Commit Graph

57752 Commits

Author SHA1 Message Date
Giulio Benetti
4b97c3aaec DEVELOPERS: add myself to trace-cmd package
Add myself to trace-cmd package.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit deb6389ea7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 12:59:30 +02:00
Giulio Benetti
1902517b85 package/trace-cmd: fix build for Sparc64
Trace-cmd needs -fPIC for Sparc64 platform otherwise it fails on linking,
so add -fPIC to CFLAGS when building for such platform.

Fixes;
    http://autobuild.buildroot.net/results/c59/c596f6308b7f4d44d9ba009ed0c395396fc72f47/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b1942c8e47)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 12:59:27 +02:00
Fabrice Fontaine
2b06df03c8 package/minicom: drop autoreconf
autoreconf (and so AM_ICONV) is not needed since commit
2df32e0d44

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5d25d5cb66)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 21:59:23 +02:00
Fabrice Fontaine
75be143e55 package/dovecot: drop host-gettext
AM_ICONV is not needed since drop of autoreconf in commit
03fbb81b8b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit aa90237546)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 21:55:00 +02:00
Peter Korsgaard
81d196decb package/libyang: security bump to version 1.0.240
Fixes the following security issues:

- CVE-2021-28902: In function read_yin_container() in libyang <= v1.0.225,
  it doesn't check whether the value of retval->ext[r] is NULL.  In some
  cases, it can be NULL, which leads to the operation of
  retval->ext[r]->flags that results in a crash.

- CVE-2021-28903: A stack overflow in libyang <= v1.0.225 can cause a denial
  of service through function lyxml_parse_mem().  lyxml_parse_elem()
  function will be called recursively, which will consume stack space and
  lead to crash.

- CVE-2021-28904: In function ext_get_plugin() in libyang <= v1.0.225, it
  doesn't check whether the value of revision is NULL.  If revision is NULL,
  the operation of strcmp(revision, ext_plugins[u].revision) will lead to a
  crash.

- CVE-2021-28905: In function lys_node_free() in libyang <= v1.0.225, it
  asserts that the value of node->module can't be NULL.  But in some cases,
  node->module can be null, which triggers a reachable assertion (CWE-617).

- CVE-2021-28906: In function read_yin_leaf() in libyang <= v1.0.225, it
  doesn't check whether the value of retval->ext[r] is NULL.  In some cases,
  it can be NULL, which leads to the operation of retval->ext[r]->flags that
  results in a crash.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 800bf65adc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 21:47:34 +02:00
Peter Korsgaard
887e2a81a8 package/fetchmail: security bump to version 6.4.22
Fixes the following security issues:

- CVE-2021-39272: Fetchmail before 6.4.22 fails to enforce STARTTLS session
  encryption in some circumstances, such as a certain situation with IMAP
  and PREAUTH.
  https://www.fetchmail.info/fetchmail-SA-2021-02.txt

Update COPYING hash for a clarification of the license situation with
openssl 3.x (which is Apache 2.0 licensed):

8eed56c21c

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6041702a24)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 21:45:20 +02:00
Michael Nosthoff
6e8d26419a package/botan: fix boost dependency
only build --with-boost when both required modules (filesystem and system) are
also selected.

Fixes:
http://autobuild.buildroot.net/results/4fbf2a63f9ddfbc540ce7dabd10964b311477c06

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5572b2e531)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 21:34:22 +02:00
Peter Korsgaard
d9e45a837e package/erlang: ignore Windows specific CVE-2021-29221
CVE-2021-29221 is a Windows specific issue:

A local privilege escalation vulnerability was discovered in Erlang/OTP
prior to version 23.2.3.  By adding files to an existing installation's
directory, a local attacker could hijack accounts of other users running
Erlang programs or possibly coerce a service running with "erlsrv.exe" to
execute arbitrary code as Local System.  This can occur only under specific
conditions on Windows with unsafe filesystem permissions.

So ignore it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e7c2eaf929)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 20:12:14 +02:00
Peter Korsgaard
18caf49a15 package/botan: add upstream security fix for CVE-2021-40529
Fixes the following security issue:

- CVE-2021-40529: The ElGamal implementation in Botan through 2.18.1, as
  used in Thunderbird and other products, allows plaintext recovery because,
  during interaction between two cryptographic libraries, a certain
  dangerous combination of the prime defined by the receiver's public key,
  the generator defined by the receiver's public key, and the sender's
  ephemeral exponents can lead to a cross-configuration attack against
  OpenPGP

For more details, see the upstream bug and issue writeup:
- https://github.com/randombit/botan/pull/2790
- https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 31c94080d2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 20:05:51 +02:00
Peter Korsgaard
a7e7f6be77 package/nodejs: security bump to version 12.22.6
Fixes the following security issues:

- CVE-2021-37701: Arbitrary File Creation/Overwrite via insufficient symlink
  protection due to directory cache poisoning using symbolic links

- CVE-2021-37712: Arbitrary File Creation/Overwrite via insufficient symlink
  protection due to directory cache poisoning using symbolic links

- CVE-2021-37713: Arbitrary File Creation/Overwrite on Windows via
  insufficient relative path sanitization

- CVE-2021-39134: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

- CVE-2021-39135: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e3bdcdd596)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:07:09 +02:00
Peter Seiderer
962e030f0e package/gst1-interpipe: bump version to 1.1.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit edb6d5f00b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:00:27 +02:00
Peter Seiderer
fb6f66236d package/gst1-python: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 02bf32ca01)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:00:01 +02:00
Peter Seiderer
d81bb9865a package/gst-omx: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 598c852077)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:55 +02:00
Peter Seiderer
b1119b67a8 package/gstreamer1-editing-services: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fc3e9ba25a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:50 +02:00
Peter Seiderer
5aaabc58f3 package/gst1-rtsp-server: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 931c6e2a70)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:42 +02:00
Peter Seiderer
c67d175955 package/gst1-vaapi: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f8e9c7470b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:30 +02:00
Peter Seiderer
64e4b46cff package/gst1-libav: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e2bfdc4f18)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:25 +02:00
Peter Seiderer
59db3f5140 package/gst1-devtools: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 40e02dccd5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:16 +02:00
Peter Seiderer
8b540d981b package/gst1-plugins-ugly: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6e6d6185dc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:10 +02:00
Peter Seiderer
d3751ed284 package/gst1-plugins-bad: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 50cc9ab544)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:59:04 +02:00
Peter Seiderer
f47a5edfb4 package/gst1-plugins-good: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 374b8f5845)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:58:58 +02:00
Peter Seiderer
85c6cc684d package/gst1-plugins-base: bump version to 1.18.5
- delete 0002-gstgl-Fix-build-when-Meson-0.58.0rc1.patch
  (from upstream [1])

[1] 90903917a8

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2f707103c3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:58:51 +02:00
Peter Seiderer
10a00b5ed5 package/gstreamer1: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 97fddaa3df)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:58:46 +02:00
Petr Vorel
94b2bea8ff package/bind: security bump version to 9.11.35
Named failed to check the opcode of responses when performing zone
refreshes, stub zone updates, and UPDATE forwarding.  This could lead to an
assertion failure under certain conditions and has been addressed by
rejecting responses whose opcode does not match the expected value. [GL #2762]

For details, see the release notes:
https://downloads.isc.org/isc/bind9/9.11.35/RELEASE-NOTES-bind-9.11.35.html

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6977ee6e0e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:45:30 +02:00
Fabrice Fontaine
c2d27a1350 package/lxc: bump to version 4.0.10
https://discuss.linuxcontainers.org/t/lxc-4-0-10-has-been-released/11618
https://discuss.linuxcontainers.org/t/lxc-4-0-9-lts-has-been-released/10999

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9a48be36d5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:41:26 +02:00
Fabrice Fontaine
e8312c4128 package/runc: bump to version 1.0.2
https://github.com/opencontainers/runc/releases/tag/v1.0.2
https://github.com/opencontainers/runc/releases/tag/v1.0.1
https://github.com/opencontainers/runc/releases/tag/v1.0.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 21704ad112)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 11:59:16 +02:00
Fabrice Fontaine
db9ac29952 package/libxcrypt: bump to version 4.4.26
This bump contains a single change to fix the following build failure
with Microblaze raised since bump to version 4.4.25 in commit
a071bec0a0:

lib/crypt-gensalt-static.c:33:1: error: symver is only supported on ELF platforms
   33 | SYMVER_crypt_gensalt;
      | ^~~~~~~~~~~~~~~~~~~~

Update hash of LICENSING due to new file being added with
4ab5f672eb

https://github.com/besser82/libxcrypt/blob/v4.4.26/NEWS

Fixes:
 - http://autobuild.buildroot.org/results/4766bfce9813b7f321369ec45298d16cd6dc251a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 30479788f1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 23:13:56 +02:00
Fabrice Fontaine
cc01ef612c package/containerd: security bump to version 1.4.9
- Fix CVE-2021-32760:
  https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w
- Update indentation in hash file (two spaces)

https://github.com/containerd/containerd/releases/tag/v1.4.9
https://github.com/containerd/containerd/releases/tag/v1.4.8
https://github.com/containerd/containerd/releases/tag/v1.4.7
https://github.com/containerd/containerd/releases/tag/v1.4.6
https://github.com/containerd/containerd/releases/tag/v1.4.5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 90f175045a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 22:42:27 +02:00
Adam Duskett
18f6da3eea package/openjdk{-bin}: security bump versions to 11.0.12+7 and 16.0.2+7
As the github repository has changed from github.com/AdoptOpenJDK/ to
github.com/adoptium, both versions are updated in the same patch.

Security fixes

    JD K-8256157: Improve bytecode assembly
    JDK-8256491: Better HTTP transport
    JDK-8258432, CVE-2021-2341: Improve file transfers
    JDK-8260453: Improve Font Bounding
    JDK-8260960: Signs of jarsigner signing
    JDK-8260967, CVE-2021-2369: Better jar file validation
    JDK-8262380: Enhance XML processing passes
    JDK-8262403: Enhanced data transfer
    JDK-8262410: Enhanced rules for zones
    JDK-8262477: Enhance String Conclusions
    JDK-8262967: Improve Zip file support
    JDK-8264066, CVE-2021-2388: Enhance compiler validation
    JDK-8264079: Improve abstractions
    JDK-8264460: Improve NTLM support

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit baaf71b9bb)
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 17:31:18 +02:00
Peter Seiderer
d4dcd9509d package/qt5location: fix musl compile (pthread_getname_np)
- pthread_getname_np not available with musl libc, add patch to disable
  usage for musl (patch inspired/ported from [1])

Fixes:

  - http://autobuild.buildroot.net/results/ed372a4a8e50d9e20be589eeda40c92888d709bc

  platform/default/thread.cpp: In function ‘std::string mbgl::platform::getCurrentThreadName()’:
  platform/default/thread.cpp:14:5: error: ‘pthread_getname_np’ was not declared in this scope; did you mean ‘pthread_setname_np’?
     14 |     pthread_getname_np(pthread_self(), name, sizeof(name));
        |     ^~~~~~~~~~~~~~~~~~
        |     pthread_setname_np

    [1] e64dd67f43/srcpkgs/qt5/patches/0014-musl-set_thread_name_np.patch

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: add uClibc]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4c8ec58504)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 17:22:00 +02:00
Fabrice Fontaine
5b4b4d16e1 package/libkrb5: fix CVE-2021-37750
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before
1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in
kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b9646b18bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-27 21:31:41 +02:00
Fabrice Fontaine
2d9422b7c3 package/apache: security bump to version 2.4.49
Fix CVE-2021-33193: A crafted method sent through HTTP/2 will bypass
validation and be forwarded by mod_proxy, which can lead to request
splitting or cache poisoning. This issue affects Apache HTTP Server
2.4.17 to 2.4.48.

https://github.com/apache/httpd/blob/2.4.49/CHANGES

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 868367222b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-27 21:27:47 +02:00
Yann E. MORIN
dc201ed323 package/kodi: fix selection of dependencies
Commit 148e695e37 (package/kodi: bump version to 19.0-Matrix) extended
the set of required libraries for various "platform" backends, by
selecting those libraries from the blind options. For example, we have:

    config BR2_PACKAGE_KODI_PLATFORM_SUPPORTS_GBM
        bool
        default y
        depends on [...]
        select BR2_PACKAGE_LIBINPUT
        [...]

However, that option is true as soon as the requirements are met (the
depends on), even when Kodi itself is not enabled.

This means that extra libraries are pulled in to the build, even when
not required.

We fix that by moving the actual selects to the main symbol, along with
the proper conditions. This means that we have two lines that select
libxbcommon, under two different conditions; we could make that a single
select, but the codition would need to be on two lines anyway, so meh...

This is not an ideal solution, because it is a bit ugly, but:
 1) adding three new blind options just for the select is kinda extreme
    and superfluous;
 2) our Kodi packaging is already a bit ugly anyway.

Fixes: #14206

Reported-by: Thomas Ruschival <t.ruschival@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
(cherry picked from commit b80c488d04)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-27 21:24:48 +02:00
Peter Korsgaard
21a5bc35f1 package/libressl: bump to version 3.2.6
Bugfix release, fixing a crash issue:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.6-relnotes.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-27 19:50:10 +02:00
Peter Korsgaard
3466797ced Update for 2021.05.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-15 16:26:50 +02:00
Fabrice Fontaine
2a411da1a6 package/libexif: fix build with gcc 4.8
Fix the following build failure with gcc 4.8 raised since bump to
version 0.6.23 in commit e2f8050976:

exif-gps-ifd.c: In function 'exif_get_gps_tag_info':
exif-gps-ifd.c:62:3: error: 'for' loop initial declarations are only allowed in C99 mode
   for (int i = 0; i < sizeof(exif_gps_ifd_tags) / sizeof(ExifGPSIfdTagInfo); ++i) {
   ^
exif-gps-ifd.c:62:3: note: use option -std=c99 or -std=gnu99 to compile your code

Fixes:
 - http://autobuild.buildroot.org/results/7dd222e06d1e6611449fb8fe7516817c9ad43d65

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 039de9a291)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-15 11:51:53 +02:00
Fabrice Fontaine
9744b1f030 package/python-pillow: security bump to version 8.3.2
- Fix CVE-2021-23437 Raise ValueError if color specifier is too long
- Fix 6-byte OOB read in FliDecode
- Update indentation in hash file (two spaces)

https://github.com/python-pillow/Pillow/releases/tag/8.3.2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a7919e68a6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 15:00:09 +02:00
Angelo Compagnucci
26b12f53a9 package/python-pillow: bump to version 8.3.1
Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d6ac118637)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 15:00:01 +02:00
Fabrice Fontaine
ab3fcf68d2 package/gd: security bump to version 2.3.3
- Fix CVE-2021-40145: ** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD
  Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE:
  the vendor's position is "The GD2 image format is a proprietary image
  format of libgd. It has to be regarded as being obsolete, and should
  only be used for development and testing purposes."
- Drop patch (already in version)
- Update hash of COPYING (duplicate merged and title added with
  82d2609505
  6013c7bcf6)

https://github.com/libgd/libgd/releases/tag/gd-2.3.3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a052ecb5b8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:56:12 +02:00
Fabrice Fontaine
da9ed19819 package/libxcrypt: security bump to version 4.4.25
- Fix several issues found by Covscan in the testsuite. These include:
  - CWE-170: String not null terminated (STRING_NULL)
  - CWE-188: Reliance on integer endianness (INCOMPATIBLE_CAST)
  - CWE-190: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
  - CWE-569: Wrong sizeof argument (SIZEOF_MISMATCH)
  - CWE-573: Missing varargs init or cleanup (VARARGS)
  - CWE-687: Argument cannot be negative (NEGATIVE_RETURNS)
- Update hash of LICENSING due to files being updated with:
  44e9eb57b4
  578271c377

https://github.com/besser82/libxcrypt/blob/v4.4.25/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a071bec0a0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:28:16 +02:00
Fabrice Fontaine
de3e19abb3 package/vim: security bump to version 8.2.3432
- Fix CVE-2021-3770: vim is vulnerable to Heap-based Buffer Overflow
- Update hash of README.txt due to changes not related to license:
  f2a44e5c48
  89a9c159f2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c3198cd414)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:14:18 +02:00
Fabrice Fontaine
8addd366a3 package/libssh: security bump to version 0.9.6
Fix CVE-2021-3634: A flaw has been found in libssh in versions prior to
0.9.6. The SSH protocol keeps track of two shared secrets during the
lifetime of the session. One of them is called secret_hash and the other
session_id. Initially, both of them are the same, but after key
re-exchange, previous session_id is kept and used as an input to new
secret_hash. Historically, both of these buffers had shared length
variable, which worked as long as these buffers were same. But the key
re-exchange operation can also change the key exchange method, which can
be based on hash of different size, eventually creating "secret_hash" of
different size than the session_id has. This becomes an issue when the
session_id memory is zeroed or when it is used again during second key
re-exchange.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 88cb451446)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:13:41 +02:00
Fabrice Fontaine
2b33ea382f package/libexif: security bump to version 0.6.23
- Drop patches (already in version)
- Fix some more denial of service (compute time or stack exhaustion)
  counter-measures added that avoid minutes of decoding time with
  malformed files found by OSS-Fuzz

https://github.com/libexif/libexif/releases/tag/v0.6.23

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e2f8050976)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:12:09 +02:00
Michael Nosthoff
7aed9ce6c5 package/protobuf: update github url
protobuf moved from the google org to protocolbuffers in 2018.
There is a redirect but we should use the official url.

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 107103ef91)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:30:41 +02:00
Fabrice Fontaine
02b5cf1a97 package/uhd: needs boost math
Lots of uhd components (e.g. examples, USRP1, USRP2) needs boost math
(i.e. https://github.com/EttusResearch/uhd/search?q=boost%3A%3Amath)
resulting in build failures since commit
c577eac16e

Fixes:
 - http://autobuild.buildroot.org/results/70f6db101c9d35cdd88da602a863ddf35706fd7d
 - http://autobuild.buildroot.org/results/5b28591b4c4a7ae4cc6d428c42d96db138ef3ee7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d5eb075d55)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:24:19 +02:00
Peter Korsgaard
b6931079d3 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 10, 13, 14}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a7864c4ff4)
[Peter: drop 5.13.x / 5.14.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:19:13 +02:00
Fabrice Fontaine
84b4f533ce package/openjdk: needs host gcc >= 4.9
openjdk needs host gcc >= 4.9 since bump to version 16.0.1+9 in commit
057e27029c and
2a8f92e7e7:

configure: Using gcc BuildC compiler version 4.8.5 [cc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-44)]
configure: Using gcc BuildC++ compiler version 4.8.5 [g++ (GCC) 4.8.5 20150623 (Red Hat 4.8.5-44)]
configure: Using gcc build linker version 2.27 [GNU ld version 2.27-44.base.el7]

[...]

g++: error: unrecognized command line option '-std=c++14'

Add a dependency on host gcc >= 4.9 for the OpenJDK 16 version only, so
that users can still use OpenJDK 11 on older distributions.

Fixes:
 - http://autobuild.buildroot.org/results/7072308d148ccb8237180729551df65c87a76f11

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: limit the dependency to OpenJDK 16]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0e5a1f7757)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 20:06:10 +02:00
James Knight
963af0c56e utils/getdeveloperlib.py: force forward-slash for pattern matching
Force relative file path resolution of DEVELOPERS file entries to use
forward-slash separators since pattern matching assumes forward slashes.
This is to help permit uses invoking `get-developers` on Platforms where
`os.sep` may not be a forward slash.

Signed-off-by: James Knight <james.d.knight@live.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit eb75d71b80)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 19:41:36 +02:00
Fabrice Fontaine
d79570c40d package/uboot-tools: fix MKIMAGE_ARCH handling
Fix MKIMAGE_ARCH handling to avoid the following build failure:

/home/buildroot/autobuild/instance-0/output-1/build/host-uboot-tools-2021.07/tools/mkimage -C none -A openrisc -T script -d /home/buildroot/autobuild/instance-0/output-1/boot_script.txt /home/buildroot/autobuild/instance-0/output-1/build/host-uboot-tools-2021.07/tools/boot.scr

Invalid architecture, supported are:
	alpha            Alpha
	arc              ARC
	arm              ARM
	arm64            AArch64
	avr32            AVR32
	blackfin         Blackfin
	ia64             IA64
	invalid          Invalid ARCH
	m68k             M68K
	microblaze       MicroBlaze
	mips             MIPS
	mips64           MIPS 64 Bit
	nds32            NDS32
	nios2            NIOS II
	or1k             OpenRISC 1000
	powerpc          PowerPC
	riscv            RISC-V
	s390             IBM S390
	sandbox          Sandbox
	sh               SuperH
	sparc            SPARC
	sparc64          SPARC 64 Bit
	x86              Intel x86
	x86_64           AMD x86_64
	xtensa           Xtensa

Strangely enough, we only have autobuilder failures since July 2021 even
as or1k has been used since the addition of openriscv support in 2012:
3ddcaccda3

For x86_64, we incorrectly mangle it to x86.

Finally, the comment about mips64 is wrong: mips64 *is* a valid
archtecture, and we anyway had no code to tweak that case.

Fixes:
 - http://autobuild.buildroot.org/results/c3f0f2a3fb87d74bfdaccf9b94c66f0b5bae7520

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: extend commit log for mips64 and x86_64]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5e8804d4e4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 19:38:43 +02:00
Fabrice Fontaine
153343b97c package/zip: fix musl static build
Fix the following static build failure on musl which is raised because
the "Check for directory libraries" in configure wrongly adds -DNO_DIR
when no directory library is needed:

/tmp/instance-0/output-1/host/bin/arm-buildroot-linux-musleabihf-gcc -c -D_FILE_OFFSET_BITS=64 -O2 -g0 -static -I. -DUNIX -DUIDGID_NOT_16BIT -DBZIP2_SUPPORT -DLARGE_FILE_SUPPORT -DUNICODE_SUPPORT -DNO_MKTIME -DNO_DIR -DHAVE_DIRENT_H -DHAVE_TERMIOS_H unix/unix.c
unix/unix.c:70:14: error: conflicting types for 'DIR'
   70 | typedef FILE DIR;
      |              ^~~

Fixes:
 - http://autobuild.buildroot.org/results/83a6e0c8c4ad026cb0261246e3b1a80d754454bd

Patch not sent upstream since upstream is dead.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ea0a4c610d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 19:28:23 +02:00