Commit Graph

34239 Commits

Author SHA1 Message Date
Vicente Olivert Riera
fe43fddcfc sudo: fix static linking with openldap having openssl support
If we are building sudo statically and openldap was linked with openssl,
then when we link sudo with openldap we need to specify the openssl
libs, otherwise it will fail with "undefined reference" errors.

Fixes:
  http://autobuild.buildroot.net/results/ebb/ebbb4c3138b5023a0c8bd938db1932a25ba5b6fb/
  http://autobuild.buildroot.net/results/58e/58ee4fddea85f0c79b26582b04a573258e27eb47/
  http://autobuild.buildroot.net/results/051/05151c4ef7f0b3702a6cd5e6df4888d826a37431/
  http://autobuild.buildroot.net/results/b1d/b1dfae81985daee106700191fcb82387833c2e3f/
  http://autobuild.buildroot.net/results/5b4/5b42e8505856156389d480d0da19f6982cf120d8/
  http://autobuild.buildroot.net/results/30a/30a76190428f902f03bcf54ba9f1f4f4377c6fc9/
  http://autobuild.buildroot.net/results/e8c/e8c6bdc314b9a8d5de303633a3abd7b7e44beb2e/
  http://autobuild.buildroot.net/results/483/4830c69cc6a62080e1516f0d9009c2ba619c23c1/

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit bf899e50d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-15 13:36:19 +02:00
Thomas Petazzoni
8f3915ef79 efibootmgr: backport upstream patch to fix build with gcc 6.x
efibootmgr was built with -fshort-wchar, which causes gcc to use
2-byte wchar_t instead of the normal 4-byte wchar_t. But this doesn't
work anymore with gcc 6.x, as it causes a build failure:

/home/test/autobuild/run/instance-3/output/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-gnueabihf/6.3.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: warning: efibootmgr.o uses 2-byte wchar_t yet the output is to use 4-byte wchar_t; use of wchar_t values across objects may fail
/home/test/autobuild/run/instance-3/output/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-gnueabihf/6.3.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: warning: efi.o uses 2-byte wchar_t yet the output is to use 4-byte wchar_t; use of wchar_t values across objects may fail
/home/test/autobuild/run/instance-3/output/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-gnueabihf/6.3.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: warning: unparse_path.o uses 2-byte wchar_t yet the output is to use 4-byte wchar_t; use of wchar_t values across objects may fail

Upstream solution was do simply drop -fshort-wchar:

  3466fd05c8

So this commit simply backports this upstream patch.

Fixes:

  http://autobuild.buildroot.net/results/87c3ff2427331eb9ab31c9eb685fe80954a0a98f/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 3e254b82c7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-15 13:24:46 +02:00
Peter Seiderer
ff1e2c2c0d qt5base: fix examples compile with disabled gui module
Fixes [1]:

  Project ERROR: Could not find feature opengl.

[1] http://autobuild.buildroot.net/results/040/040ab283dbbec623fe5ff4eaece754d9701fafc5

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 4860e05a63)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-15 12:15:45 +02:00
Romain Naour
21724ff539 package/ltp-testsuite: needs threads NPTL
Fixes:
http://autobuild.buildroot.net/results/3e0/3e0bbf41e339e62422463773bf07945f048a9501

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 362d185b30)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-15 11:46:43 +02:00
Yann E. MORIN
f1d4f33bab package/libubox: fix lua module install path
The LUAPATH variable is only used when installing the lua module, and
cmake knows very well how to do out-of-tree isntalls, so there is no
reason to include the staging path in LUAPATH, which will cause our
post-install sanity checks to kick in and whine:

    libubox: installs files in /home/lhk/workspace/orangepi/host/usr/a
    rm-buildroot-linux-gnueabihf/sysroot//home/lhk/workspace/orangepi

As for libuci, just pass the runtime LUAPATH.

Fixes #9856

Reported-by: linhuikui@gmail.com
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit be3645a58a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-15 11:44:54 +02:00
Danomi Manchego
3858b49e93 dbus: fix dbus symlink removal
There was already a post-build hook to delete the /var/lib/dbus symlink
created by buildroot after the package's own installation, to prevent
a dbus installation error during "make dbus-rebuild".  However, this
misses the case for when one might delete the .stamp_target_installed
file manually, outside of dbus-rebuild.  This can be fixed by changing
the post-build hook to a pre-install hook.  This seems appropriate,
since it is really addressing an installation issue, not a build issue.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c2d6c4ac32)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-15 11:43:44 +02:00
Yann E. MORIN
6df3dc343f package/kyua: fix unmet dependencies
lutok is a lua module, so it depends on ! static libs. However, the
dependency is implicit, being done because the lua modules are sourced
globally under an if-block, and thus it is not easy to find that
dependency.

Propagate that dependency to kyua, which was missing it (because it is
not a lua module, so was missing the dependency).

[Peter: also update toolchain comment]
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Sebastien Bourdelin <sebastien.bourdelin@savoirfairelinux.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit a65da16f63)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-15 11:41:57 +02:00
Thomas Petazzoni
09fd512c8a nvidia-driver: use http:// instead of ftp://
Fixes the download, which currently times out on ftp://.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 2068c7c6a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-05 21:42:20 +02:00
Peter Korsgaard
f7d6bf3dda linux-headers: bump 4.{4,9,10}.x series
[Peter: drop 4.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 15a31470b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-05 21:37:51 +02:00
Baruch Siach
4a33076ffb picocom: force target LDFLAGS
This allows a static build of picocom when BR2_STATIC_LIBS=y but the toolchain
provides static and shared libraries.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit add51b89bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-05 21:35:23 +02:00
Peter Korsgaard
799aed7a18 Update for 2017.02.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-02 00:05:42 +02:00
Arnout Vandecappelle
abfcc5624b busybox: no need to disable clear and reset
Removing clear and reset from the busybox config when the ncurses tools
are enabled is not really needed.

Since commit 802bff9c42, the busybox install will not overwrite
existing programs. Therefore, the tools will be installed correctly
regardless of the order of the build:
- if busybox is built first, the clear and reset apps are installed,
  but they will be overwritten by ncurses;
- if ncurses is built first, it will install the clear and reset apps,
  and busybox will no longer install them.

We prefer not to modify the busybox configuration when not strictly
necessary, because it is surprising for the user that his configuration
is not applied. Clearly, it's not ideal that busybox is configured with
redundant apps, but if the user wants to shrink it, it's possible to
provide a custom config.

This partially reverts commit 33c72344a8.

Cc: Matthew Weber <matthew.weber@rockwellcollins.com>
Cc: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Tested-by: Matt Weber  <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 200282e207)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 23:59:39 +02:00
Peter Korsgaard
b706f46e97 linux-headers: bump 4.4.x series to 4.4.65
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0d18d1d9c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 22:43:16 +02:00
Peter Korsgaard
7ac7be5f87 linux-headers: bump 3.18.x series to 3.18.51
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 20:58:08 +02:00
Romain Naour
296ffa6770 toolchain-external: CodeSourcery MIPS update upstream URL
The current URL returns error 403: Forbidden, so switch to https.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 25902b111a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 09:21:18 +02:00
Romain Naour
35db9f3ab9 toolchain-external: CodeSourcery ARM update upstream URL
The current URL returns error 403: Forbidden, so switch to https.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit bcf1d93a89)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 09:21:08 +02:00
Romain Naour
0bc84f9612 toolchain-external: CodeSourcery aarch64 update upstream URL
The current URL returns error 403: Forbidden, so switch to https.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 3e069f41bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 09:20:59 +02:00
Romain Naour
bc224445b2 toolchain-external: CodeSourcery NIOSII update upstream URL
The current URL returns error 403: Forbidden, so switch to https.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit d647b23e2e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 09:20:48 +02:00
Peter Korsgaard
84e3e5a9f0 freetype: add upstream security fixes for CVE-2017-8105 and CVE-2017-8287
Add upstream post-2.7.1 commits (except for ChangeLog modifications) fixing
the following security issues:

CVE-2017-8105 - FreeType 2 before 2017-03-24 has an out-of-bounds write
caused by a heap-based buffer overflow related to the
t1_decoder_parse_charstrings function in psaux/t1decode.c.

CVE-2017-8287 - FreeType 2 before 2017-03-26 has an out-of-bounds write
caused by a heap-based buffer overflow related to the
t1_builder_close_contour function in psaux/psobjs.c.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 6d557ac013)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 09:20:14 +02:00
Bernd Kuhls
eac5d8c01d package/samba4: bump version to 4.5.8
Version bump includes a regression fix:
https://www.samba.org/samba/history/samba-4.5.8.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 67c25f897d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 09:17:16 +02:00
Peter Korsgaard
8879b99a50 ghostscript: add upstream security fixes for CVE-2017-8291
CVE-2017-8291 - Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass
and remote command execution via a "/OutputFile (%pipe%" substring in a
crafted .eps document that is an input to the gs program, as exploited in
the wild in April 2017.

For more details, see https://bugzilla.suse.com/show_bug.cgi?id=1036453

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 874becfd01)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-05-01 08:38:47 +02:00
Peter Korsgaard
60e7c1075f python-django: security bump to version 1.10.7
Fixes the following security issues:

Since 1.10.3:

CVE-2016-9013 - User with hardcoded password created when running tests on
Oracle

Marti Raudsepp reported that a user with a hardcoded password is created
when running tests with an Oracle database.

CVE-2016-9014 - DNS rebinding vulnerability when DEBUG=True

Aymeric Augustin discovered that Django does not properly validate the Host
header against settings.ALLOWED_HOSTS when the debug setting is enabled.  A
remote attacker can take advantage of this flaw to perform DNS rebinding
attacks.

Since 1.10.7:

CVE-2017-7233 - Open redirect and possible XSS attack via user-supplied
numeric redirect URLs

It was discovered that is_safe_url() does not properly handle certain
numeric URLs as safe.  A remote attacker can take advantage of this flaw to
perform XSS attacks or to use a Django server as an open redirect.

CVE-2017-7234 - Open redirect vulnerability in django.views.static.serve()

Phithon from Chaitin Tech discovered an open redirect vulnerability in the
django.views.static.serve() view.  Note that this view is not intended for
production use.

Cc: Oli Vogt <oli.vogt.pub01@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3a66a81b7a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:53:27 +02:00
Vicente Olivert Riera
75c7c53e88 linux-headers: bump 4.{4,9,10}.x series
[Peter: drop 4.10.x bump]
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 431bd936a1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:51:53 +02:00
Baruch Siach
e63c2c3566 libnl: add upstream security fix
CVE-2017-0553: An elevation of privilege vulnerability in libnl could enable a
local malicious application to execute arbitrary code within the context of
the Wi-Fi service

https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1511855.html

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5efbd573c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:43:28 +02:00
Peter Korsgaard
89300b0097 tiff: add upstream security fixes
Add upstream post-4.0.7 commits (except for ChangeLog modifications) fixing
the following security issues:

CVE-2016-10266 - LibTIFF 4.0.7 allows remote attackers to cause a denial of
service (divide-by-zero error and application crash) via a crafted TIFF
image, related to libtiff/tif_read.c:351:22.

CVE-2016-10267 - LibTIFF 4.0.7 allows remote attackers to cause a denial of
service (divide-by-zero error and application crash) via a crafted TIFF
image, related to libtiff/tif_ojpeg.c:816:8.

CVE-2016-10269 - LibTIFF 4.0.7 allows remote attackers to cause a denial of
service (heap-based buffer over-read) or possibly have unspecified other
impact via a crafted TIFF image, related to "READ of size 512" and
libtiff/tif_unix.c:340:2.

CVE-2016-10270 - LibTIFF 4.0.7 allows remote attackers to cause a denial of
service (heap-based buffer over-read) or possibly have unspecified other
impact via a crafted TIFF image, related to "READ of size 8" and
libtiff/tif_read.c:523:22.

CVE-2017-5225 - LibTIFF version 4.0.7 is vulnerable to a heap buffer
overflow in the tools/tiffcp resulting in DoS or code execution via a
crafted BitsPerSample value.

CVE-2017-7592 - The putagreytile function in tif_getimage.c in LibTIFF 4.0.7
has a left-shift undefined behavior issue, which might allow remote
attackers to cause a denial of service (application crash) or possibly have
unspecified other impact via a crafted image.

CVE-2017-7593 - tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata
is properly initialized, which might allow remote attackers to obtain
sensitive information from process memory via a crafted image.

CVE-2017-7594 - The OJPEGReadHeaderInfoSecTablesDcTable function in
tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of
service (memory leak) via a crafted image.

CVE-2017-7595 - The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7
allows remote attackers to cause a denial of service (divide-by-zero error
and application crash) via a crafted image.

CVE-2017-7598 - tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers
to cause a denial of service (divide-by-zero error and application crash)
via a crafted image.

CVE-2017-7601 - LibTIFF 4.0.7 has a "shift exponent too large for 64-bit
type long" undefined behavior issue, which might allow remote attackers to
cause a denial of service (application crash) or possibly have unspecified
other impact via a crafted image.

CVE-2017-7602 - LibTIFF 4.0.7 has a signed integer overflow, which might
allow remote attackers to cause a denial of service (application crash) or
possibly have unspecified other impact via a crafted image.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 030fe340af)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:33:20 +02:00
Peter Korsgaard
6a404f8245 icu: add upstream security fix for utf-8 handling
Fixes:

CVE-2017-7867 - International Components for Unicode (ICU) for C/C++ before
2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow
related to the utf8TextAccess function in common/utext.cpp and the
utext_setNativeIndex* function.

CVE-2017-7868 - International Components for Unicode (ICU) for C/C++ before
2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow
related to the utf8TextAccess function in common/utext.cpp and the
utext_moveIndex32* function.

Upstream: http://bugs.icu-project.org/trac/changeset/39671

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0135204868)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:32:34 +02:00
Peter Korsgaard
bc633d98ad libsndfile: security bump to version 1.0.28
Fixes:

CVE-2017-7585 - In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to cause a
stack-based buffer overflow via a specially crafted FLAC file.

CVE-2017-7586 - In libsndfile before 1.0.28, an error in the "header_read()"
function (common.c) when handling ID3 tags can be exploited to cause a
stack-based buffer overflow via a specially crafted FLAC file.

CVE-2017-7741 - In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to cause a
segmentation violation (with write memory access) via a specially crafted
FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

CVE-2017-7742 - In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to cause a
segmentation violation (with read memory access) via a specially crafted
FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

Dop undocumented patch adjusting SUBDIRS in Makefile.in as it no longer
applies.  Instead pass --disable-full-suite to disable man pages,
documentation and programs, as that was presumably the reason for the patch.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c363e070d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:31:24 +02:00
Peter Korsgaard
a1b9e5cb32 imagemagick: add upstream security fix for CVE-2017-7606
This is not yet part of any release.

coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of
representable values of type unsigned char" undefined behavior issue, which
might allow remote attackers to cause a denial of service (application
crash) or possibly have unspecified other impact via a crafted image.

For more details, see:
https://blogs.gentoo.org/ago/2017/04/02/imagemagick-undefined-behavior-in-codersrle-c/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 665560856e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:28:27 +02:00
Vicente Olivert Riera
1b8f4d29ed imagemagick: bump version to 7.0.5-4
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 49a3ed0fee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:28:14 +02:00
Vicente Olivert Riera
83e50860e7 imagemagick: bump version to 7.0.5-3
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 84bc1fb532)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:28:05 +02:00
Vicente Olivert Riera
33adae56f9 imagemagick: bump version to 7.0.5-2
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 22562f7f05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:27:58 +02:00
Peter Korsgaard
0cef3aad7b libcroco: add upstream security fixes
These have been added to upstream git after 0.6.12 was released.

CVE-2017-7960 - The cr_input_new_from_uri function in cr-input.c in libcroco
0.6.11 and 0.6.12 allows remote attackers to cause a denial of service
(heap-based buffer over-read) via a crafted CSS file.

CVE-2017-7961 - The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco
0.6.11 and 0.6.12 has an "outside the range of representable values of type
long" undefined behavior issue, which might allow remote attackers to cause
a denial of service (application crash) or possibly have unspecified other
impact via a crafted CSS file.

For more details, see:
https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 52bfb4b1ce)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:27:01 +02:00
Peter Korsgaard
32e514709f python-web2py: security bump to version 2.14.6
CVE-2016-4806 - Web2py versions 2.14.5 and below was affected by Local File
Inclusion vulnerability, which allows a malicious intended user to
read/access web server sensitive files.

CVE-2016-4807 - Web2py versions 2.14.5 and below was affected by Reflected
XSS vulnerability, which allows an attacker to perform an XSS attack on
logged in user (admin).

CVE-2016-4808 - Web2py versions 2.14.5 and below was affected by CSRF (Cross
Site Request Forgery) vulnerability, which allows an attacker to trick a
logged in user to perform some unwanted actions i.e An attacker can trick an
victim to disable the installed application just by sending a URL to victim.

CVE-2016-10321 - web2py before 2.14.6 does not properly check if a host is
denied before verifying passwords, allowing a remote attacker to perform
brute-force attacks.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a534030c6e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:25:38 +02:00
Peter Korsgaard
cf113c76df minicom: security bump to version 2.7.1
Fixes CVE-2017-7467 - minicom and prl-vzvncserver vt100.c escparms[] buffer
overflow.

For more details about the issue, see the nice writeup on oss-security:

http://www.openwall.com/lists/oss-security/2017/04/18/5

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 027a0d5b61)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:23:24 +02:00
Vicente Olivert Riera
6b671fa3b6 linux-headers: bump 4.{4,9,10}.x series
[Peter: drop 4.10.x bump]
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 37159734b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-28 14:21:09 +02:00
Jörg Krause
35f735cd5a libsamplerate: security bump to version 0.1.9
libsamplerate is relicensed under the 2 clause BSD license.

Fixes CVE-2017-7697 - In libsamplerate before 0.1.9, a buffer over-read
occurs in the calc_output_single function in src_sinc.c via a crafted audio
file.

For more details, see:
https://blogs.gentoo.org/ago/2017/04/11/libsamplerate-global-buffer-overflow-in-calc_output_single-src_sinc-c/

[Peter: add CVE info]
Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bcdaf4ca84)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-25 23:11:57 +02:00
Peter Korsgaard
392b4a6670 xen: security bump to version 4.7.2
The 4.7.2 release brings a number of bugfixes and improvements:

https://www.xenproject.org/downloads/xen-archives/xen-project-47-series/xen-472.html

Including fixes for the following security issues:

XSA-191: x86 null segments not always treated as unusable (CVE-2016-9386)
XSA-192: x86 task switch to VM86 mode mis-handled (CVE-2016-9382)
XSA-193: x86 segment base write emulation lacking canonical address checks
	 (CVE-2016-9385)
XSA-194: guest 32-bit ELF symbol table load leaking host data (CVE-2016-9384)
XSA-195: x86 64-bit bit test instruction emulation broken (CVE-2016-9383)
XSA-196: x86 software interrupt injection mis-handled
	 (CVE-2016-9377 CVE-2016-9378)
XSA-197: qemu incautious about shared ring processing (CVE-2016-9381)
XSA-198: delimiter injection vulnerabilities in pygrub
	 (CVE-2016-9379 CVE-2016-9380)
XSA-199: qemu ioport array overflow (CVE-2016-9637)
XSA-200: x86 CMPXCHG8B emulation fails to ignore operand size override
	 Files (CVE-2016-9932)
XSA-201: ARM guests may induce host asynchronous abort
         (CVE-2016-9815 CVE-2016-9816 CVE-2016-9817 CVE-2016-9818)
XSA-202: x86 PV guests may be able to mask interrupts (CVE-2016-10024)
XSA-203: x86: missing NULL pointer check in VMFUNC emulation (CVE-2016-10025)
XSA-204: x86: Mishandling of SYSCALL singlestep during emulation
         (CVE-2016-10013)
XSA-207: memory leak when destroying guest without PT devices
XSA-208: oob access in cirrus bitblt copy (CVE-2017-2615)
XSA-209: cirrus_bitblt_cputovideo does not check if memory region is safe
         (CVE-2017-2620)

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-25 17:50:51 +02:00
Peter Korsgaard
039f7d0d2f nodejs: bump 6.x version to 6.10.2
6.10.2 is the latest release in the LTS series, fixing a number of issues:

https://nodejs.org/en/blog/release/v6.10.2/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-25 17:50:39 +02:00
Peter Korsgaard
48447b9efc linux-headers: bump 3.18.x series to 3.18.50
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-25 17:50:30 +02:00
Christian Stewart
24d80453af uboot: fix target uboot defconfig warning
The warning currently reads:

  No board defconfig name specified, check your
  BR2_TARGET_UBOOT_DEFCONFIG setting.

It should read:

  No board defconfig name specified, check your
  BR2_TARGET_UBOOT_BOARD_DEFCONFIG setting.

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit b7f095920a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:50:14 +02:00
Vicente Olivert Riera
86a16f169d libcurl: bump version to 7.54.0 (security)
Security fixes:
 - CVE-2017-7468: switch off SSL session id when client cert is used

Full changelog: https://curl.haxx.se/changes.html

Removing 0001-CVE-2017-7407.patch. It's included in this release:
  1890d59905

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 034e95e51e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:49:41 +02:00
Baruch Siach
bb64a4f87e libnss: security bump to version 3.30.2
CVE-2017-5461 - Out-of-bounds write in Base64 encoding in NSS. Might cause
remote arbitrary code execution
(https://access.redhat.com/errata/RHSA-2017:1100).

CVE-2017-5462 - DRBG flaw in NSS

Drop 0001-cross-compile.patch and TARGET* variables. Upstream Makefile now
allows override of CC, so use TARGET_CONFIGURE_OPTS instead.

Drop upstream 0003-it-uninitialized-fix.patch.

Renumber the remaining patch.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 09b8e1079e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:47:46 +02:00
Baruch Siach
6736d2f604 libnspr: bump to version 4.14
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 7e1f3171ac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:47:36 +02:00
Bernd Kuhls
bce9b77e04 package/linux-headers: bump 3.12.x and 4.{4, 9, 10}.x series
[Peter: drop 4.10.x bump]
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit a96a8435d5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:46:54 +02:00
Romain Naour
892e908120 package/libunwind: disable for x86 with uClibc toolchain
libunwind use sigreturn() while building for x86 [1] but this function
is not available with uClibc-ng.

This throw a warning during libunwind build:
In file included from x86/Los-linux.c:4:0:
x86/Gos-linux.c: In function ‘_ULx86_local_resume’:
x86/Gos-linux.c:298:7: warning: implicit declaration of function ‘sigreturn’ [-Wimplicit-function-declaration]
       sigreturn (sc);
       ^

But any program trying to link against libunwind-generic.so fail to build:
[...]usr/lib/libunwind-generic.so: undefined reference to `sigreturn'
collect2: error: ld returned 1 exit status

Disable libunwind for x86 target when uClibc-ng is used.

Fixes:
http://autobuild.buildroot.net/results/54a/54afac8148cff5f3c17e83f80917fd9006948fe0//build-end.log

[1] http://git.savannah.gnu.org/gitweb/?p=libunwind.git;a=blob;f=src/x86/Gos-linux.c;h=17aebc2974af50eb0bf8292689b2ed22a4c97866;hb=HEAD#l299

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit c5b56b0a20)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:45:11 +02:00
Rahul Bedarkar
de2534bb54 which: update homepage URL
Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 8e9a990ae9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:44:17 +02:00
Bernd Kuhls
7e48857917 package/mpv: disable cuda support
mpv wrongly detects cuda being available:

Checking for CUDA hwaccel : yes

leading to build errors.

Fixes
http://autobuild.buildroot.net/results/e89/e892a537265ad7259024403a0bb3ca5da85ed096/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 030bebd7f1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 17:44:06 +02:00
Romain Naour
bac22a6f55 package/hiredis: fix install step for static build only
The previous patch [1] didn't take into acount the static build only
scenario. It tries to unconditionally install a shared library.

Handle the install step like for bzip2 package: install the shared
library only if BR2_SHARED_LIBS or BR2_SHARED_STATIC_LIBS is set and
install the static library only if BR2_STATIC_LIBS or
BR2_SHARED_STATIC_LIBS is set.

[1] 96daacb720

Fixes:
http://autobuild.buildroot.net/results/6be/6be8024dd664af83fcf49ede29c8ad59a37f73d1

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 10ffe1f65c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 16:25:59 +02:00
Matt Weber
2de0f39ed6 busybox: preserve ncurses progs/tools
The ncurses package installs a full version of clear and reset(tset)
tools.  Preserve these by disabling the options in the busybox config
file.  This removes the need for ncurses to depend on busybox for solely
ordering of target install.

This commit resolves the following python circular dependency with python.
busybox -> libselinux -> python3 -> ncurses -> busybox

Fixes:
http://autobuild.buildroot.net/results/db1/db1e6f3054092fc5576ccab8e04a3b9d74ca9a8c/

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
[Thomas: minor tweaks.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

(cherry picked from commit 33c72344a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 16:25:37 +02:00
Waldemar Brodkorb
9d1e422788 glibc: add patches to fix sh4 compile issue
Fixes:

  https://bugs.busybox.net/show_bug.cgi?id=9756

[Peter: drop 2.25.x patch]
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Thomas: rework patches as Git formatted patches, fix numbering.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 5f2cff973a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-04-24 16:24:09 +02:00