buildroot/package/file, branch 2019.02-op-build

package/file: security bump to version 5.36

2019-03-25T16:34:01+00:00

CVE-2019-8906: do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. CVE-2019-8904: do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf. Update license files hashes; removal of trailing white spaces. Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard (cherry picked from commit 14d6e6df7bcfd7d46811a812610ec87b0b249088) Signed-off-by: Peter Korsgaard

file: explicitly disable libseccomp support for host

2018-10-09T06:53:00+00:00

Fixes: http://autobuild.buildroot.net/results/8a2/8a2ea2e4426416447705492237f526fc84b595d7/ http://autobuild.buildroot.net/results/a1f/a1f2369d31c2387efdec908877e0bcaa728b5aeb/ file-5.33 added optional seccomp support, but the filters did not cover all needed syscalls, leading to errors when the freshly built host-file is executed as part of the build on distributions with seccomp support (E.G. Arch Linux): checking for seccomp_init in -lseccomp... yes .. ../src/file -C -m magic make[3]: *** [Makefile:764: magic.mgc] Bad system call This has been fixed in file-5.34, but it anyway makes sense to explicitly disable libseccomp support for consistency as we do not need it for the host build. Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni

file: bump to version 5.34

2018-09-10T15:07:11+00:00

Remove patch (already in version) Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni

file: add upstream security fix

2018-06-15T08:02:24+00:00

Fixes CVE-2018-10360: The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file. Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

package/file: bump version to 5.33

2018-06-13T20:25:19+00:00

Added license hashes, added optional dependency to libseccomp provided by upstream in this version bump. Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni

file: security bump to version 5.32

2017-09-06T19:50:19+00:00

Fixes CVE-2017-1000249 - Stack buffer overflow with a specially crafted .notes section in an ELF binary file. For more details, see: http://www.openwall.com/lists/oss-security/2017/09/05/3 Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni

file: bump version to 5.31

2017-05-26T13:15:20+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

package: use SPDX short identifier for BSD-4c

2017-04-01T13:27:17+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-4c is BSD-4-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-4c/BSD-4-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

boot, package: use SPDX short identifier for BSD-2c

2017-04-01T13:27:05+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-2c is BSD-2-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-2c/BSD-2-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

boot, package: use SPDX short identifier for BSD-3c

2017-04-01T13:26:57+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-3c is BSD-3-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-3c/BSD-3-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni