Commit Graph

57040 Commits

Author SHA1 Message Date
Peter Seiderer
61914d80fa package/gst-omx: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 598c852077)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:03:41 +02:00
Peter Seiderer
855f0602bc package/gstreamer1-editing-services: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fc3e9ba25a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:03:33 +02:00
Peter Seiderer
3692d5ff3f package/gst1-rtsp-server: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 931c6e2a70)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:03:26 +02:00
Peter Seiderer
a5940aafdd package/gst1-vaapi: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f8e9c7470b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:03:18 +02:00
Peter Seiderer
4604a89c90 package/gst1-libav: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e2bfdc4f18)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:03:05 +02:00
Peter Seiderer
b63758a3b5 package/gst1-devtools: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 40e02dccd5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:02:57 +02:00
Peter Seiderer
e1896b443c package/gst1-plugins-ugly: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6e6d6185dc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:02:51 +02:00
Peter Seiderer
e17cd3121a package/gst1-plugins-bad: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 50cc9ab544)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:02:43 +02:00
Peter Seiderer
ddf0dc232f package/gst1-plugins-good: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 374b8f5845)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:02:38 +02:00
Peter Seiderer
b7708dcc64 package/gst1-plugins-base: bump version to 1.18.5
- delete 0002-gstgl-Fix-build-when-Meson-0.58.0rc1.patch
  (from upstream [1])

[1] 90903917a8

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2f707103c3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:02:33 +02:00
Peter Seiderer
c30e276063 package/gstreamer1: bump version to 1.18.5
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 97fddaa3df)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 17:02:28 +02:00
Petr Vorel
9d772f2c49 package/bind: security bump version to 9.11.35
Named failed to check the opcode of responses when performing zone
refreshes, stub zone updates, and UPDATE forwarding.  This could lead to an
assertion failure under certain conditions and has been addressed by
rejecting responses whose opcode does not match the expected value. [GL #2762]

For details, see the release notes:
https://downloads.isc.org/isc/bind9/9.11.35/RELEASE-NOTES-bind-9.11.35.html

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6977ee6e0e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:45:36 +02:00
Fabrice Fontaine
7786d71922 package/lxc: bump to version 4.0.10
https://discuss.linuxcontainers.org/t/lxc-4-0-10-has-been-released/11618
https://discuss.linuxcontainers.org/t/lxc-4-0-9-lts-has-been-released/10999

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9a48be36d5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 16:41:30 +02:00
Fabrice Fontaine
df9336d389 package/runc: bump to version 1.0.2
https://github.com/opencontainers/runc/releases/tag/v1.0.2
https://github.com/opencontainers/runc/releases/tag/v1.0.1
https://github.com/opencontainers/runc/releases/tag/v1.0.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 21704ad112)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-29 11:59:23 +02:00
Fabrice Fontaine
4ae616eaac package/containerd: security bump to version 1.4.9
- Fix CVE-2021-32760:
  https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w
- Update indentation in hash file (two spaces)

https://github.com/containerd/containerd/releases/tag/v1.4.9
https://github.com/containerd/containerd/releases/tag/v1.4.8
https://github.com/containerd/containerd/releases/tag/v1.4.7
https://github.com/containerd/containerd/releases/tag/v1.4.6
https://github.com/containerd/containerd/releases/tag/v1.4.5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 90f175045a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 22:50:31 +02:00
Adam Duskett
6726e6b7cf package/openjdk{-bin}: security bump versions to 11.0.12+7 and 16.0.2+7
As the github repository has changed from github.com/AdoptOpenJDK/ to
github.com/adoptium, both versions are updated in the same patch.

Security fixes

    JD K-8256157: Improve bytecode assembly
    JDK-8256491: Better HTTP transport
    JDK-8258432, CVE-2021-2341: Improve file transfers
    JDK-8260453: Improve Font Bounding
    JDK-8260960: Signs of jarsigner signing
    JDK-8260967, CVE-2021-2369: Better jar file validation
    JDK-8262380: Enhance XML processing passes
    JDK-8262403: Enhanced data transfer
    JDK-8262410: Enhanced rules for zones
    JDK-8262477: Enhance String Conclusions
    JDK-8262967: Improve Zip file support
    JDK-8264066, CVE-2021-2388: Enhance compiler validation
    JDK-8264079: Improve abstractions
    JDK-8264460: Improve NTLM support

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit baaf71b9bb)
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 17:48:14 +02:00
Fabrice Fontaine
d6156fc8a5 package/openjdk: needs host gcc >= 4.9
openjdk needs host gcc >= 4.9 since bump to version 16.0.1+9 in commit
057e27029c and
2a8f92e7e7:

configure: Using gcc BuildC compiler version 4.8.5 [cc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-44)]
configure: Using gcc BuildC++ compiler version 4.8.5 [g++ (GCC) 4.8.5 20150623 (Red Hat 4.8.5-44)]
configure: Using gcc build linker version 2.27 [GNU ld version 2.27-44.base.el7]

[...]

g++: error: unrecognized command line option '-std=c++14'

Add a dependency on host gcc >= 4.9 for the OpenJDK 16 version only, so
that users can still use OpenJDK 11 on older distributions.

Fixes:
 - http://autobuild.buildroot.org/results/7072308d148ccb8237180729551df65c87a76f11

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: limit the dependency to OpenJDK 16]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0e5a1f7757)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 17:47:49 +02:00
Yann E. MORIN
a2c6fcc500 package/openjdk: fully switch to Github, commonalise version scheme
Commit 057e27029c (package/openjdk{, -bin}: bump latest to version
16.0.1+9) partially switched over to using the Github repository (which
is the new official publication channel for OpenJDK).

However, only the JDK16 was switched, because of concerns about a change
in the hash of Github-generated archives for the JDK11, due to a missing
Hg-related file on Github.

But as Arnout put it:
    There's a trivial workaround: drop OPENJDK_SOURCE = .... That way,
    the tarball name becomes openjdk-... instead of jdk-... and it's a
    different file.

There is indeed no good reason to force a non-default filename for the
archive, so we do drop it.

As a consequence, we can fully switch over to Github for openjdk, using
the new version scheme. Of course the hash changes, but it is a new
file, so that's OK.

The filename for the JDK16 changes, but the content does not change, so
the hash does not change.

For consistency, the version scheme is also applied to openjdk-bin. Even
though it was already using Github, using that new version scheme also
allows to commonalise the variables too. The archives are the exact
same: no change in filename or content, so no hash to fixup.

Reported-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
cc: Adam Duskett <aduskett@gmail.com>
Tested-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 750fb4ec3e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 17:46:12 +02:00
Adam Duskett
aca8179978 package/openjdk{, -bin}: bump latest to version 16.0.1+9
When introducing OpenJDK to buildroot, the OpenJDK project did not put
releases on their GitHub page. Since then, the OpenJDK developers have
not only added OpenJDK releases to Github, they are starting to phase
out adding releases to their public-facing mercurial repository.

Compare the following URLs:
https://wiki.openjdk.java.net/display/JDKUpdates/JDK+14u
https://wiki.openjdk.java.net/display/JDKUpdates/JDK+15u
https://wiki.openjdk.java.net/display/JDKUpdates/JDK+16u

With JDK14, only the mercurial repository is listed. With OpenJDK15,
both the GitHub and mercurial repository are listed. Finally, with
OpenJDK16, only the GitHub repository is listed.

For consistency's sake, and for the version bump of JDK latest from 14
to 16 do the following:

  - Change the repository for OpenJDK14 to point to the official GitHub
    repository,

  - In order to simplify and reuse the GitHub URL, modify the
    OPENJDK_VERSION_MAJOR and OPENJDK_VERSION_MINOR definitions to only
    include a single number for the MAJOR definition.

  - Change openjdk-bin.mk to also use the same format as the openjdk.mk
    file

Unfortunately, we can't yet do the switch for OpenJDK11: the Github
repository is missing a Mercurial-related file, so that the archive
for OpenJDK11 11.0.11+9 would change from the one we already have on
s.b.o and that people would alreay have locally, and we'd have a hash
mismatch, either on master, or on all pur previous relases. OpenJDK11
just got a new release mere hours ago (as of this writing), but it
hasn't yet trickled down to AdoptOpenJDK/openjdk11-binaries, so we
can't do the bump just yet...

Add a note to the OpenJDK11 case, to prepare the migration to Github
with the next version bump.

Finally, remove upstreamed patch 0001-fix-gcc-10-support.patch as it's
no longer needed.

Signed-off-by: Adam Duskett <aduskett@gmail.com>
[yann.morin.1998@free.fr:
  - meld the github switch and 14->16 bump together
  - drop the github switch for 11 9because hash mismatch)
  - expand commit log accordingly
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 057e27029c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 17:37:19 +02:00
Peter Seiderer
0d7153ee3e package/qt5location: fix musl compile (pthread_getname_np)
- pthread_getname_np not available with musl libc, add patch to disable
  usage for musl (patch inspired/ported from [1])

Fixes:

  - http://autobuild.buildroot.net/results/ed372a4a8e50d9e20be589eeda40c92888d709bc

  platform/default/thread.cpp: In function ‘std::string mbgl::platform::getCurrentThreadName()’:
  platform/default/thread.cpp:14:5: error: ‘pthread_getname_np’ was not declared in this scope; did you mean ‘pthread_setname_np’?
     14 |     pthread_getname_np(pthread_self(), name, sizeof(name));
        |     ^~~~~~~~~~~~~~~~~~
        |     pthread_setname_np

    [1] e64dd67f43/srcpkgs/qt5/patches/0014-musl-set_thread_name_np.patch

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: add uClibc]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4c8ec58504)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-28 17:22:13 +02:00
Fabrice Fontaine
30c218fec8 package/libkrb5: fix CVE-2021-37750
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before
1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in
kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b9646b18bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-27 21:32:02 +02:00
Fabrice Fontaine
3cee0ac570 package/apache: security bump to version 2.4.49
Fix CVE-2021-33193: A crafted method sent through HTTP/2 will bypass
validation and be forwarded by mod_proxy, which can lead to request
splitting or cache poisoning. This issue affects Apache HTTP Server
2.4.17 to 2.4.48.

https://github.com/apache/httpd/blob/2.4.49/CHANGES

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 868367222b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-27 21:27:52 +02:00
Peter Korsgaard
bdc7e494a1 package/libressl: bump to version 3.2.6
Bugfix release, fixing a crash issue:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.6-relnotes.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-27 19:49:54 +02:00
Peter Korsgaard
767a2da72f Update for 2021.02.5
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-15 17:20:06 +02:00
Fabrice Fontaine
9235281bcb package/libexif: fix build with gcc 4.8
Fix the following build failure with gcc 4.8 raised since bump to
version 0.6.23 in commit e2f8050976:

exif-gps-ifd.c: In function 'exif_get_gps_tag_info':
exif-gps-ifd.c:62:3: error: 'for' loop initial declarations are only allowed in C99 mode
   for (int i = 0; i < sizeof(exif_gps_ifd_tags) / sizeof(ExifGPSIfdTagInfo); ++i) {
   ^
exif-gps-ifd.c:62:3: note: use option -std=c99 or -std=gnu99 to compile your code

Fixes:
 - http://autobuild.buildroot.org/results/7dd222e06d1e6611449fb8fe7516817c9ad43d65

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 039de9a291)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-15 11:51:57 +02:00
Fabrice Fontaine
9eb977f002 package/python-pillow: security bump to version 8.3.2
- Fix CVE-2021-23437 Raise ValueError if color specifier is too long
- Fix 6-byte OOB read in FliDecode
- Update indentation in hash file (two spaces)

https://github.com/python-pillow/Pillow/releases/tag/8.3.2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a7919e68a6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:59:38 +02:00
Angelo Compagnucci
18b0456713 package/python-pillow: bump to version 8.3.1
Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d6ac118637)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:59:21 +02:00
Fabrice Fontaine
c2f2862db0 package/gd: security bump to version 2.3.3
- Fix CVE-2021-40145: ** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD
  Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE:
  the vendor's position is "The GD2 image format is a proprietary image
  format of libgd. It has to be regarded as being obsolete, and should
  only be used for development and testing purposes."
- Drop patch (already in version)
- Update hash of COPYING (duplicate merged and title added with
  82d2609505
  6013c7bcf6)

https://github.com/libgd/libgd/releases/tag/gd-2.3.3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a052ecb5b8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:56:37 +02:00
Francois Perrad
599e2b13e0 package/gd: bump to version 2.3.2
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6945b55823)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:56:34 +02:00
Francois Perrad
885eec4448 package/gd: bump to version 2.3.1
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 970b2ca3cc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:56:27 +02:00
Fabrice Fontaine
9481e9f8af package/vim: security bump to version 8.2.3432
- Fix CVE-2021-3770: vim is vulnerable to Heap-based Buffer Overflow
- Update hash of README.txt due to changes not related to license:
  f2a44e5c48
  89a9c159f2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c3198cd414)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:14:13 +02:00
Fabrice Fontaine
a13cff2d06 package/libssh: security bump to version 0.9.6
Fix CVE-2021-3634: A flaw has been found in libssh in versions prior to
0.9.6. The SSH protocol keeps track of two shared secrets during the
lifetime of the session. One of them is called secret_hash and the other
session_id. Initially, both of them are the same, but after key
re-exchange, previous session_id is kept and used as an input to new
secret_hash. Historically, both of these buffers had shared length
variable, which worked as long as these buffers were same. But the key
re-exchange operation can also change the key exchange method, which can
be based on hash of different size, eventually creating "secret_hash" of
different size than the session_id has. This becomes an issue when the
session_id memory is zeroed or when it is used again during second key
re-exchange.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 88cb451446)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:13:36 +02:00
Fabrice Fontaine
b3d3d1d936 package/libexif: security bump to version 0.6.23
- Drop patches (already in version)
- Fix some more denial of service (compute time or stack exhaustion)
  counter-measures added that avoid minutes of decoding time with
  malformed files found by OSS-Fuzz

https://github.com/libexif/libexif/releases/tag/v0.6.23

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e2f8050976)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-14 14:12:18 +02:00
Christian Stewart
06d731046b package/go: security bump version to 1.16.8
go1.16.8 (released 2021-09-09) includes a security fix to the archive/zip
package, as well as bug fixes to the archive/zip, go/internal/gccgoimporter,
html/template, net/http, and runtime/pprof packages.

https://golang.org/doc/devel/release#go1.16.minor

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1279d2b132)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:55:01 +02:00
Christian Stewart
299ec29591 package/go: security bump to version 1.16.7
go1.16.7 (released 2021-08-05) includes a security fix to the
net/http/httputil package, as well as bug fixes to the compiler, the
linker, the runtime, the go command, and the net/http package.

https://golang.org/doc/devel/release#go1.16

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 825eec010c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:54:54 +02:00
Christian Stewart
035fda19d3 package/go: security bump version to 1.16.6
These minor releases include a security fix according to the new security policy (#44918).

crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters.
net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker
in a privileged network position without access to the server certificate's private key, as long as a trusted
ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with
Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher
suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.

This is CVE-2021-34558.

View the release notes for more information:

https://golang.org/doc/devel/release.html#go1.16.minor

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 806b26950d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:54:48 +02:00
Peter Korsgaard
128adb7a54 package/go: security bump to version 1.16.5
Fixes the following security issues:

- CVE-2021-33195: The LookupCNAME, LookupSRV, LookupMX, LookupNS, and
  LookupAddr functions in net, and their respective methods on the Resolver
  type may return arbitrary values retrieved from DNS which do not follow
  the established RFC 1035 rules for domain names.  If these names are used
  without further sanitization, for instance unsafely included in HTML, they
  may allow for injection of unexpected content.  Note that LookupTXT may
  still return arbitrary values that could require sanitization before
  further use

- CVE-2021-33196: The NewReader and OpenReader functions in archive/zip can
  cause a panic or an unrecoverable fatal error when reading an archive that
  claims to contain a large number of files, regardless of its actual size

- CVE-2021-33197: ReverseProxy in net/http/httputil could be made to forward
  certain hop-by-hop headers, including Connection.  In case the target of
  the ReverseProxy was itself a reverse proxy, this would let an attacker
  drop arbitrary headers, including those set by the ReverseProxy.Director

- CVE-2021-33198: The SetString and UnmarshalText methods of math/big.Rat
  may cause a panic or an unrecoverable fatal error if passed inputs with
  very large exponents

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0c60007419)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:54:36 +02:00
Peter Korsgaard
f52be858f6 package/go: security bump to version 1.16.4
Fixes the following security issues:

- CVE-2021-31525: ReadRequest and ReadResponse in net/http can hit an
  unrecoverable panic when reading a very large header (over 7MB on 64-bit
  architectures, or over 4MB on 32-bit ones).  Transport and Client are
  vulnerable and the program can be made to crash by a malicious server.
  Server is not vulnerable by default, but can be if the default max header
  of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value,
  in which case the program can be made to crash by a malicious client.

  https://github.com/golang/go/issues/45710

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1cfc01a008)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:54:30 +02:00
Christian Stewart
c136a012ac package/go: bump version to 1.16.3
go1.16.3 (released 2021/04/01) includes fixes to the compiler, linker, runtime,
the go command, and the testing and time packages.

https://golang.org/doc/go1.16

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 16123616d3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:54:07 +02:00
Christian Stewart
f14662bad7 package/go: security bump to 1.16.2
go1.16.1 (released 2021/03/10) includes security fixes to the archive/zip and
encoding/xml packages.

go1.16.2 (released 2021/03/11) includes fixes to cgo, the compiler, linker, the
go command, and the syscall and time packages.

https://golang.org/doc/devel/release.html#go1.16

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9b36b4aa28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:53:57 +02:00
Christian Stewart
bff6255da2 package/go: bump version to 1.16
Release notes: https://golang.org/doc/go1.16

The latest Go release, version 1.16, arrives six months after Go 1.15. Most of
its changes are in the implementation of the toolchain, runtime, and libraries.

The linker changes in 1.16 extend the 1.15 improvements to all supported
architecture/OS combinations (the 1.15 performance improvements were primarily
focused on ELF-based OSes and amd64 architectures). For a representative set of
large Go programs, linking is 20-25% faster than 1.15 and requires 5-15% less
memory on average for linux/amd64, with larger improvements for other
architectures and OSes. Most binaries are also smaller as a result of more
aggressive symbol pruning.

According to the release notes, Go 1.16 drops support for x87 mode
compilation (GO386=387).  Support for non-SSE2 processors is now available
using soft float mode.  Buildroot will automatically set GO386=softfloat on
non-SSE2 processors.

Signed-off-by: Christian Stewart <christian@paral.in>

v1 -> v2:

 - added 386=softfloat handling re: Peter's review

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9c035502bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:53:41 +02:00
Julien Olivain
a995385a61 package/fluidsynth: security bump to version 2.1.9
Fixes the CVE-2021-21417 security issue:
https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9
https://github.com/FluidSynth/fluidsynth/issues/808

See changelog since v2.1.5:
- https://github.com/FluidSynth/fluidsynth/releases/tag/v2.1.6
- https://github.com/FluidSynth/fluidsynth/releases/tag/v2.1.7
- https://github.com/FluidSynth/fluidsynth/releases/tag/v2.1.8
- https://github.com/FluidSynth/fluidsynth/releases/tag/v2.1.9

./utils/test-pkg --package fluidsynth
6 builds, 2 skipped, 0 build failed, 0 legal-info failed

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:32:44 +02:00
Michael Nosthoff
cf41704cd8 package/protobuf: update github url
protobuf moved from the google org to protocolbuffers in 2018.
There is a redirect but we should use the official url.

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 107103ef91)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:29:19 +02:00
Fabrice Fontaine
71a0539705 package/uhd: needs boost math
Lots of uhd components (e.g. examples, USRP1, USRP2) needs boost math
(i.e. https://github.com/EttusResearch/uhd/search?q=boost%3A%3Amath)
resulting in build failures since commit
c577eac16e

Fixes:
 - http://autobuild.buildroot.org/results/70f6db101c9d35cdd88da602a863ddf35706fd7d
 - http://autobuild.buildroot.org/results/5b28591b4c4a7ae4cc6d428c42d96db138ef3ee7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d5eb075d55)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:24:30 +02:00
Peter Korsgaard
74fa4f2c52 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 10, 13, 14}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a7864c4ff4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 22:20:44 +02:00
James Knight
737001e68b utils/getdeveloperlib.py: force forward-slash for pattern matching
Force relative file path resolution of DEVELOPERS file entries to use
forward-slash separators since pattern matching assumes forward slashes.
This is to help permit uses invoking `get-developers` on Platforms where
`os.sep` may not be a forward slash.

Signed-off-by: James Knight <james.d.knight@live.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit eb75d71b80)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 19:41:19 +02:00
Fabrice Fontaine
c776e800b5 package/uboot-tools: fix MKIMAGE_ARCH handling
Fix MKIMAGE_ARCH handling to avoid the following build failure:

/home/buildroot/autobuild/instance-0/output-1/build/host-uboot-tools-2021.07/tools/mkimage -C none -A openrisc -T script -d /home/buildroot/autobuild/instance-0/output-1/boot_script.txt /home/buildroot/autobuild/instance-0/output-1/build/host-uboot-tools-2021.07/tools/boot.scr

Invalid architecture, supported are:
	alpha            Alpha
	arc              ARC
	arm              ARM
	arm64            AArch64
	avr32            AVR32
	blackfin         Blackfin
	ia64             IA64
	invalid          Invalid ARCH
	m68k             M68K
	microblaze       MicroBlaze
	mips             MIPS
	mips64           MIPS 64 Bit
	nds32            NDS32
	nios2            NIOS II
	or1k             OpenRISC 1000
	powerpc          PowerPC
	riscv            RISC-V
	s390             IBM S390
	sandbox          Sandbox
	sh               SuperH
	sparc            SPARC
	sparc64          SPARC 64 Bit
	x86              Intel x86
	x86_64           AMD x86_64
	xtensa           Xtensa

Strangely enough, we only have autobuilder failures since July 2021 even
as or1k has been used since the addition of openriscv support in 2012:
3ddcaccda3

For x86_64, we incorrectly mangle it to x86.

Finally, the comment about mips64 is wrong: mips64 *is* a valid
archtecture, and we anyway had no code to tweak that case.

Fixes:
 - http://autobuild.buildroot.org/results/c3f0f2a3fb87d74bfdaccf9b94c66f0b5bae7520

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: extend commit log for mips64 and x86_64]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5e8804d4e4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 19:38:58 +02:00
Fabrice Fontaine
f504192788 package/zip: fix musl static build
Fix the following static build failure on musl which is raised because
the "Check for directory libraries" in configure wrongly adds -DNO_DIR
when no directory library is needed:

/tmp/instance-0/output-1/host/bin/arm-buildroot-linux-musleabihf-gcc -c -D_FILE_OFFSET_BITS=64 -O2 -g0 -static -I. -DUNIX -DUIDGID_NOT_16BIT -DBZIP2_SUPPORT -DLARGE_FILE_SUPPORT -DUNICODE_SUPPORT -DNO_MKTIME -DNO_DIR -DHAVE_DIRENT_H -DHAVE_TERMIOS_H unix/unix.c
unix/unix.c:70:14: error: conflicting types for 'DIR'
   70 | typedef FILE DIR;
      |              ^~~

Fixes:
 - http://autobuild.buildroot.org/results/83a6e0c8c4ad026cb0261246e3b1a80d754454bd

Patch not sent upstream since upstream is dead.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ea0a4c610d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 19:28:32 +02:00
Krzysztof Kanas
d464f8b313 package/environment-setup/environment-setup: add zsh
environment-setup uses BASH_SOURCE which is bash specific. For other
shells, this variable is empty, leading to an error message and empty
SDK_PATH.
Zsh Uses $0. Unfortunately POSIX is not specifying how exactly $0
should behave when in sourced (or using special dot utility). So other
shell support have to be implemented in different manner.

Signed-off-by: Krzysztof Kanas <kkanas@fastmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 65cee90cc3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 15:37:30 +02:00
Bernd Kuhls
053378a913 package/mc: security bump version to 4.8.27
Removed patch which was backported from upstream and is now included in
this release.

Changelog: https://midnight-commander.org/wiki/NEWS-4.8.27

Fixes CVE-2021-36370:
https://mail.gnome.org/archives/mc/2021-August/msg00010.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit f37cc65fa6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-13 15:35:22 +02:00