buildroot, branch 2016.11.1

Update for 2016.11.1

2016-12-29T20:54:33+00:00

Signed-off-by: Peter Korsgaard

CHANGES: update for 2016.11.1

2016-12-29T20:41:23+00:00

Signed-off-by: Peter Korsgaard

cryptopp: fixup DOS newlines in CVE-2016-9939 patch

2016-12-29T20:34:53+00:00

The patch did contain the correct newlines, but they got stripped by patchwork so now the patch no longer applies. Signed-off-by: Peter Korsgaard (cherry picked from commit 9f57959147377e5ee13451a9d5fe6ba002aa20a5)

cryptopp: add upstream security fix for CVE-2016-9939

2016-12-29T20:34:46+00:00

Fixes security issue (DoS) in Crypto++ ASN1 decoder: https://github.com/weidai11/cryptopp/issues/346 Signed-off-by: Peter Korsgaard (cherry picked from commit 222808a4b678aca0da01cc96f543079f06613554)

exim: security bump to 4.87.1

2016-12-28T22:58:58+00:00

No features are added or removed. This release contains just a fix for CVE-2016-9963 - Fix CVE-2016-9963 - Info leak from DKIM. When signing DKIM, if either LMTP or PRDR was used for delivery, the key could appear in logs. Additionally, if the experimental feature "DSN_INFO" was used, it could appear in DSN messages (and be sent offsite). Signed-off-by: Peter Korsgaard (cherry picked from commit 62f0195119187449e6f037b3d0f753de855752ae)

libcurl: security bump to 7.52.1

2016-12-23T21:57:06+00:00

Fixes CVE-2016-9594 - Unitilized random Libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. Signed-off-by: Peter Korsgaard (cherry picked from commit 72b6bf8f57569c14238d223bb6cc6fec7fd3af4d)

package/python: security bump version to 2.7.13

2016-12-23T21:56:51+00:00

Rebased patches 004 & 010. Changelog: https://hg.python.org/cpython/raw-file/v2.7.13/Misc/NEWS Fixes CVE-2016-2183 & CVE-2016-1000110. This bump also fixes the host build with openssl 1.1.0, http://patchwork.ozlabs.org/patch/696139/ is not needed anymore. Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard (cherry picked from commit 5df0bfa9a0f36c6533e95621363d004bd36785fa)

package/apache: security bump version to 2.4.25

2016-12-23T21:56:37+00:00

Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.25 Fixes CVE-2016-8740, CVE-2016-5387, CVE-2016-2161, CVE-2016-0736, CVE-2016-8743. Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard (cherry picked from commit 68af1dc2575888863ae0015b09555a5e42a5d56c)

libcurl: security bump to 7.52.0

2016-12-23T21:56:26+00:00

Fixes CVE-2016-9586 - printf floating point buffer overflow For details, see: https://curl.haxx.se/docs/adv_20161221A.html Signed-off-by: Peter Korsgaard (cherry picked from commit 0c5beb6501707dd5cb80484562bf2b0cbe2b4423)

package/monit: security bump to version 5.20.0

2016-12-23T21:56:17+00:00

Fixes CVE-2016-7067. Note that since version 5.20.0 monit optionally depends on zlib. Signed-off-by: Jörg Krause Signed-off-by: Peter Korsgaard (cherry picked from commit 0bf7c74e1551a64ab3164f374304154b21bc5045)