Fix CVE-2022-46149: Cap'n Proto is a data interchange format and remote
procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1,
0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust
implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to
out-of-bounds read due to logic error handling list-of-list. This issue
may lead someone to remotely segfault a peer by sending it a malicious
message, if the victim performs certain actions on a list-of-pointer
type. Exfiltration of memory is possible if the victim performs
additional certain actions on a list-of-pointer type. To be vulnerable,
an application must perform a specific sequence of actions, described in
the GitHub Security Advisory. The bug is present in inlined code,
therefore the fix will require rebuilding dependent applications. Cap'n
Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and
0.10.3.
https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hxhttps://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fixes the following security issues:
- CVE-2022-3550: A vulnerability classified as critical was found in X.org
Server. Affected by this vulnerability is the function _GetCountedString
of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is
recommended to apply a patch to fix this issue. The associated identifier
of this vulnerability is VDB-211051.
- CVE-2022-3551: A vulnerability, which was classified as problematic, has
been found in X.org Server. Affected by this issue is the function
ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to
memory leak. It is recommended to apply a patch to fix this issue. The
identifier of this vulnerability is VDB-211052.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fixes the following security issues:
- CVE-2022-37325: A zero length Called or Calling Party Number can cause a
buffer under-run and Asterisk crash.
https://downloads.asterisk.org/pub/security/AST-2022-007.html
- CVE-2022-42705: Use after free in res_pjsip_pubsub.c may allow a remote
authenticated attacker to crash Asterisk (denial of service) by performing
activity on a subscription via a reliable transport at the same time
Asterisk is also performing activty on that subscription.
https://downloads.asterisk.org/pub/security/AST-2022-008.html
- CVE-2022-42706: AMI Users with “config” permissions may read files outside
of Asterisk directory via GetConfig AMI Action even if “live_dangerously"
is set to "no"
https://downloads.asterisk.org/pub/security/AST-2022-009.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Samples can be disabled since version 2.6.2 and
a8db9f4e7e
This bump will fix the following build failure on arm with gcc 10 raised
since bump to version 2.6.0 in commit
55f1d0a359 and
0872e35a300872e35a30
thanks to
f26d77ba26:
/home/giuliobenetti/autobuild/run/instance-3/output-1/host/lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: ../../XMPFiles/source/.libs/libXMPFiles.a(XMPFiles_Impl.o):(.rodata+0x5c): multiple definition of `typeinfo name for TXMPMeta<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >'; XMPFilesCoverage.o:(.rodata+0x0): first defined here
https://gitlab.freedesktop.org/libopenraw/exempi/-/blob/2.6.3/NEWS
Fixes:
- http://autobuild.buildroot.org/results/c440719de02a154c6bdae11bda06ea30c131c71d
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Building with libressl results in the following build failure since the
addition of the package in commit
736c4c1655:
src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c: In function '_session_secret':
src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c:228:47: error: invalid use of incomplete typedef 'SSL' {aka 'struct ssl_st'}
228 | eap_fast_session_ticket(tls_session, s->s3->client_random, s->s3->server_random, secret, secret_len);
| ^~
Disable building with libressl following upstream feedback:
https://github.com/FreeRADIUS/freeradius-server/pull/4689
Fixes:
- http://autobuild.buildroot.org/results/c8df444f4c39f83e254dbb642a5852a1c956f7bb
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
For change log since 1.17, see:
- https://dev.yorhel.nl/ncdu/changes
This commit also adds md5 and sha1 hashes published on the web site.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Add support for new optional gsettings meson config option.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Many new features & bugfixes.
https://github.com/mobile-shell/mosh/releases
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
CVE-2022-39253: git vulnerability mitigation.
... and other bugfixes.
https://github.com/moby/buildkit/releases/tag/v0.10.6
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Rebase the patch for riscv compatibility as well.
"go mod tidy" insists on updating x/sys so pin it to the version from upstream
release v2.3 using a replace statement.
https://github.com/rfjakob/gocryptfs/releases/tag/v2.3
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The 5.19.x series is now EOL upstream, so drop the linux-headers option and
add legacy handling for it.
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Reviewed-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
License hash changed due to year update:
8794887e2a
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
License hash changed due to syntax update:
2a0405d07e
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
