally, even without PPD, this would fail in a similar manner in
the SDK, as that can be relocated too.

So we unconditionally enable the relocatable option, but only for the
host variant (there is no reason to enable it for the target, as it is
not going to be relocated).

Fixes:
 - http://autobuild.buildroot.org/results/0e00059b09b4445eaaec1030997883187c6a80d6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: reword the already-good commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 75361a9aba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 22:48:56 +01:00
Peter Korsgaard
f45f6bae0d package/zsh: security bump to version 5.8.1
Fixes the following security issue:

- CVE-2021-45444: In zsh before 5.8.1, an attacker can achieve code
  execution if they control a command output inside the prompt, as
  demonstrated by a %F argument.  This occurs because of recursive
  PROMPT_SUBST expansion.

The 5.8.1 release is not listed in MD5SUM, so drop the md5 hash.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ca6c2ee3da)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 22:46:41 +01:00
Peter Seiderer
15d2938c24 package/wireless-regdb: bump version to 2022.02.18
Changelog (since 2021.08.28, [1]):

  e061299 wireless-regdb: Raise DFS TX power limit to 250 mW (24 dBm) for the US
  2ce78ed wireless-regdb: Update regulatory rules for Croatia (HR) on 6GHz
  0d39f4c wireless-regdb: Update regulatory rules for South Korea (KR)
  acad231 wireless-regdb: Update regulatory rules for France (FR) on 6 and 60 GHz
  ea83a82 wireless-regdb: add support for US S1G channels
  4408149 wireless-regdb: add 802.11ah bands to world regulatory domain
  5f3cadc wireless-regdb: Update regulatory rules for Spain (ES) on 6GHz
  e0ac69b Revert "wireless-regdb: Update regulatory rules for South Korea (KR)"
  40e5e80 wireless-regdb: Update regulatory rules for South Korea (KR)
  e427ff2 wireless-regdb: Update regulatory rules for China (CN)
  0970116 wireless-regdb: Update regulatory rules for the Netherlands (NL) on 6GHz
  4dac44b wireless-regdb: update regulatory database based on preceding changes

[1] https://lore.kernel.org/linux-wireless/YhBCKWNw3IMfGs0L@ubuntu-x1/

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 324f055252)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 22:43:00 +01:00
Bernd Kuhls
bfe590a959 package/php: security bump version to 8.0.16
Changelog: https://www.php.net/ChangeLog-8.php#8.0.16

Fixes CVE-2021-21708.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4c4d289229)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 20:39:08 +01:00
Fabrice Fontaine
42ecaeb1ce package/expat: security bump to version 2.4.5
Security fixes:
 #562  CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
       sequences (e.g. from start tag names) to the XML
       processing application on top of Expat can cause
       arbitrary damage (e.g. code execution) depending
       on how invalid UTF-8 is handled inside the XML
       processor; validation was not their job but Expat's.
       Exploits with code execution are known to exist.
 #561  CVE-2022-25236 -- Passing (one or more) namespace separator
       characters in "xmlns[:prefix]" attribute values
       made Expat send malformed tag names to the XML
       processor on top of Expat which can cause
       arbitrary damage (e.g. code execution) depending
       on such unexpectable cases are handled inside the XML
       processor; validation was not their job but Expat's.
       Exploits with code execution are known to exist.
 #558  CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
       that could be triggered by e.g. a 2 megabytes
       file with a large number of opening braces.
       Expected impact is denial of service or potentially
       arbitrary code execution.
 #560  CVE-2022-25314 -- Fix integer overflow in function copyString;
       only affects the encoding name parameter at parser creation
       time which is often hardcoded (rather than user input),
       takes a value in the gigabytes to trigger, and a 64-bit
       machine.  Expected impact is denial of service.
 #559  CVE-2022-25315 -- Fix integer overflow in function storeRawNames;
       needs input in the gigabytes and a 64-bit machine.
       Expected impact is denial of service or potentially
       arbitrary code execution.

https://blog.hartwork.org/posts/expat-2-4-5-released/
https://github.com/libexpat/libexpat/blob/R_2_4_5/expat/Changes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 21c07c0aaa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-10 20:37:06 +01:00
Peter Korsgaard
eeb8c004da Update for 2021.11.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-28 21:18:28 +01:00
Fabrice Fontaine
49b1a3ef2e package/expat: fix tarball sha256
Commit ab71ac15dd forgot to update sha256

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: update  hash for real ;-)]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 59a813d2a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-28 20:55:13 +01:00
Giulio Benetti
a7b9636286 configs/roc_pc_rk3399_defconfig: expand rootfs size to 120M
Default 60M for rootfs are not enough and generate a build failure, so
let's expand rootfs size to 120M.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 5194113331)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 21:38:40 +01:00
Giulio Benetti
bec884cf3b toolchain: fix gcc bug 99140 condition
Gcc bug 99140 exhibits with gcc versions:
- up to 7.x
- 9.x
- 10.x
and doesn't show up with gcc versions:
- 8.x
- 11.x
then moving BR2_TOOLCHAIN_GCC_AT_LEAST_9 to BR2_TOOLCHAIN_GCC_AT_LEAST_10
makes gcc version 9 set as working but it's not. So let's back substitute
BR2_TOOLCHAIN_GCC_AT_LEAST_10 with BR2_TOOLCHAIN_GCC_AT_LEAST_9.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 33ea4d7887)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 21:32:51 +01:00
Fabrice Fontaine
57fb6f5201 package/python-regex: fix license
License is Apache-2.0 since bump to version 2021.4.4 in commit
d973fac7ca and
b693a1fba7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 261bb9a17a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 21:25:46 +01:00
Fabrice Fontaine
b8caff2cf2 package/resiprocate: fix build of rend with gcc 11
Fix the following build failure of rend with gcc 11:

/home/buildroot/autobuild/instance-3/output-1/host/opt/ext-toolchain/riscv32-buildroot-linux-gnu/include/c++/11.2.0/bits/stl_tree.h:770:15: error: static assertion failed: comparison object must be invocable as const
  770 |               is_invocable_v<const _Compare&, const _Key&, const _Key&>,
      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/ad9d89fefe1a667daa123397a072bf130bfa03a7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a715593d94)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 21:23:55 +01:00
Fabrice Fontaine
eb84d08807 package/kodi: add bluetooth dependency comment
Commit 43122d64e0 forgot to add bluetooth
dependency comment

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 38b5f2069b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 21:20:49 +01:00
Giulio Benetti
e3fdd72274 docs/manual: fix "+size = +" latex formatting
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 46beca0656)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 21:13:54 +01:00
Andreas Ziegler
8ab26921c2 package/mpd: ignore CVE-2020-746[56] intended for FreeBSD PPP daemon
cpe:2.3🅰️mpd_project:mpd:*:*:*:*:*:*:*:* is not a valid CPE
identifier for mpd (musicpd.org); this string refers to
MPD /FreeBSD PPP daemon (sourceforge.net/projects/mpd)

Since mpd does not have entries in the CVE database, put these
two CVE identifiers on the mpd ignore list:

  https://nvd.nist.gov/vuln/detail/CVE-2020-7465
  https://nvd.nist.gov/vuln/detail/CVE-2020-7466

Signed-off-by: Andreas Ziegler <br015@umbiko.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 210e6bd559)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 21:01:28 +01:00
Giulio Benetti
0cc9eed5d4 board/intel/galileo: fix build failure with host gcc 10
Building galileo_defconfig throws error:
```
/usr/bin/ld: arch/x86/tools/relocs_64.o:(.bss+0x0): multiple definition of `per_cpu_load_addr'; arch/x86/tools/relocs_32.o:(.bss+0x0): first defined here
```

To fix this let's add an upstreamed patch[1] and add BR2_GLOBAL_PATCH_DIR
to galileo_defconfig to point to where patch is.

[1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eeeda4cd06e828b331b15741a204ff9f5874d28d.patch

Fixes:
https://gitlab.com/ymorin/buildroot/-/jobs/2035821039

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9dd5382d79)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 20:58:15 +01:00
Giulio Benetti
3a1d44dfa0 DEVELOPERS: remove Martin Hicks from file
Martin Hicks asked to not maintain cryptsetup anymore:
https://lists.buildroot.org/pipermail/buildroot/2022-February/635413.html

Also he doesn't mantain any other package, so let's remove him from this
file.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d06bf4a9d7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 20:53:12 +01:00
Giulio Benetti
9d48687bb2 DEVELOPERS: add Giulio Benetti to cryptsetup package
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a5e72ca9e7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 20:52:25 +01:00
Giulio Benetti
3e7238e9d1 package/util-linux: improve host build failure fix
As suggested by Peter Seiderer package util-linux doesn't need raw support
when built for host, so let's remove:
HOST_UTIL_LINUX_POST_PATCH_HOOKS += UTIL_LINUX_FIX_DISK_UTILS_COMPILE
in favor of:
HOST_UTIL_LINUX_CONF_OPTS += --disable-raw
This is a better approach than my commit:
https://git.buildroot.net/buildroot/commit/?id=d895bd973b35fde10d3dd7db530d9e4782926497

Suggested-by: Peter Seiderer <ps.report@gmx.net>
Tested-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 498117df12)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 20:30:07 +01:00
Giulio Benetti
f34fcc03cf package/util-linux: fix host build failure
The UTIL_LINUX_FIX_DISK_UTILS_COMPILE workaround is needed for host
building too. So let's add it to HOST_UTIL_LINUX_POST_PATCH_HOOKS.
host-util-linux is used a lot, so this patch fixes a lot of future
builds.

Fixes:
http://autobuild.buildroot.net/results/b8c/b8cb40efc036a01802c914544cd4fc29dfd67af6//

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d895bd973b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 20:29:58 +01:00
Peter Seiderer
8c97451ab9 package/util-linux: bump version to 2.37.3 (fixes CVE-2021-3996, CVE-2021-3995)
- add 'touch' workaround for missing disk-utils/raw.8 file ([1], [2]) in
  util-linux-2.37.3 release download package

For details see [1].

[1] https://www.spinics.net/lists/util-linux-ng/msg17037.html

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Arnout: put fix in POST_PATCH instead of PRE_COMPILE hook]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b292f1d41a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 20:29:48 +01:00
Yann E. MORIN
9ca49fba1a linux: fix build with host-gcc 10+
Some older versions of linux, or custom versions (like forks for some
boards), fail to build with host-gcc 10+, because of redefined symbols:

      HOSTLD  scripts/dtc/dtc
    /usr/bin/ld: scripts/dtc/dtc-parser.tab.o:(.bss+0x10): multiple definition
    of `yylloc'; scripts/dtc/dtc-lexer.lex.o:(.bss+0x0): first defined here
    collect2: error: ld returned 1 exit status

Since this has been fixed in recent-ish versions, we can't use an
unconditionaly patch, so we must have a conditional patch. However, a
patch may not always apply to arbitrary Linux versions or forks.

Upstream just dropped that line altogether:
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e33a814e772cdc36436c8c188d8c42d019fda639

So, we use a little sed-grep combo to do the exact same change.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Reviewed-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Tested-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9b41b54be0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-02-27 20:22:15 +01:00