Peter Korsgaard [Sat, 30 Dec 2017 23:34:32 +0000 (00:34 +0100)]
nodejs: security bump to version 6.12.2
Fixes CVE-2017-15896 - Node.js was affected by OpenSSL vulnerability
CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake
failure. The result was that an active network attacker could send
application data to Node.js using the TLS or HTTP2 modules in a way that
bypassed TLS authentication and encryption.
For more details, see the announcement:
https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Romain Naour [Tue, 26 Dec 2017 13:19:21 +0000 (14:19 +0100)]
package/mfgtools: bump to 0.02
Bump mfgtools to include the fix [1] for the C++ build issue reported
by the autobuilders.
This bump include only 4 small commits fixing memory leak and this
build issue.
Remove CPOL.htm (removed upstream) from MFGTOOLS_LICENSE_FILES but CPOL
license is still valid.
Add the README.txt file to MFGTOOLS_LICENSE_FILES since it contains
licensing informations:
Licenses:
- CPOL: MfgToolLib/XmlLite.CPP and XmlLite.h
- BSD: Others.
This is a maintenance release of the current stable WebKitGTK+ version,
which contains fixes for CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, and
CVE-2017-13856. Additionally, this release brings improvements in the
WebDriver spec-compliance, plugs several memory leaks in its GStreamer based
multimedia backend, and fixes a bug when handling cookie removal.
More details about the security fixes are provided in the following
WebKitGTK+ Security Advisory report:
https://webkitgtk.org/security/WSA-2017-0010.html
Last but not least, this new release includes the fix for honoring the
CMAKE_BUILD_TYPE value from CMake toolchain files and the corresponding
patch is removed.
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fbf6a483e00a87fb561fa5fe9a423c4a14867f50) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit e7f82694cfe98f659ff08b5834e32f8996ca55c5) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Tue, 19 Dec 2017 11:56:28 +0000 (12:56 +0100)]
rsync: add upstream security fix for CVE-2017-16548
The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development
does not check for a trailing '\0' character in an xattr name, which allows
remote attackers to cause a denial of service (heap-based buffer over-read
and application crash) or possibly have unspecified other impact by sending
crafted data to the daemon.
For more details, see:
https://bugzilla.samba.org/show_bug.cgi?id=13112
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7f33f1d848908975b513f852873ae4fdb2702183) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Damien Riegel [Mon, 18 Dec 2017 21:19:35 +0000 (16:19 -0500)]
lldpd: remove check on CXX compiler
lldpd currently depends on a C++ compiler to configure properly, but
the package doesn't select that option, so builds fail if
BR2_TOOLCHAIN_BUILDROOT_CXX is not selected with following errors:
checking how to run the C++ preprocessor... /lib/cpp
configure: error: in `/home/dkc/src/buildroot/build-zii/build/lldpd-0.9.4':
configure: error: C++ preprocessor "/lib/cpp" fails sanity check
This package actually builds fine without C++, so drop this check in
configure.ac. Attached patch has already been accepted upstream [1].
Peter Seiderer [Fri, 8 Dec 2017 21:29:52 +0000 (22:29 +0100)]
gdb: prevent installation of libbfd.so and libopcode.so
The gdb install target installs dynamic versions of libbfd and
libopcode, accidentally overwriting the binutils provided versions
(gdb itself links against the bundled static ones to avoid
version problems, so the dynamic ones are un-needed).
Prevent the installation by using the '--disable-install-libbfd'
configure option.
Signed-off-by: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit b54c7931952874a814e48df75093e13ad955604f) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
CVE-2017-10378 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: Server: Optimizer). Supported versions that are affected are
5.5.57 and earlier, 5.6.37 and earlier and 5.7.11 and earlier. Easily
exploitable vulnerability allows low privileged attacker with network access
via multiple protocols to compromise MySQL Server. Successful attacks of this
vulnerability can result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of MySQL Server.
CVE-2017-10268 - Vulnerability in the MySQL Server component of Oracle MySQL
(subcomponent: Server: Replication). Supported versions that are affected are
5.5.57 and earlier, 5.6.37 and earlier and 5.7.19 and earlier. Difficult to
exploit vulnerability allows high privileged attacker with logon to the
infrastructure where MySQL Server executes to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized access to
critical data or complete access to all MySQL Server accessible data.
Signed-off-by: Ryan Coe <bluemrp9@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e299197a2c2a267d05e5ae7cb7298bce0faceb51) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Ryan Coe <bluemrp9@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit ff614db18e0b0f34a1ed14ef6bee4bae522039f4) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 1d8de10c5fb36619708898a529977058886f31d1) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For more information, see the release notes:
https://www.wireshark.org/docs/relnotes/wireshark-2.2.11.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d2bc1e2bbbabc70f2e9436387b8a40ff96216372) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Johan Oudinet [Wed, 6 Dec 2017 14:47:53 +0000 (15:47 +0100)]
flann: Disable find package for HDF5
The HDF5 package is used by flann for testing purpose only and is
not part of buildroot packages. However, if present in the host, it will
be used and trigger the unsafe header/library path used in
cross-compilation error.
Signed-off-by: Johan Oudinet <johan.oudinet@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit f6ee339e92360fc43ebe17928656c06634b09c97) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam <festevam@gmail.com>
[Thomas: adjust commit description to mention the CVE being fixed.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 9f5178fa3495b5b59c4d86c2d1a6fca23bf4e6f3) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Thu, 30 Nov 2017 00:07:01 +0000 (01:07 +0100)]
libcurl: security bump to version 7.57.0
Fixes the following security issues:
- CVE-2017-8816: NTLM buffer overflow via integer overflow
- CVE-2017-8817: FTP wildcard out of bounds read
- CVE-2017-8818: SSL out of buffer access
For more details, see the changelog:
https://curl.haxx.se/changes.html#7_57_0
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fb2ed961988867ab77c48786075e03a6110d1d0a) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Jerzy Grzegorek [Fri, 8 Dec 2017 19:39:01 +0000 (20:39 +0100)]
package/exim: change tarball compression to xz
Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7c42b5f38131ef19843301410e6e649c6173565d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Andrey Yurovsky [Tue, 28 Nov 2017 03:37:07 +0000 (19:37 -0800)]
support/scripts/size-stats: avoid divide-by-zero
Some packages (ex: skeleton-init-systemd) have a zero size so we cannot
divide by the package size. In that case make their percent zero
explicitly and avoid a ZeroDivisionError exception.
Signed-off-by: Andrey Yurovsky <yurovsky@gmail.com> Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 88af7d330dec7b6386a9994d8e53900033d85903) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Danomi Manchego [Wed, 29 Nov 2017 02:55:24 +0000 (21:55 -0500)]
samba4: ensure that copied cache.txt is writable
If the Buildroot tree is read-only, then cache.txt is copied read-only into
the build directory, and the configuration step fails. Fix this in the
same way we do in other places, by opening permissions as we copy the file
using $(INSTALL).
Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 832b2de3ba82d8b51c393f743ee86ad530829607) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
webkitgtk: Add upstream patch to ensure CMAKE_BUILD_TYPE is honored
Make WebKitGTK+ honor the value of CMAKE_BUILD_TYPE defined in the CMake
toolchain file by backporting the following upstream WebKit patch:
https://trac.webkit.org/changeset/225168
This reduces the generated binary sizes when building in "Release" mode
(BR2_ENABLE_DEBUG=n), for example when targeting ARMv8 the size reduction
is ~17 MiB.
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit a49c69862a617617d05c23e5c64ddea1c665174f) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Carlos Santos [Tue, 28 Nov 2017 16:06:51 +0000 (14:06 -0200)]
mtools: do not link to libbsd
If libbsd is found by the configuration process, mtools unnecessarily
adds a NEEDED field with libbsd to its dynamic section, but it does not
actually use anything from libbsd under Linux. The same may happen to
host-mtools if some libbsd package is installed on the host machine.
Prevent this by forcing configure to bypass the checking for the
existence of a gethostbyname function in libbsd.
I stumbled on this problem when I built host-mtools and later removed
libbsd to upgrade to Fedora 27, due to Bug 1504831[1]. The previously
built host/bin/mtools started to fail due to the missing libbsd.so.0.
Signed-off-by: Carlos Santos <casantos@datacom.ind.br> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f5ef363732fd6092b132cc21573efafea3f1d4ac) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Baruch Siach [Tue, 28 Nov 2017 15:23:21 +0000 (17:23 +0200)]
libevent: disable openssl for host
As host-libevent does not depend on host-openssl, it might attempt to
build against the host installed openssl. This does not work very well
on various hosts. Since we don't really need encryption support in
host-libevent just disable openssl support.
Disable build of example code as we already do for the target libevent.
Fabrice Fontaine [Sun, 26 Nov 2017 21:26:40 +0000 (22:26 +0100)]
linphone: add optional dependency on libupnp
linphone can optionally use libupnp, so this dependency should be
accounted for in linphone.mk. In addition, linphone is not compatible
with libupnp18, but misdetects it as a a proper libupnp, causing a
build failure.
The build failure with libupnp18 currently only happens on the next
branch (because libupnp18 has only been added there), but adding the
optional dependency on libupnp makes sense for the master branch
anyway.
Peter Korsgaard [Mon, 11 Dec 2017 09:17:22 +0000 (10:17 +0100)]
tor: security bump to version 0.2.9.14
Fixes the following securoty issues:
- CVE-2017-8819: In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before
0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before
0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion
services, aka TROVE-2017-009. An attacker can send many INTRODUCE2 cells
to trigger this issue.
- CVE-2017-8820: In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before
0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before
0.3.1.9, remote attackers can cause a denial of service (NULL pointer
dereference and application crash) against directory authorities via a
malformed descriptor, aka TROVE-2017-010.
- CVE-2017-8821: In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before
0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before
0.3.1.9, an attacker can cause a denial of service (application hang) via
crafted PEM input that signifies a public key requiring a password, which
triggers an attempt by the OpenSSL library to ask the user for the
password, aka TROVE-2017-011.
- CVE-2017-8822: In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before
0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before
0.3.1.9, relays (that have incompletely downloaded descriptors) can pick
themselves in a circuit path, leading to a degradation of anonymity, aka
TROVE-2017-012.
- CVE-2017-8823: In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before
0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before
0.3.1.9, there is a use-after-free in onion service v2 during intro-point
expiration because the expiring list is mismanaged in certain error cases,
aka TROVE-2017-013.
For more details, see the release notes:
https://lists.torproject.org/pipermail/tor-announce/2017-December/000147.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Seiderer [Tue, 21 Nov 2017 19:13:30 +0000 (20:13 +0100)]
Fix makefile include order by using sort/wildcard.
The 'include' directive in GNU make supports wildcards, but their
expansion has no defined sort order (GLOB_NOSORT is passed to glob()).
Usually this doesn't matter. However, there is at least one case where
it does make a difference: toolchain/*/*.mk includes both the
definitions of the external toolchain packages and
pkg-toolchain-external.mk, but pkg-toolchain-external.mk must be
included first.
For predictability, use ordered 'include $(sort $(wildcard ...))'
instead of unordered direct 'include */*.mk' everywhere.
Fixes [1] reported by Petr Vorel:
make: *** No rule to make target 'toolchain-external-custom', needed by '.../build/toolchain-external/.stamp_configured'. Stop.
Signed-off-by: Peter Seiderer <ps.report@gmx.net> Tested-by: Petr Vorel <petr.vorel@gmail.com>
[Arnout: also sort the one remaining include, of the external docs] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b9d2d4cb4ebc7a2290c4683dd9667b8f0a9e3cdf) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
and the perl script section_generate.pl will create both the .c and .h
files in one go, but given the construct above, there can be two such
script that run in parallel, which can clobber the generated .c and/or
.h files.
So, make dvb-apps a MAKE1 package.
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit ba6796c7ccb856fc34a7983c9ac031168f1e0b65) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Romain Naour [Wed, 22 Nov 2017 21:08:28 +0000 (22:08 +0100)]
package/google-breakpad: replace references to 'struct ucontext' with 'ucontext_t'
In glibc, since
https://sourceware.org/git/?p=glibc.git;h=251287734e89a52da3db682a8241eb6bccc050c9
the 'struct ucontext' tag has been replaced with 'struct ucontext_t'.
The tag itself is anyway not POSIX - only the 'ucontext_t' typedef is
specified. And that type has existed since at least 1997 in glibc.
Therefore, replace references to 'struct ucontext' with 'ucontext_t',
which works in all versions of glibc, uClibc and musl.
Peter Seiderer [Mon, 20 Nov 2017 18:36:58 +0000 (19:36 +0100)]
localedef: fix xlocale.h related compile failure
Add upstream patch 'Don't include <xlocale.h>'.
Fixes Bug-10501 ([1]):
In file included from ./include/locale.h:1:0,
from /usr/include/libintl.h:103,
from ./include/libintl.h:2,
from glibc/locale/programs/charmap.c:25:
glibc/locale/locale.h:146:11: fatal error: xlocale.h: No such file or directory
# include <xlocale.h>
Signed-off-by: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit d5cc76c5314f58fa18001e9abce196c1ac4a28d1) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Sat, 25 Nov 2017 23:30:09 +0000 (00:30 +0100)]
samba4: security bump to version 4.5.15
Fixes the following security issues:
- CVE-2017-14746:
All versions of Samba from 4.0.0 onwards are vulnerable to a use after
free vulnerability, where a malicious SMB1 request can be used to
control the contents of heap memory via a deallocated heap pointer. It
is possible this may be used to compromise the SMB server.
- CVE-2017-15275:
All versions of Samba from 3.6.0 onwards are vulnerable to a heap
memory information leak, where server allocated heap memory may be
returned to the client without being cleared.
There is no known vulnerability associated with this error, but
uncleared heap memory may contain previously used data that may help
an attacker compromise the server via other methods. Uncleared heap
memory may potentially contain password hashes or other high-value
data.
For more details, see the release notes:
https://www.samba.org/samba/history/samba-4.5.15.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Thomas Petazzoni [Fri, 17 Nov 2017 15:14:16 +0000 (16:14 +0100)]
libfastjson: indicate explicitly which gcc -std option to use
This commit fixes the following build issue of libfastjson with old
enough compilers (4.8) and wchar disabled:
json_object.c: In function 'fjson_object_object_delete':
json_object.c:385:3: error: 'for' loop initial declarations are only allowed in C99 mode
for (int i = 0 ; i < FJSON_OBJECT_CHLD_PG_SIZE ; ++i) {
^
The code of libfastjson requires C99. If your compiler is recent
enough (gcc 5.x), then no problem, it is C99 by default, no additional
flags are needed.
If your compiler is older (for example gcc 4.8), then -std=c99 or
-std=gnu99 is explicitly needed to tell the compiler to accept C99
constructs. Testing the compiler for the availability of such flags is
done by libfastjson configure script. However, the test program used
by the configure script uses some wchar_t types, and therefore the
test checking for C99 availability fails on toolchains with wchar
disabled. From config.log:
configure:3928: checking for /home/test/buildroot/output/host/usr/bin/i586-buildroot-linux-uclibc-gcc option to accept ISO C99
[...]
configure:4077: /home/test/buildroot/output/host/usr/bin/i586-buildroot-linux-uclibc-gcc -std=gnu99 -c -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 conftest.c >&5
conftest.c:54:3: error: unknown type name 'wchar_t'
const wchar_t *name;
^
So, just like we did in libv4l in commit f01396a158f14c53b781c35f7ff29da0bea8c8d6 ("libv4l: fix uclibc-ng
configure/compile"), let's hint directly the configure script that it
should use -std=gnu99. This fixes the build of libfastjson with old
compilers and wchar disabled.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 90430237ccdcc369d3e206fdd24266c0cad0dcb6) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Thu, 16 Nov 2017 14:23:04 +0000 (15:23 +0100)]
qt5webkit: correct download URL and hash for 5.6 variant
Commit 06a4975d4bd03 (qt5: bump LTS version to 5.6.3) added an empty hash
for the 5.6.3 variant of qt5webkit, causing failures.
It also forgot to adjust the download URL as the qt5webkit tarballs are no
longer available under official_releases/ like the other submodules, but only
under community_releases/.
Fix both issues.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d4a119ccc42f5b93a2e33f99438a86cc5ee1fb00) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Adam Duskett [Tue, 14 Nov 2017 14:42:03 +0000 (09:42 -0500)]
libpjsip: fix ssl support
Currently, ssl support is implicitely disabled in the initial configure
options. This overrides the check for openssl below.
libpjsip is also currently only compatible with libopenssl. Change
the check to LIBOPENSSL instead of openssl, and depend on libopenssl.
[Peter: drop libopenssl change] Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 9e479e65dcf1582b20433ca1b120efb66e806a04) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Bernd Kuhls [Mon, 13 Nov 2017 19:23:49 +0000 (20:23 +0100)]
package/x11r7/xapp_xdriinfo: fix libgl dependency
Fixes
"mesa3d is in the dependency chain of xapp_xdriinfo that has added it
to its _DEPENDENCIES variable without selecting it or depending on it
from Config.in."
http://autobuild.buildroot.net/results/d8a/d8aeed2f64e21a277eb0bc5dc08d2339a14c682e/
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6d97e73257ffb9fddb8a57dc8d2933b79b86f4b0) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Luca Ceresoli [Sat, 11 Nov 2017 23:06:31 +0000 (00:06 +0100)]
libpjsip: fix static build failures due to name clash
Several packages have a similar md5.c file, and each has a function
named byteReverse(). This generates link errors when building
statically ("multiple definition of `byteReverse'").
Fix by applying a patch from upstream:
https://trac.pjsip.org/repos/changeset/5688
Peter Korsgaard [Sun, 12 Nov 2017 13:43:11 +0000 (14:43 +0100)]
ruby: security bump to version 2.4.2
Fixed the following security issues:
CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf
CVE-2017-10784: Escape sequence injection vulnerability in the Basic
authentication of WEBrick
CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode
CVE-2017-14064: Heap exposure in generating JSON
For more details, see the release notes:
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-4-2-released/
Drop now upstreamed rubygems patches and add hashes for the license files
while we're at it.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f2c353054111b0398399ba1933a47d34441c875e) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Alex Suykov [Tue, 7 Nov 2017 10:17:15 +0000 (12:17 +0200)]
vboot-utils: fix ARCH detection
The package includes some target-specific code that is irrelevant
in a host package but gets built anyway. The target for this code
must be one of the supported ChromeOS targets.
Supplied Makefile apparently relies on the environment to provide
a valid target, with a simple fallback to host arch. This breaks
the build if no value is provided and the host arch is not among
the supported ones.
Signed-off-by: Alex Suykov <alex.suykov@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit bbb25c3ad7b66e6882508e49028d1739732bca34) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Adam Duskett [Wed, 8 Nov 2017 12:00:33 +0000 (07:00 -0500)]
snmp++: security bump to v3.3.10
>From the changelong:
Set the FD_CLOEXEC flag on sockets, so they are not "leaked" to
spawned processes
Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 6be1631bf27cb0d2aa6ddcbad835d614f33698e6) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Andrey Smirnov [Tue, 7 Nov 2017 20:04:42 +0000 (12:04 -0800)]
package/collectd: Specify FP layout based on endianness
Big-endian CPUs store floating point as big endian (at lest majority
of them do), so, in order for 'network' plugin to work correctly (and
potentially any user of htond() in collectd's codebase),
--with-fp-layout=endianflip as opposed to --with-fp-layout=nothing
needs to be specified during configuration phase.
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: Arnout Vandecappelle <arnout@mind.be> Cc: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Reviewed-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit bdd8475b90fa46644149d34bf852b213ec60ce71) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Sat, 11 Nov 2017 10:44:56 +0000 (11:44 +0100)]
postgresql: security bump to version 9.6.6
Fixes the following security issues:
CVE-2017-12172: Start scripts permit database administrator to modify
root-owned files.
CVE-2017-15098: Memory disclosure in JSON functions.
CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT
privileges.
See the announcement for more details:
https://www.postgresql.org/about/news/1801/
While we're at it, also add a hash for the license file.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit b97353f2b50add10971e8477ad0b4cede9244578) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This is a maintenance release of the current stable WebKitGTK+ version,
which contains a minor rendering fix, another for the WebDriver
implementation, and security fixes for CVE-2017-13798, CVE-2017-13788,
and CVE-2017-13803.
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5ff18880e9647e446a3d720b7c6c74eed97ef0b4) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Adam Duskett [Thu, 9 Nov 2017 21:51:47 +0000 (16:51 -0500)]
libpjsip: security bump to 2.7.1
Also add hash for license file
See release notes for details:
https://trac.pjsip.org/repos/milestone/release-2.7.1
Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4bdc4e492ba75d34d859ca15f0c21ec8078785fc) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Adam Duskett [Fri, 13 Oct 2017 02:42:17 +0000 (22:42 -0400)]
libpjsip: bump to 2.7
Signed-off-by: Adam Duskett <Adamduskett@outlook.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 0f6dacb37a4e97c7acea59ea7ccda932512e3ff9) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: André Hentschel <nerv@dawncrow.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 708316f49fd08170e75d9c9eab61a4b3b1280bc9) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
g_cclosure_marshal_VOID__VOID is defined both in libgobject.a and
libgstreamer.a. It is probably possible to fix this, but gstreamer0.10
has been deprecated for a long time now and is anyway unlikely to be
used in static-only situations, so let's just require dynamic linking.
Propagate to the reverse dependencies. opencv3 already did depend on
dynamic libs.
[Peter: add autobuild reference] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0eee5465e51229c4c17d7930ca2095caace4f8d2) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: André Hentschel <nerv@dawncrow.de> Reviewed-by: André Hentschel <nerv@dawncrow.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4013f11a5b71f238b36f45dcdeb46b7f7a01e600) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Thomas Petazzoni [Tue, 17 Oct 2017 19:46:48 +0000 (21:46 +0200)]
libglib2: needs autoreconf
Patch 0002-disable-tests.patch modifies Makefile.am, so we have to
autoreconf. It hasn't been seen until now, but becomes very clear
since the bump of automake to 1.15.1, as we're seeing build failures
such as:
configure.ac:66: error: version mismatch. This is Automake 1.15.1,
configure.ac:66: but the definition used by this AM_INIT_AUTOMAKE
configure.ac:66: comes from Automake 1.15. You should recreate
configure.ac:66: aclocal.m4 with aclocal and run automake again.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 45fbec12e79dfd8416b20afa4c2590aecd3ddc5d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This version bump fixes
* CVE-2017-6440
* CVE-2017-6439
* CVE-2017-6438
* CVE-2017-6437
* CVE-2017-6436
* CVE-2017-6435
* CVE-2017-5836
* CVE-2017-5835
* CVE-2017-5834
* CVE-2017-5545
* CVE-2017-5209
... and several others that didn't receive any CVE (yet).
The dependency to libxml2 was removed.
Autoreconf is not needed anymore, the upstream tarball includes a
configure script.
[Peter: also drop host-pkgconf dependency, only used for cython] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4c3820248761c279e3c8f9839e5b24c8b39891fd) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Thu, 2 Nov 2017 10:45:19 +0000 (11:45 +0100)]
luajit: only available on x86(-64) hosts
The -m32 compiler flag is used for 32bit builds and host-luajit has
limited architecture support. Building for a 32-bit target on a 32-bit
host should always work, but we haven't tested that and it's very
unlikely that someone needs it. So just limit to x86(-64) hosts.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Arnout: clarify that it might work on 32-bit hosts for a 32-bit target] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9b9347ee9f8e531dd177b437e8ea5387e29fc35e) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Matt Weber [Wed, 18 Oct 2017 16:55:23 +0000 (11:55 -0500)]
python-config.sh: don't reassign ${prefix}
When prefix is set to a path like /usr during crossbuild
the sed operations end up executing twice, once for the prefix
reassignment and another for includedir if it is set as a string
including the ${prefix} variable. This results in an issue
when the build directory is under /usr.
This patch updates the remaining location which uses the prefix
variable to also sed and update to use the real path.
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
[Arnout: refer to autobuild failures that still exist] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 04d1699ba4cecaa77f688b4effbcac5e84419b15) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Yann E. MORIN [Sun, 5 Nov 2017 09:14:56 +0000 (10:14 +0100)]
core/reproducible: do not override SOURCE_DATE_EPOCH
SOURCE_DATE_EPOCH is currently forcibly set (to either the git commit
date, or the last release date).
However, the spec mandates that it should not be modified if already
set: https://reproducible-builds.org/specs/source-date-epoch/
Build systems MUST NOT overwrite this variable for child
processes to consume if it is already present.
Abide by the rule, and only set it if not already set.
This will allow users to pass it from an upper-layer buildsystem (e.g. a
jenkins or gitlab-ci job, for example), when they have a reson to do so.
Reported-by: Peter Korsgaard <peter@korsgaard.com> Reported-by: Einar Jón Gunnarsson <tolvupostur@gmail.com> Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Peter Korsgaard <peter@korsgaard.com> Cc: Einar Jón Gunnarsson <tolvupostur@gmail.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: Arnout Vandecappelle <arnout@mind.be> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0437d2f8f6ef8c10b529c154f4534453ce34607b) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Matt Weber [Tue, 31 Oct 2017 06:18:34 +0000 (01:18 -0500)]
argp-standalone: fix build with gcc 7.x
Back in commit a662ff7e79630ca0875dd8529fe54db27a275007
("package/argp-standalone: Fix build with c99 compilers"), we fixed
the build of argp-standalone with compilers defaulting to C99 inline
semantics, i.e starting from gcc 5.x.
This was done as part of a patch that used "inline" instead of "extern
inline". However, using "inline" once again broke the build with gcc
7.x. To fix this, revert back to using just "extern inline" (hence
removing a patch of patch 0003-fix_build_with_c99_compilers.patch) and
instead use -fgnu89-inline in the CFLAGS.
See https://gcc.gnu.org/gcc-5/porting_to.html for more details.
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
[Thomas: also drop the patch of
0003-fix_build_with_c99_compilers.patch that is no longer needed.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit f0b65bd90ce4429d6b7e952ce7de2d5f92a2dd26) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Mon, 30 Oct 2017 21:53:09 +0000 (22:53 +0100)]
quagga: add upstream security fix for CVE-2017-16227
>From the advisory:
http://www.openwall.com/lists/oss-security/2017/10/30/4
It was discovered that the bgpd daemon in the Quagga routing suite does
not properly calculate the length of multi-segment AS_PATH UPDATE
messages, causing bgpd to drop a session and potentially resulting in
loss of network connectivity.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit d77d7220a7ced8daa89e3e0aa0090a4e60074001) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The configure script checks for getpagesize() and sets HAVE_GETPAGESIZE in
config.h, but bsd-getpagesize.c forgot to include includes.h (which
indirectly includes config.h) so the checks always fails, causing linker
issues when linking statically on systems with getpagesize().
Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit cc856401e8ac6a2c7a8767737b73dde933a5798a) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Adam Duskett [Wed, 21 Jun 2017 20:30:57 +0000 (16:30 -0400)]
apr: bump version to 1.6.2
Signed-off-by: Adam Duskett <aduskett@codeblue.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit d56868011b521df802cd171b4f39e56120585396) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 06a4975d4bd030ab3cf291d18fa36a39cb58cc89) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
projects / coffee / buildroot.git / log