Commit Graph

72599 Commits

Author SHA1 Message Date
Peter Korsgaard
8a87115a8f package/gst1-plugins-ugly: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a0c1f2383649e810459482f6614214122adcd78b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:29 +01:00
Peter Korsgaard
c595b5b828 package/gst1-plugins-bad: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1fa7c453e4f1dd099b6818ede10a4404b572424f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:28 +01:00
Peter Korsgaard
af9f7bdd7c package/gst1-plugins-good: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84f8e7c18bfdcbab26b4fd52d5696992ce6d0bbe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:27 +01:00
Peter Korsgaard
1bc589c515 package/gst1-plugins-base: security bump to version 1.22.12
Fixes the following security issue:

CVE-2024-4453: Heap-based buffer overflow in the EXIF image tag parser when
handling certain malformed streams before GStreamer 1.24.3 or 1.22.12

https://gstreamer.freedesktop.org/security/sa-2024-0002.html

For more details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 197cd0de3b02fc66e35632644fc8437ad4464fe9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:27 +01:00
Peter Korsgaard
6f9a2c8083 package/gstreamer1: bump version to 1.22.12
For various bugfixes. For details, see the release notes:

https://gstreamer.freedesktop.org/releases/1.22/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 395dcfbb1e5c46870495b75e270613d60f1616e1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 14:19:26 +01:00
Brandon Maier
0455bcc804 package/gnutls: fix autobuild error from 3.8.8 update
Fixes: http://autobuild.buildroot.net/results/317/3178fca15cbb2520336b0678a16a5be5a51a8702//
Upstream bug report: https://gitlab.com/gnutls/gnutls/-/issues/1604

Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit ca3cf2bea272bb0e0833c7fd2ec8f0fa28387692)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 13:24:16 +01:00
Thomas Bonnefille
e09b44b36a package/gdb: add hash of licence files
Adds sha256 hash of the license files for GDB.

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b0207c1f15c12011782e46233effa61f5acbfcad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 12:30:19 +01:00
Thomas Bonnefille
be577adfbc package/libsha1: Fix gcc14 compilation in libsha1
GCC14 removed the implicit int support.
This commit adds a patch to libsha1 to fix an implicit int declaration
as recommended.

Link: https://gcc.gnu.org/gcc-14/porting_to.html

Fixes:
    http://autobuild.buildroot.net/results/87dc9ba9690cbb6a82875734ce9cb8dbaf878e46/

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d427d27aeeaec4ff52e948fdc7d4be3ce0c9e2bb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 12:08:49 +01:00
Peter Korsgaard
8157e14da6 package/samba4: bump version to 4.19.9
Various bugfixes. For details, see the release notes:

https://www.samba.org/samba/history/samba-4.19.7.html
https://www.samba.org/samba/history/samba-4.19.8.html
https://www.samba.org/samba/history/samba-4.19.9.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-01-02 09:16:48 +01:00
Francois Perrad
da6c5f7434 package/gnupg2: bump to version 2.4.7
See release announce:
https://lists.gnupg.org/pipermail/gnupg-announce/2024q4/000487.html

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien: add release announce link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8e00663624a3c5f2603c54af62efecd6f25874ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 17:05:17 +01:00
Francois Perrad
1bbcfb3b5b package/gnupg2: bump to version 2.4.6
See release announce:
https://lists.gnupg.org/pipermail/gnupg-announce/2024q4/000486.html

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien: add release announce link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9b35b02fc5e24a6b8e7888380305e5171818a17)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 17:05:10 +01:00
Thomas Petazzoni
498406cfdb package/qt6base: properly ignore CVE-2023-32573
In commit
a9aa11544a ("package/qt6/qt6svg:
backport fix for CVE-2023-32573"), a fix for security issue
CVE-2023-32573 was added to qt6svg, with the appropriate
QT6SVG_IGNORE_CVES entry.

However, all CVEs against Qt are reported by the NVD on the qt:qt
vendor/product CPE. For example:

  https://nvd.nist.gov/vuln/detail/CVE-2023-32573

Therefore, the QT6SVG_IGNORE_CVES entry added has no effect, and
CVE-2023-32573 continues to be reported against our qt6base package.

The only reasonable option is to collect all such CVE ignore entries
for Qt modules into the qt6base package, which is the one that matches
with the qt:qt CPE identifier. This commit does just that, with an
hopefully appropriate comment in qt6base.mk that explains what's going
on.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 17:00:50 +01:00
Thomas Petazzoni
0980919b90 package/qt6/qt6base: fix QT6BASE_IGNORE_CVES for CVE-2023-51714
Commit 4009842cba ("package/qt6/qt6base:
backport fix for CVE-2023-51714") brought in a fix for CVE-2023-51714,
but got the QT6BASE_IGNORE_CVES update wrong, due to a copy/paste
error with the previous QT6BASE_IGNORE_CVES entry. Due to this
CVE-2023-51714 is still reported as affecting qt6base, while the
security fix is already there.

Fixes: 4009842cba ("package/qt6/qt6base: backport fix for CVE-2023-51714")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-31 16:59:59 +01:00
Peter Korsgaard
9749b6fbc9 package/netatalk: security bump to version 3.1.19
Fixes the following security issues:

CVE-2024-38439: Netatalk 3.2.0 has an off-by-one error and resultant
heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in
FPLoginExt in login in etc/uams/uams_pam.c.

https://github.com/advisories/GHSA-pcmr-ff73-xcj5

CVE-2024-38440: Netatalk 3.2.0 has an off-by-one error and resultant
heap-based buffer overflow because of incorrectly using FPLoginExt in
BN_bin2bn in etc/uams/uams_dhx_pam.c.

https://github.com/advisories/GHSA-52mm-rqxx-gfq6

CVE-2024-38441: Netatalk 3.2.0 has an off-by-one error and resultant
heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName
in afp_mapname in etc/afp/directory.c.

https://github.com/advisories/GHSA-j764-4v6h-pqp7

Release notes:
https://github.com/Netatalk/netatalk/releases/tag/netatalk-3-1-19

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9ab704699ea70b12478eac87313ec7d1ff902c7a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:58:54 +01:00
Peter Korsgaard
c7288d19b9 package/libsndfile: add upstream post-1.2.2 security fixes
Fixes the following security vulnerabilities:

CVE-2022-33065: Multiple signed integers overflow in function au_read_header
in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in
Libsndfile, allows an attacker to cause Denial of Service or other
unspecified impacts.

CVE-2024-50612: libsndfile through 1.2.2 has an ogg_vorbis.c
vorbis_analysis_wrote out-of-bounds read.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e675ffd964d65067bb115ee1e770ee44ba073958)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:57:47 +01:00
Peter Korsgaard
b570feeb64 package/apr: add upstream security fix for CVE-2023-49582
Fixes CVE-2023-49582: Lax permissions set by the Apache Portable Runtime
library on Unix platforms would allow local users read access to named
shared memory segments, potentially revealing sensitive application data.
This issue does not affect non-Unix platforms, or builds with
APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR
version 1.7.5, which fixes this issue.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a60c38b381bbb46094f57fe1c252df962fab6673)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:55:13 +01:00
Bernd Kuhls
e2143da2c1 {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 49a7cf412133daf3d477a000f4449e984da40e21)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-29 20:51:25 +01:00
Bernd Kuhls
6ad85c42fb package/wpewebkit: needs NPTL
Fixes build error

/home/buildroot/buildroot/output/build/wpewebkit-2.44.4/Source/WTF/wtf/StackBounds.cpp: In static member function 'static WTF::StackBounds WTF::StackBounds::newThreadStackBounds(WTF::PlatformThreadHandle)':
/home/buildroot/buildroot/output/build/wpewebkit-2.44.4/Source/WTF/wtf/StackBounds.cpp:117:5: error: 'pthread_getattr_np' was not declared in this scope; did you mean 'pthread_attr_t'?
  117 |     pthread_getattr_np(thread, &sattr);

using this defconfig (and libvpx bump to 1.15.0 reverted)

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WPEWEBKIT=y

A backport of this patch should be considered because the code is
present since 2011:
03f678fac7/Source/WTF/wtf/StackBounds.cpp (L117)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9f4a95e5c6e18413e913236f8e7d44cedecc2b2a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:30:21 +01:00
Bernd Kuhls
fd1c47e287 package/webkitgtk: needs NPTL
Fixes build error

/home/buildroot/buildroot/output/build/webkitgtk-2.44.2/Source/WTF/wtf/StackBounds.cpp: In static member function 'static WTF::StackBounds WTF::StackBounds::newThreadStackBounds(WTF::PlatformThreadHandle)':
/home/buildroot/buildroot/output/build/webkitgtk-2.44.2/Source/WTF/wtf/StackBounds.cpp:117:5: error: 'pthread_getattr_np' was not declared in this scope; did you mean 'pthread_attr_t'?
  117 |     pthread_getattr_np(thread, &sattr);

using this defconfig (and libvpx bump to 1.15.0 reverted)

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y

A backport of this patch should be considered because the code is
present since 2011:
03f678fac7/Source/WTF/wtf/StackBounds.cpp (L117)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 054e5c4d22e9e235d1818baa1333ca4abace50ea)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:29:46 +01:00
Bernd Kuhls
4426fd6b64 package/webkitgtk: multimedia support needs gst1-plugins-bad
Fixes build error

--   Package 'gstreamer-webrtc-1.0' not found
-- Found GStreamer: GSTREAMER_INCLUDE_DIRS;GSTREAMER_LIBRARIES;GSTREAMER_VERSION;GSTREAMER_BASE_INCLUDE_DIRS;GSTREAMER_BASE_LIBRARIES;GSTREAMER_APP_INCLUDE_DIRS;GSTREAMER_APP_LIBRARIES;GSTREAMER_PBUTILS_INCLUDE_DIRS;GSTREAMER_PBUTILS_LIBRARIES;GSTREAMER_VIDEO_INCLUDE_DIRS;GSTREAMER_VIDEO_LIBRARIES;GSTREAMER_MPEGTS_INCLUDE_DIRS;GSTREAMER_MPEGTS_LIBRARIES;GSTREAMER_TAG_INCLUDE_DIRS;GSTREAMER_TAG_LIBRARIES;GSTREAMER_GL_INCLUDE_DIRS;GSTREAMER_GL_LIBRARIES;GSTREAMER_AUDIO_INCLUDE_DIRS;GSTREAMER_AUDIO_LIBRARIES;GSTREAMER_FFT_INCLUDE_DIRS;GSTREAMER_FFT_LIBRARIES;GSTREAMER_TRANSCODER_INCLUDE_DIRS;GSTREAMER_TRANSCODER_LIBRARIES (Required is at least version "1.18.4")
CMake Error at Source/cmake/GStreamerChecks.cmake:62 (message):
  GStreamerTranscoder >= 1.20 is needed for USE_GSTREAMER_TRANSCODER.
Call Stack (most recent call first):
  Source/cmake/OptionsGTK.cmake:478 (include)
  Source/cmake/WebKitCommon.cmake:237 (include)
  CMakeLists.txt:21 (include)

using this defconfig

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y
BR2_PACKAGE_WEBKITGTK_MULTIMEDIA=y

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4a2ec46014687faf91c3db8f9f768a00133c3f36)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:18:58 +01:00
Bernd Kuhls
ecd9ffbdd3 package/webkitgtk: disable libdrm usage when not available
Fixes build error

-- Could NOT find LibDRM (missing: LibDRM_INCLUDE_DIR LibDRM_LIBRARY)
CMake Error at Source/cmake/OptionsGTK.cmake:320 (message):
  libdrm is required for USE_LIBDRM
Call Stack (most recent call first):
  Source/cmake/WebKitCommon.cmake:237 (include)
  CMakeLists.txt:21 (include)

with this defconfig:

BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y

due to libdrm being enabled by default:
f736325e66/Source/cmake/OptionsGTK.cmake (L59)

This is a port of buildroot commit 65f8174648a3df922892cfac1ad15279d1bffde3
for the wpewebkit package, quoting its commit message:

    Pass USE_LIBDRM=OFF to the wpewebkit CMake configuration step when the
    libdrm package has not been selected.

    WPE WebKit can be built without libdrm support, and it will still work
    with backends that use other platform-specific methods to handle
    graphics buffers and/or presenting content onto an output. For example
    this is the case with wpebackend-rdk configured to use rpi-userland,
    which uses dispmanx to produce the output instead of DRM/KMS.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 865457e76201f663cf81b09486485fbee961423d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 11:18:43 +01:00
Peter Korsgaard
0ee60ab4d3 package/opensc: security bump to version 0.26.0
Fixes the following security vulnerabilities:

0.25.0:

CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5
padding in OpenSC
https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992

CVE-2024-1454: Potential use-after-free in AuthentIC driver during card
enrollment in pkcs15init
https://github.com/OpenSC/OpenSC/wiki/CVE-2024-1454

0.26.0:

CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init
https://github.com/advisories/GHSA-3q68-hm47-94vg

CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU
response values in libopensc
https://github.com/advisories/GHSA-2mjg-798r-mxwh

CVE-2024-45617: Uninitialized values after incorrect or missing checking
return values of functions in libopensc
https://github.com/advisories/GHSA-cf2w-h975-2fpg

CVE-2024-45618: Uninitialized values after incorrect or missing checking
return values of functions in pkcs15init
https://github.com/advisories/GHSA-f2v6-mw6x-qmwc

CVE-2024-45619: Incorrect handling length of buffers or files in libopensc
https://github.com/advisories/GHSA-9vxw-3j77-cj78

CVE-2024-45620: Incorrect handling of the length of buffers or files in
pkcs15init
https://github.com/advisories/GHSA-9c2g-6v5v-57qg

CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key
https://github.com/advisories/GHSA-mgc5-p43f-72pc

Release notes:
https://github.com/OpenSC/OpenSC/releases/tag/0.26.0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1f4b4ccde7ceb379010aeb93458792202622d64b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:46:47 +01:00
Peter Korsgaard
41bd9a5839 package/libsoup3: security bump to version 3.6.1
Fixes the following security vulnerabilities:

CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in
applications that perform conversion to UTF-8 in
soup_header_parse_param_list_strict.  Input received over the network cannot
trigger this.

https://www.cve.org/CVERecord?id=CVE-2024-52531

CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory
consumption.  during the reading of certain patterns of WebSocket data from
clients.

https://www.cve.org/CVERecord?id=CVE-2024-52532

Changelog: https://gitlab.gnome.org/GNOME/libsoup/-/blob/3.6.1/NEWS

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b9120736a7e1e6c6e685d70a5a93e4d861422d70)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:42:00 +01:00
Thomas Devoogdt
f62d6af7fd package/libsoup3: bump to 3.6.0
News:
 - https://download.gnome.org/sources/libsoup/3.5/libsoup-3.5.2.news
 - https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.0.news

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e3f464778945d3e7ed31c50d07de02fb2cd85464)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:41:54 +01:00
Thomas Devoogdt
e8c9054461 package/libsoup3: bump to 3.5.1
News: https://download.gnome.org/sources/libsoup/3.5/libsoup-3.5.1.news.

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cd2a882768)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-28 09:41:46 +01:00
Bernd Kuhls
c5ca74ba46 {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bb654e5a3bdef3576e82bd27e0ef809afb1b10d9)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-26 22:50:29 +01:00
Thomas Petazzoni
8b4a5da997 package/cdrkit: fix build with gcc 14.x
This commit adds a patch, which is already in Debian, fixing the build
with gcc 14.x:

/home/autobuild/autobuild/instance-7/output-1/build/host-cdrkit-1.1.11/genisoimage/genisoimage.c:1509:17: error: implicit declaration of function 'parse_checksum_algo' [-Wimplicit-function-declaration]
 1509 |             if (parse_checksum_algo(optarg, &checksum_algo_iso))
      |                 ^~~~~~~~~~~~~~~~~~~
make[3]: *** [genisoimage/CMakeFiles/genisoimage.dir/build.make:76: genisoimage/CMakeFiles/genisoimage.dir/genisoimage.o] Error 1

Fixes:

  http://autobuild.buildroot.net/results/a9cca8da22774ecafdbb382697aae71f78e348f4/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0a0de4d86cd1fbeb5ff0439259b297756b3a5d98)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-23 09:26:00 +01:00
Thomas Petazzoni
849306c66d package/cdrkit: convert first patch to Git formatted one
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 347def2fd1f062be5d335d06aaaec577c5fa1d68)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-23 09:25:39 +01:00
Peter Korsgaard
310d70cb08 package/python-django: security bump to version 5.0.10
Fixes the following security issues:

CVE-2024-53907: Potential denial-of-service in
django.utils.html.strip_tags()

The strip_tags() method and striptags template filter are subject to a
potential denial-of-service attack via certain inputs containing large
sequences of nested incomplete HTML entities.

CVE-2024-53908: Potential SQL injection in HasKey(lhs, rhs) on Oracle

Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle is
subject to SQL injection if untrusted data is used as a lhs value.
Applications that use the jsonfield.has_key lookup through the __ syntax are
unaffected.

https://www.djangoproject.com/weblog/2024/dec/04/security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-19 09:44:32 +01:00
Peter Korsgaard
460cce9247 package/libcurl: security bump to version 8.11.1
Fixes the following security vulnerability:

CVE-2024-11053: netrc and redirect credential leak
https://curl.se/docs/CVE-2024-11053.html

Changelog: https://curl.se/ch/8.11.1.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4338deaae58a68e397c7375476745778eb7b732f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-19 09:24:45 +01:00
Peter Korsgaard
cf454846b5 package/subversion: security bump to version 1.14.5
Fixes the following security vulnerabilities:

CVE-2024-46901: mod_dav_svn denial-of-service via control characters in
paths

It has been discovered that the patch for CVE-2013-1968 was incomplete
and unintentionally left mod_dav_svn vulnerable to control characters
in filenames.

https://subversion.apache.org/security/CVE-2024-46901-advisory.txt

Subversion 1.14.4 also fixed a Windows-only vulnerability:
https://subversion.apache.org/security/CVE-2024-45720-advisory.txt

For change log, see:
https://svn.apache.org/repos/asf/subversion/tags/1.14.5/CHANGES

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: add link to change log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9975d28aa3ffbda2b727979b2e322fc8986d6d1b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-19 09:24:31 +01:00
Peter Korsgaard
5d1912ba3d package/wireshark: security bump to version 4.0.17
Fixes the following vulnerabilities:

4.0.17:

CVE-2024-8250: wnpa-sec-2024-11 · NTLMSSP dissector crash
https://www.wireshark.org/security/wnpa-sec-2024-11

4.0.16:

CVE-2024-8645: wnpa-sec-2024-10 · SPRT dissector crash
https://www.wireshark.org/security/wnpa-sec-2024-10

4.0.15:

CVE-2024-4854: wnpa-sec-2024-07 · MONGO and ZigBee TLV dissector infinite
loops
https://www.wireshark.org/security/wnpa-sec-2024-07

CVE-2024-4853: wnpa-sec-2024-08 · Editcap byte chopping crash
https://www.wireshark.org/security/wnpa-sec-2024-08

CVE-2024-4855: wnpa-sec-2024-09 · Editcap secret injection crash
https://www.wireshark.org/security/wnpa-sec-2024-09

4.0.14:

CVE-2024-2955: wnpa-sec-2024-06 · T.38 dissector crash
https://www.wireshark.org/security/wnpa-sec-2024-06

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 12:50:49 +01:00
Bernd Kuhls
79299da8c4 package/wget: security bump version to 1.25.0
Release notes:
https://lists.gnu.org/archive/html/bug-wget/2024-11/msg00002.html

Fixes the following vulnerabilities:

- CVE-2024-38428: url.c in GNU Wget through 1.24.5 mishandles semicolons in
  the userinfo subcomponent of a URI, and thus there may be insecure
  behavior in which data that was supposed to be in the userinfo
  subcomponent is misinterpreted to be part of the host subcomponent.

  https://nvd.nist.gov/vuln/detail/CVE-2024-38428

- CVE-2024-10524: Applications that use Wget to access a remote resource
  using shorthand URLs and pass arbitrary user credentials in the URL are
  vulnerable.  In these cases attackers can enter crafted credentials which
  will cause Wget to access an arbitrary host.

  https://www.openwall.com/lists/oss-security/2024/11/18/6

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 295b2c4f8ecaf0b6e03725a6c8412795e91888c8)
[Peter: mark as security bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 11:58:23 +01:00
Bernd Kuhls
27914e481d package/wget: bump version to 1.24.5
Release notes:
https://lists.gnu.org/archive/html/bug-wget/2024-03/msg00008.html

No versions between > 1.21.4 and < 1.24.5 were released:
https://lists.gnu.org/archive/html/bug-wget/2024-03/msg00012.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9beea334b769b187b9c0870895d4c3bc31758198)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 11:58:12 +01:00
Julien Olivain
76d7d1f1b9 package/nettle: update _SITE to use BR2_GNU_MIRROR
The nettle package is distributed on the GNU project servers. See [1]
and [2]. Buildroot has the BR2_GNU_MIRROR configuration which can
be used for that purpose. See [3].

For consistency with all other GNU packages, this commit updates
the _SITE to use BR2_GNU_MIRROR.

Note: the nettle _SITE was updated to ftp.gnu.org in commit [4].

[1] https://www.lysator.liu.se/~nisse/nettle/
[2] https://www.gnu.org/prep/ftp.html
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08.2/Config.in#L286
[4] 92f0ef5eaa

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 9ccc0f5642cf173bcc8d51f778331acfea9dbde8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 09:53:44 +01:00
Julien Olivain
029fc4fb3a package/freeipmi: update _SITE to use BR2_GNU_MIRROR
The freeipmi package is distributed on the GNU project servers.
See [1] and [2]. Buildroot has the BR2_GNU_MIRROR configuration
which can be used for that purpose. See [3].

For consistency with all other GNU packages, this commit updates
the _SITE to use BR2_GNU_MIRROR.

[1] https://www.gnu.org/software/freeipmi/download.html
[2] https://www.gnu.org/prep/ftp.html
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08.2/Config.in#L286

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit bfa2dbc2d679b88d8166359ec916590050fb5802)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 09:53:17 +01:00
Julien Olivain
b1f9e8cc15 package/octave: update _SITE to use BR2_GNU_MIRROR
The octave package is distributed on the GNU project servers. See [1]
and [2]. Buildroot has the BR2_GNU_MIRROR configuration which can
be used for that purpose. See [3].

For consistency with all other GNU packages, this commit updates
the _SITE to use BR2_GNU_MIRROR.

[1] https://www.octave.org/download
[2] https://www.gnu.org/prep/ftp.html
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08.2/Config.in#L286

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit b0a1b0bab1238271ca99d6a453101d6b128b027a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 09:52:21 +01:00
Julien Olivain
5a07c6f8b3 Config.in: switch GNU mirrors URL to https
As explained on [1], the primary GNU mirrors URL is https.
This commit updates BR2_GNU_MIRROR to switch to it.

[1] https://www.gnu.org/prep/ftp.html

Signed-off-by: Julien Olivain <ju.o@free.fr>
Reviewed-by: Vincent Jardin <vjardin@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 0f9da3934b9fc1425db49526ab7735a601ac1edb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-14 09:51:29 +01:00
Julien Olivain
1650865220 boot/grub2: update _SITE to use BR2_GNU_MIRROR
The grub2 package is distributed on the GNU project servers. See [1]
and [2]. Buildroot has the BR2_GNU_MIRROR configuration which can
be used for that purpose. See [3].

For consistency with all other GNU packages, this commit updates
the _SITE to use BR2_GNU_MIRROR.

Note: Commit [4] introduced the grub2 package using BR2_GNU_MIRROR.
Commit [5] changed it to use "http://ftp.gnu.org/gnu/grub" without
providing a justification for that change.

[1] https://www.gnu.org/software/grub/grub-download.html
[2] https://www.gnu.org/prep/ftp.html
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08.2/Config.in#L286
[4] c24fdb3680
[5] 5ffafd2353

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 51858c4a34f73c52ac9ff36ba7facf8a8ab9b711)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-13 23:39:09 +01:00
Julien Olivain
2538748565 package/bc: update _SITE to use BR2_GNU_MIRROR
The bc package is distributed on the GNU project servers. See [1]
and [2]. Buildroot has the BR2_GNU_MIRROR configuration which can
be used for that purpose. See [3]

For consistency with all other GNU packages, this commit updates
the _SITE to use BR2_GNU_MIRROR.

As a side note, the bc package was introduced long time ago using
BR2_GNU_MIRROR. See [4]. It was then updated to an alpha version
in [5]. When the alpha version was no longer needed, it was switched
to the main GNU download server in [6].

[1] https://www.gnu.org/software/bc/
[2] https://www.gnu.org/prep/ftp.html
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08.2/Config.in#L286
[4] c95dcd4645
[5] 1faa7c344e
[6] ed7572cc7f

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 2956a3921548921adb5472e092901ff9d9861333)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-13 23:37:23 +01:00
Peter Korsgaard
80ade2cbab package/python3: security bump to version 3.11.11
gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the
mapped IPv4 address value for deciding properties.  Properties which have
their behavior fixed are is_multicast, is_reserved, is_link_local,
is_global, and is_unspecified.

https://github.com/python/cpython/issues/122792

CVE-2024-9287, gh-124651: Properly quote template strings in venv activation
scripts.

https://github.com/python/cpython/issues/124651

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-13 18:09:21 +01:00
Peter Korsgaard
d8e6f912c6 package/xen: fix 'available' typo
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 21e5a9a96b1c25a7d3a5e92fd405afb6aafde605)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:15 +01:00
Peter Korsgaard
3126215c3e package/xdriver_xf86-video-qxl: fix 'appropriate' typo
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2e8cd8199c5024cf419336d509c8714cf560e8b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:13 +01:00
Peter Korsgaard
a2d58f5145 package/wilc-firmware: fix 'acceptable' typo
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0c6b8c989fcca8d057f7598f28eff377a018ed2f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:12 +01:00
Peter Korsgaard
23872a77b2 package/vim: fix 'highlighting' typo
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 900bf91d104d412853ccc6970cad752c3d217699)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:10 +01:00
Peter Korsgaard
f1a9811a45 package/vdr-plugin-vnsiserver: fix 'several' typo
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 34c671688741410a4eb4d83b38874dee00e9ebb9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:09 +01:00
Peter Korsgaard
996554d0bc package/transmission: fix 'environment' and 'RECOMMENDED' typos
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9a46343df311961a8efb2a5e75c179eaa40b9a59)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:07 +01:00
Peter Korsgaard
7596ec2b69 package/tpm2-tss: fix 'and' typo
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit aca49ab538f07b77aa57b9940b78239544dd256f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:06 +01:00
Peter Korsgaard
b1b6002049 package/ti-sgx-demos: fix 'available' typo
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ee93f20f96b2f27ef4c512bf591f55ed4518b82a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:05 +01:00
Peter Korsgaard
e93fde7c81 package/tcf-agent: fix 'will not' and 'unmodified' typos
Found by codespell.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 10c218ea7805c0384cf28ab95350dcc2dd821f79)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-12-12 21:19:03 +01:00