Commit Graph

54607 Commits

Author SHA1 Message Date
Samuel Mendoza-Jonas
efca26a405 package/busybox: Fix check for IPv6 default route in udhcpc
The check for a default route is inverted, causing the script to wait
for the timeout even when a default IPv6 route is available. Fix this up
so that it exits early as expected.

Reported-by: Bhattiprolu RaviKumar <ravikumar.bhattiprolu@gmail.com>
Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 09ad6f392f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:29:45 +01:00
Peter Korsgaard
8f0312d967 package/wireguard-linux-compat: bump version to 1.0.20210124
Fixes a build issue with recent 4.14.x stable kernels.  For details, see the
announcement:

https://lists.zx2c4.com/pipermail/wireguard/2021-January/006349.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ff852b0de4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:27:53 +01:00
Peter Korsgaard
535c86e6f7 package/python-django: security bump to version 3.0.12
Fixes the following security issues:

CVE-2021-3281: Potential directory-traversal via archive.extract()

The django.utils.archive.extract() function, used by startapp --template and
startproject --template, allowed directory-traversal via an archive with
absolute paths or relative paths with dot segments.

For details, see the advisory:
https://www.djangoproject.com/weblog/2021/feb/01/security-releases/

Additionally, 3.0.11 fixed a regression:
https://docs.djangoproject.com/en/3.1/releases/3.0.11/

Update indentation in hash file (two spaces).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 28355e20fe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:26:39 +01:00
Peter Korsgaard
3e8d678be2 package/privoxy: security bump to version 3.0.31
From the announcement:

ChangeLog for Privoxy 3.0.31
--------------------------------------------------------------------
- Security/Reliability:
  - Prevent an assertion from getting triggered by a crafted CGI request.
    Commit 5bba5b89193fa. OVE-20210130-0001.
    Reported by: Joshua Rogers (Opera)
  - Fixed a memory leak when decompression fails "unexpectedly".
    Commit f431d61740cc0. OVE-20210128-0001.

- Bug fixes:
  - Fixed detection of insufficient data for decompression.
    Previously Privoxy could try to decompress a partly
    uninitialized buffer.

https://www.privoxy.org/announce.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3a6fde69e1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:23:30 +01:00
Fabrice Fontaine
fa17e077ab package/pugixml: bump to version 1.11.4
- Use LICENSE.md which has been added in the release tarball since
  version 1.11 and
  ccb63a9186
- Fix a build failure with gerbera >= 1.5.0 when building pugixml in
  header-only mode

Fixes:
 - http://autobuild.buildroot.org/results/9c1919bacd23da0505a4eb828a806997a23b640f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 451fed96f9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 20:20:03 +01:00
Thomas Petazzoni
48ef8defa1 package/binutils: bump 2.35.x series to 2.35.2
Release notes:

  https://sourceware.org/pipermail/binutils/2021-January/115150.html

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 98267eb874)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 18:52:35 +01:00
Thomas De Schampheleire
ee4a1452a0 package/xenomai: set 'custom' as version in case of tarball
When BR2_PACKAGE_XENOMAI_CUSTOM_TARBALL is selected, the xenomai package
declared an empty version, which among others means that the build directory
becomes output/build/xenomai without any version specification, and empty
version information in 'xenomai-show-info'.

Other packages that allow a custom tarball, like 'linux' and
'arm-trusted-firmware', specify 'custom' as version in this case.

Adapt the xenomai package accordingly.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 603bfafa97)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 18:49:25 +01:00
Peter Korsgaard
11ed6ccd1f package/xserver_xorg-server: don't install init script if nodm is enabled
Both S40xorg and S90nodm tries to run an Xserver on vt1, causing the nodm
one to fail.  If nodm is enabled, then that is likely what the user wants to
run, so skip installing S40xorg.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 735581122a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-03 18:40:49 +01:00
Fabrice Fontaine
41cbb88372 package/dhcpcd: create /var/db/dhcpcd
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13506

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-02 18:59:09 +01:00
Fabrice Fontaine
2f11b344d9 package/intel-mediadriver: fix option
Replace INSTALL_DRIVERS_SYSCONF by INSTALL_DRIVER_SYSCONF which is the
correct name since version 18.2.0 and
81796c8a9e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9d41e98d6f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:53:59 +01:00
Fabrice Fontaine
230f80d156 package/intel-mediadriver: drop unrecognized options
BUILD_ALONG_WITH_CMRTLIB has been dropped since version 18.2.0 and
c3e13c175d

RUN_TEST_SUITE is also unrecognized (only MEDIA_RUN_TEST_SUITE is
recognized)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8a0cbe9474)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:53:41 +01:00
Fabrice Fontaine
10ee253027 package/intel-mediadriver: fix build with gcc 10
Fixes:
 - http://autobuild.buildroot.org/results/d5ab36026a66a4f371fb6ef6c9ecf43e9617d119

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6a0d2bb945)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:53:32 +01:00
Geoffrey Le Gourriérec
e8c386da55 package/uclibc: Patch with updated kernel time definitions
Building uclibc 1.0.37 for SuperH architecture with linux-headers 5.10.7
fails at libpthread level due to missing time-related data structures,
usually defined by the kernel. Make uclibc correctly define those types.

A previous patch in buildroot [1] fixed the symptom by tampering with
linux-headers inclusions, but analysis [2] done in collaboration with
Linux folks concluded that the issue lied in (voluntary) include guard
"preemption" in uclibc kernel_types.h.
However, kernel_types.h was not up to date with relevant 64-bit time
data structures, so defining those here was needed.

The present uclibc patch was mailed to uclibc-ng mailing list and got
a positive response; I am not able to give a link to the discussion,
as it has not appeared yet [3] (perhaps I'm not looking at the right
place ?)
So until the patch is merged upstream and we bump uclibc version, keep
our patch here.

[1] https://git.buildroot.net/buildroot/commit/?id=742f37de8d0e3797698411dfc6a63bd7e98aafe2
[2] https://patchwork.kernel.org/project/linux-sh/patch/20210123165652.10884-1-geoffrey.legourrierec@gmail.com/
[3] https://mailman.uclibc-ng.org/pipermail/devel/2021-January/thread.html

Signed-off-by: Geoffrey Le Gourriérec <geoffrey.legourrierec@gmail.com>
Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1f50a44371)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-01 10:19:03 +01:00
Peter Korsgaard
551cb63007 Update for 2020.11.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-31 21:34:30 +01:00
Peter Korsgaard
6f48359ff8 CHANGES: update with recent changes
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 18:36:55 +01:00
Fabrice Fontaine
0567775702 package/socat: security bump to version 1.7.4.1
Buffer size option (-b) is internally doubled for CR-CRLF conversion,
but not	checked for integer overflow. This could lead to heap based
buffer overflow, assuming the attacker could provide this parameter.

- Update indentation in hash file (two spaces)
- Update hash of README file due to minor updates:
  https://repo.or.cz/socat.git/commit/b145170837d75bd7a1a5803283910ab075d47bea
  https://repo.or.cz/socat.git/commit/0a115feadc3102f17e0a8a1a985319af0295f704

http://www.dest-unreach.org/socat/doc/CHANGES

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1b18d9104f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 16:38:19 +01:00
Peter Korsgaard
3bf6d795e2 {linux, linux-headers}: bump 4.19.x / 5.{4, 10}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1c61297ec0)
[Peter: drop 5.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 16:35:46 +01:00
Peter Korsgaard
d2d2ac40a4 package/mutt: add security fixes from Ubuntu for CVE-2021-3181
Fixes the following security issue:

- CVE-2021-3181: rfc822.c in Mutt through 2.0.4 allows remote attackers to
  cause a denial of service (mailbox unavailability) by sending email
  messages with sequences of semicolon characters in RFC822 address fields
  (aka terminators of empty groups).  A small email message from the
  attacker can cause large memory consumption, and the victim may then be
  unable to see email messages from other persons.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c1413cd94c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 16:23:11 +01:00
Peter Korsgaard
47afc80adf support/dependencies/check-host-cmake.mk: gerbera needs cmake 3.14+
Fixes:
http://autobuild.buildroot.net/results/871/8717612ae32cc491b868f37fbbc960c16b562877/

Since the security bump to gerbera 1.6.4, gerbera now needs cmake 3.14+,
whereas Buildroot currently enforces 3.10+.

As a fix, bump the requirement to 3.14+ when gerbera is enabled.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-30 11:43:55 +01:00
Peter Korsgaard
6b8e73d6a1 package/glibc: security bump for additional post-2.31.x fixes
Fixes the following security issue:

- CVE-2021-3326: Assertion failure in ISO-2022-JP-3 gconv module related to
  combining characters

For details, see https://sourceware.org/bugzilla/show_bug.cgi?id=27256 and
https://www.openwall.com/lists/oss-security/2021/01/27/3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-29 09:59:40 +01:00
Baruch Siach
9e2f21dff9 package/uboot-tools: drop redundant parentheses
Commit d8db91fc6f ("package/uboot-tools: resolve host uboot env/script
error") introduced closing parentheses that is not matched and not
needed.

Fixes:
http://autobuild.buildroot.net/results/a65/a65fcc581f56ef70154f83e80f12d64f2e0f856a/
http://autobuild.buildroot.net/results/39a/39aabb9d8afcdead1d620e081d2cd43ee2d61fbc/

Cc: Matt Weber <matthew.weber@rockwellcollins.com>
Cc: Kalpesh Panchal <kalpesh.panchal@rockwellcollins.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollins.com>
Reviewed-by: Bin Meng <bin.meng@windriver.com>
Tested-by: Bin Meng <bin.meng@windriver.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c1eb722915)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:18:26 +01:00
Fabrice Fontaine
379112c575 package/gerbera: needs gcc >= 8
std::filesystem is required since version 1.5.0:
https://github.com/gerbera/gerbera/issues/849

Fixes:
 - http://autobuild.buildroot.org/results/759c875ee8ab0447cd735c22f89fa127cb8c427c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 70db2351da)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:16:12 +01:00
Kalpesh Panchal
9bec67f56d package/uboot-tools: resolve host uboot env/script error
The host build of uboot-tools can occur early in the build process and may
require the creation of BINARIES_DIR before generation of an enabled envimage
and/or boot script binary. So to resolve this in proper way, separated the
build and installation part of uboot env/script in their respective commands.

Signed-off-by: Kalpesh Panchal <kalpesh.panchal@rockwellcollins.com>
Signed-off-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d8db91fc6f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:12:00 +01:00
Peter Korsgaard
c2a46a5136 package/sudo: drop unneeded autoreconf
Commit 4fea71ac78 (package/sudo: security bump to version 1.9.5p2)
removed the patch, but forgot to remove the now unneeded autoreconf.  Fix
that.

Reported-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 84a8aac451)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:09:49 +01:00
Christian Stewart
05983bbbe8 package/sudo: security bump to version 1.9.5p2
Major changes between sudo 1.9.5p2 and 1.9.5p1

 * Buildroot: dropped a patch that was included in the release.

 * Fixed sudo's setprogname(3) emulation on systems that don't
   provide it.

 * Fixed a problem with the sudoers log server client where a partial
   write to the server could result the sudo process consuming large
   amounts of CPU time due to a cycle in the buffer queue. Bug #954.

 * Added a missing dependency on libsudo_util in libsudo_eventlog.
   Fixes a link error when building sudo statically.

 * The user's KRB5CCNAME environment variable is now preserved when
   performing PAM authentication.  This fixes GSSAPI authentication
   when the user has a non-default ccache.

 * When invoked as sudoedit, the same set of command line options
   are now accepted as for "sudo -e".  The -H and -P options are
   now rejected for sudoedit and "sudo -e" which matches the sudo
   1.7 behavior.  This is part of the fix for CVE-2021-3156.

 * Fixed a potential buffer overflow when unescaping backslashes
   in the command's arguments.  Normally, sudo escapes special
   characters when running a command via a shell (sudo -s or sudo
   -i).  However, it was also possible to run sudoedit with the -s
   or -i flags in which case no escaping had actually been done,
   making a buffer overflow possible.  This fixes CVE-2021-3156.

https://www.sudo.ws/stable.html#1.9.5p2

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4fea71ac78)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:09:15 +01:00
Thomas De Schampheleire
30c6b17b4a package/opentracing-cpp: fix build if clang-tidy is installed on the host
opentracing-cpp fails to build if clang-tidy is installed:

...
-- clang-tidy found: /usr/lib/llvm/11/bin/clang-tidy
-- Configuring done
-- Generating done
...

[ 25%] Building CXX object CMakeFiles/opentracing.dir/src/propagation.cpp.o
.../buildroot/output/build/opentracing-cpp-1.5.1/include/opentracing/string_view.h:5:10: error: 'algorithm' file not found [clang-diagnostic-error]
         ^
.../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp:3:11: warning: '__llvm_libc' needs to be the outermost namespace [llvmlibc-implementation-in-namespace]
namespace opentracing {
          ^
.../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp:11:3: warning: use '= default' to define a trivial default constructor [hicpp-use-equals-default,modernize-use-equals-default]
  PropagationErrorCategory() {}
  ^                          ~~
                             = default;
.../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp:13:15: warning: use a trailing return type for this function [modernize-use-trailing-return-type]
  const char* name() const noexcept override {
  ~~~~~~~~~~~ ^
  auto                              -> const char*
.../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp:13:15: warning: method 'name' can be made static [readability-convert-member-functions-to-static]
  const char* name() const noexcept override {
              ^      ~~~~~~
  static
.../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp:17:24: warning: use a trailing return type for this function [modernize-use-trailing-return-type]
  std::error_condition default_error_condition(int code) const
                       ^
.../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp:37:15: warning: use a trailing return type for this function [modernize-use-trailing-return-type]
  std::string message(int code) const override {
              ^
.../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp:58:28: warning: use a trailing return type for this function [modernize-use-trailing-return-type]
const std::error_category& propagation_error_category() {
                           ^
226 warnings and 1 error generated.
Error while processing .../buildroot/output/build/opentracing-cpp-1.5.1/src/propagation.cpp.
Suppressed 218 warnings (218 in non-user code).
Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
Found compiler error(s).
make[3]: *** [CMakeFiles/opentracing.dir/build.make:83: CMakeFiles/opentracing.dir/src/propagation.cpp.o] Error 1
make[3]: *** Waiting for unfinished jobs....
.../buildroot/output/build/opentracing-cpp-1.5.1/include/opentracing/string_view.h:5:10: error: 'algorithm' file not found [clang-diagnostic-error]
         ^
.../buildroot/output/build/opentracing-cpp-1.5.1/src/dynamic_load.cpp:4:

Disable the 'ENABLE_LINTING' option to avoid this influence.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit aede6dd7b6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:04:46 +01:00
Fabrice Fontaine
33562fecb6 package/gerbera: needs xpath in pugixml
Fixes:
 - http://autobuild.buildroot.org/results/0fcd0ce167c04f788bf1b9414ae5e7677691c7cf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c7414ab12e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:02:06 +01:00
Fabrice Fontaine
a6dc61541a package/gerbera: fix linking with std::filesystem
Do not force to CXX_FILESYSTEM_NO_LINK_NEEDED to ON to allow gerbera to
link with the approriate library for std::filesystem

It should be noted that check_cxx_source_runs has been dropped since
version 1.6.0 and
a3a64bed1d

Fixes:
 - http://autobuild.buildroot.org/results/0fcd0ce167c04f788bf1b9414ae5e7677691c7cf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 65f7b0d30d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:01:49 +01:00
Fabrice Fontaine
5bb1a4697b package/sslh: systemd needs libconfig
systemd-sslh-generator unconditionally uses libconfig

Fixes:
 - http://autobuild.buildroot.org/results/d46581842906f7780f4a3a1ae21963e78e7f5276

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr:
  - select libconfig
  - drop changes in the .mk
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ab8cb306e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 21:00:28 +01:00
Fabrice Fontaine
6218b0de22 package/libupnp18: drop package
Drop libupnp18 as libupnp has been bumped to 1.14.x and 1.8.x will not
been fixed against CallStranger a.k.a. CVE-2020-12695

mpd and vlc are already compliant with libupnp 1.14.x (i.e those
packages use UpnpInit2 instead of the deprecated UpnpInit)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eddc9df972)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 20:24:04 +01:00
Fabrice Fontaine
389d1524b4 package/ushare: add libupnp 1.14.x support
This switch is needed to fix CallStranger a.k.a. CVE-2020-12695

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f851b36371)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:56:03 +01:00
Fabrice Fontaine
fae5c287ca package/gmrender-resurrect: add libupnp 1.14.x support
Using libupnp 1.14.x is needed to fix CallStranger a.k.a. CVE-2020-12695

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9f3f2fa6a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:55:31 +01:00
Fabrice Fontaine
caf4d9ffae package/igd2-for-linux: security bump to version 2.0
- Move site to Orange-OpenSource
- Drop patch (already in version)
- This version is compatible with libupnp 1.14.x to fix
  CallStranger a.k.a. CVE-2020-12695
- Add threadutil license (BSD-3-Clause)
- Update hash in license file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a83073ac31)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:53:02 +01:00
Fabrice Fontaine
e9dd318ac3 package/gerbera: security bump to version 1.6.4
- This version is compatible with libupnp 1.14.x which fix
  CallStranger a.k.a. CVE-2020-12695
- Drop all patches (already in version)
- expat is not needed since version 1.5.0 and
  a4f0cccd6a
- fmt is a mandatory dependency since version 1.5.0 and
  fe81e5fc88
- spdlog is a mandatory dependency since version 1.5.0 and
  615d698fe4
- pugixml is a mandatory dependency since version 1.5.0 and
  c244006aa0
- libnpupnp can be used instead of libupnp since version 1.6.2 and
  e648763626
- Set CXX_FILESYSTEM_NO_LINK_NEEDED to ON to avoid a build failure
  due to check_cxx_source_runs which has been added with
  8ea0fce24c
- Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr:
  - libupnp and libnpupnp are mutually exclusive
  - fix typo in npupnp package name
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 61b1107e30)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:52:25 +01:00
Fabrice Fontaine
e96410be8d package/libupnp: security bump to version 1.14.0
- Fix CallStranger a.k.a. CVE-2020-12695 as well as CVE-2020-13848
- Update indentation in hash file (two spaces)
- Backport all changes from libupnp18 to libupnp:
  - Use COPYING instead of LICENSE (no license change)
  - Add host-pkgconf dependency
  - Add --enable-reuseaddr
  - Add openssl optional dependency

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 118648d161)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:51:30 +01:00
Fabrice Fontaine
9fd1c3b480 package/mpd: create directories used in mpd.conf
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13471

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d0031c5621)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:39:38 +01:00
Fabrice Fontaine
3b72c7f8d9 package/openldap: security bump to version 2.4.57
Fixes the following security issues:

- CVE-2020-36221: An integer underflow was discovered in OpenLDAP before
  2.4.57 leading to slapd crashes in the Certificate Exact Assertion
  processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).

- CVE-2020-36222: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  an assertion failure in slapd in the saslAuthzTo validation, resulting in
  denial of service.

- CVE-2020-36223: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  a slapd crash in the Values Return Filter control handling, resulting in
  denial of service (double free and out-of-bounds read).

- CVE-2020-36224: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  an invalid pointer free and slapd crash in the saslAuthzTo processing,
  resulting in denial of service.

- CVE-2020-36225: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  a double free and slapd crash in the saslAuthzTo processing, resulting in
  denial of service.

- CVE-2020-36226: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  a memch->bv_len miscalculation and slapd crash in the saslAuthzTo
  processing, resulting in denial of service.

- CVE-2020-36227: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  an infinite loop in slapd with the cancel_extop Cancel operation,
  resulting in denial of service.

- CVE-2020-36228: An integer underflow was discovered in OpenLDAP before
  2.4.57 leading to a slapd crash in the Certificate List Exact Assertion
  processing, resulting in denial of service.

- CVE-2020-36229: A flaw was discovered in ldap_X509dn2bv in OpenLDAP before
  2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring,
  resulting in denial of service.

- CVE-2020-36230: A flaw was discovered in OpenLDAP before 2.4.57 leading in
  an assertion failure in slapd in the X.509 DN parsing in decode.c
  ber_next_element, resulting in denial of service.

https://www.openldap.org/software/release/changes.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 46c4c9684d)
[Peter: mark as security bump, add CVE info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:34:13 +01:00
Kalpesh Panchal
a1d3dd8421 package/uboot-tools: resolve uboot env source file error
If Target u-boot is not available, the host build of uboot-tools
requires user to provide u-boot environment source file.
This change resolves a missing parentheses and updates the comment
for the same.

Signed-off-by: Kalpesh Panchal <kalpesh.panchal@rockwellcollins.com>
Signed-off-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4419c3dafd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:29:21 +01:00
Maxim Kochetkov
89a47457a8 package/postgresql: add some additional output to pg_config
Some external packages call pg_config to determine the installed
PostgreSQL options. Add this output to Buildroots own pg_config,
so these packages correctly compile.

Added options:
	--pkgincludedir
	--pgxs
	--cflags
	--cc
	--pkglibdir
	--bindir
	--sharedir
	--localedir
	--docdir
	--mandir

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e3ff618bd8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:35:03 +01:00
Titouan Christophe
bffdab0612 package/redis: bump to v6.0.10
Redis 6.0.10 fixes several bugs with moderate impact.

Read the full announcement:
https://github.com/redis/redis/blob/6.0.10/00-RELEASENOTES

Signed-off-by: Titouan Christophe <titouanchristophe@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7ee49e48bd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:23:43 +01:00
Bernd Kuhls
a5fe4ec31f {linux, linux-headers}: bump 5.{4, 10}.x 4.{4, 9, 14, 19} series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6943c84d9c)
[Peter: drop 5.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:08:53 +01:00
Fabrice Fontaine
761a7334c1 package/libtorrent-rasterbar: drop host gcc dependency
Drop host gcc dependency which has wrongly been added by commit
0393f5d344

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ab0af07ce2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:05:36 +01:00
Fabrice Fontaine
c0162e6c7a package/brltty: add polkit optional dependency
polkit is an optional dependency (enabled by default) since version 5.4:
e62b3c925d

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 74c6a7e4db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:02:03 +01:00
Gwenhael Goavec-Merou
19aa4e9ee7 package/uhd: fix build on RISC-V
When the target CPU is riscV, msgpack is unable to detect endianness with a list of errors like:

uhd/host/lib/deps/rpclib/include/rpc/msgpack/pack.hpp:190:2: error: #error msgpack-c supports only big endian and little endian
  190 | #error msgpack-c supports only big endian and little endian
      |  ^~~~~

and with subsequent errors:

uhd0/host/lib/deps/rpclib/include/rpc/msgpack/pack.hpp:236:46: error: there are no arguments to 'take8_8' that depend on a template parameter, so a declaration of 'take8_8' must be available [-fpermissive]
  236 |     char buf[2] = {static_cast<char>(0xccu), take8_8(d)};
      |

This is due to a missing support for this architecture in msgpack.
This patch adapt commit from https://github.com/boostorg/predef

[backported from https://github.com/EttusResearch/uhd/pull/400]

Fix:
- http://autobuild.buildroot.net/results/afacf5c5c2cd9dff6962523f1fdded9b474b9d66/
- http://autobuild.buildroot.net/results/91530538d630a7f09d85327e514f01b45253c1a6/
- http://autobuild.buildroot.net/results/91530538d630a7f09d85327e514f01b45253c1a6/
- and others

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8692d8f38d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:00:46 +01:00
Fabrice Fontaine
0c68c46440 package/sudo: fix static build without closefrom
Fixes:
 - http://autobuild.buildroot.org/results/515b45f876fa9de03c9235f86017f4dc10eb3b54

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b6eeb2fdda)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:54:52 +01:00
Thomas De Schampheleire
8253f57ad8 package/syslog-ng: fix build if net-snmp is installed on the host (again)
See also commit 4ff6e52392 which describes the
problem in detail.

The same problem now arises again, because syslog-ng renamed the
--enable-snmp-dest option into --enable-afsnmp. See syslog-ng commit
4537938474771673ef5bd4a9cad7c9a7dc20b7c1, first part of 3.27.1.

Update the configure options passed from Buildroot accordingly.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 40f4468e94)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:49:53 +01:00
Yann E. MORIN
a8f6453a55 utils: fix flake8 warning
Commit 40bb37bd70 refactored get-developers, and now the 'os' module is
no longer needed, but still imported:

    utils/get-developers:6:1: F401 'os' imported but unused
    1     F401 'os' imported but unused

Drop it now.

Reported-by: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9277978e28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:43:56 +01:00
Fabrice Fontaine
831a862f64 package/poppler: add boost optional dependency
boost is an optional dependency which is enabled by default since
version 0.80.0 and
355fd8d58c

There is no cmake option to enable or disable this dependency

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 497f989d75)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:28:20 +01:00
Bernd Kuhls
17c1e129e6 package/vlc: security bump version to 3.0.12
Removed patch which was applied upstream, removed md5 hash.

Security Bulletin: https://www.videolan.org/security/sb-vlc3012.html
Fixes CVE-2020-26664: https://nvd.nist.gov/vuln/detail/CVE-2020-26664

Added CPE_ID, cpe:2.3🅰️videolan:vlc_media_player is a valid CPE
identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&orderBy=2.3&keyword=cpe%3A2.3%3Aa%3Avideolan%3Avlc_media_player&status=FINAL

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit de128d9ad6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-22 09:39:25 +01:00
Yann E. MORIN
2a7f1d2571 package/pkg-meson.mk avoid host ccache detection
meson will by default try to detect the presence of ccache, and if
found, will use it unconditionally.

However, using a system-wide ccache, which would be using our own cache
directory, may very well conflict with our own ccache.

But there is no option to disable that meson behaviour. The only
workaround that is even the official documented way to do so, is to
actually pass environment variables that point to the compiler:

    https://mesonbuild.com/Feature-autodetection.html#ccache

For the host variants, we pass $(HOST_CONFIGURE_OPTS) in the environment,
and this contains correct settings for CC and CXX, so meson does not try
and detect ccache; it uses exactly what we tell it to use.

For the target variant, the settings for the cross-compiler are defined
in the cross-compilation file, and so meson just abides by our will. But
for the compiler-for-build, there is no way to specify the CC_FOR_BUILD
or CXX_FOR_BUILD via a cross-compilation file:

    https://mesonbuild.com/Machine-files.html
    https://mesonbuild.com/Cross-compilation.html

We could pass the full TARGET_CONFIGURE_OPTS in the environment, like we
do for the host variant, but this contains a lot more variables that are
supposed to be covered by the cross-compilation file.

So, we stay safe and just provide the exact two variables that meson
will use to avoid detecting ccache.

If the current configuration defines the use of ccache, then these two
variables will be properly setup to use our own ccache.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Gleb Mazovetskiy <glex.spb@gmail.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Norbert Lange <nolange79@gmail.com>
(cherry picked from commit f4a61d1ae2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-22 09:33:05 +01:00