buildroot/package, branch 2016.02

slang: fix static link with readline

2016-03-01T20:00:50+00:00

slang forgets to link with ncurses that is a dependency of readline when linking the slsh binary. Correct this. While at it, also make sure to use staging ncurses5-config script and not the host one. slang uses ncurses5-config to find terminfo location, and only staging ncurses5-config provides the correct run-time location. Fixes: http://autobuild.buildroot.net/results/1dc/1dc52048254c32a24070fef1c1039cebb32e7ac1/ http://autobuild.buildroot.net/results/c17/c176511cbb147c2d8cb0ec0ff3c1612ce8971cb8/ http://autobuild.buildroot.net/results/78d/78dc2ba07b1d7f888aab94e223f3e0b1a1df3af5/ Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

heirloom-mailx: disable SSLv2 support

2016-03-01T19:53:29+00:00

Now that openssl has dropped SSLv2 support from the latest security bump we need to patch it out here as well. Fixes: http://autobuild.buildroot.net/results/dab/dab1629cfcb5cb33706d0c762dba57baa43299a5/ Patch status: debian upstream. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

tn5250: don't reference SSLv2/v3 functions if openssl is built without them

2016-03-01T18:52:49+00:00

Fixes: http://autobuild.buildroot.net/results/83e/83e29482cad6adef18a0e97bc8e75df302467dbb/ The recent openssl security bump disabled SSLv2 support, but tn5250 was still referencing SSLv2 functions breaking the build. Include a patch from OpenBSD to only reference the SSLv2 / SSLv3 symbols if openssl is built with support for them. Signed-off-by: Peter Korsgaard

python-m2crypto: don't reference SSLv2 functions if openssl is built without SSLv2 support

2016-03-01T17:13:58+00:00

Fixes: http://autobuild.buildroot.net/results/018/0183ba8c9fccc87f9e72279c49c2fdc1a9fcb556/ The recent openssl security bump disabled SSLv2 support, but python-m2crypto was still referencing SSLv2 functions causing undefined symbols when the module was imported. Backport an upstream patch to only reference these symbols if openssl is built with SSLv2 support. Signed-off-by: Peter Korsgaard

imx-gpu-viv: fix build dependencies when linking against libGAL.so

2016-03-01T16:46:52+00:00

Packages like QT5 Base with OpenGL and X support link against libGAL.so at build time. This results in an error because some X functions used in libGAL.so aren't referenced as the libXdamage, libXext and libXfixes packages aren't built and installed into sysroot at the time. Fix this by adding these three packages as build dependencies of imx-gpu-viv. Signed-off-by: Antoine Tenart Acked-by: Thomas Petazzoni Signed-off-by: Peter Korsgaard

openssl: security bump to version 1.0.2g

2016-03-01T14:48:08+00:00

Fixes: CVE-2016-0800 - Cross-protocol attack on TLS using SSLv2 (DROWN) CVE-2016-0705 - Double-free in DSA code CVE-2016-0798 - Memory leak in SRP database lookups CVE-2016-0797 - BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption CVE-2016-0799 - Fix memory issues in BIO_*printf functions CVE-2016-0702 - Side channel attack on modular exponentiation Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

zsh: use the correct target pcre-config

2016-03-01T11:48:29+00:00

zsh configure script mis-detects the location of pcre-config, and may use that of host-pcre or that of the host instead of the target. Make configure use the correct pcre-config. Thanks to Thomas Petazzoni for pointing me at the right direction. Fixes: http://autobuild.buildroot.net/results/b12/b12aadf3016dab0941cae780fa9ee7bf9be8fcda/ http://autobuild.buildroot.net/results/8e8/8e8b12dbca4ef8cac2e5f33cd3cdcddd8e849840/ http://autobuild.buildroot.net/results/473/473197ec8e323ea7ae0e29e6363525dc42f9da2c/ Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

sox: disable SSP when using MIPS Codescape toolchains

2016-03-01T10:30:34+00:00

MIPS Codescape toolchains don't support stack-smashing protection despite of using glibc, therefore we see failures like this one: mips-img-linux-gnu/bin/ld: cannot find -lssp Fixes: http://autobuild.buildroot.net/results/957/95721f7b88c46a20202fb02e408817097df965c3/ Signed-off-by: Vicente Olivert Riera Signed-off-by: Peter Korsgaard

libfcgi:add security patch for CVE-2012-6687

2016-03-01T10:18:27+00:00

Fix-CVE-2012-6687 - remote attackers cause a denial of service (crash) via a large number of connections (http://www.cvedetails.com/cve/CVE-2012-6687/). use poll in os_unix.c instead of select to avoid problem with > 1024 connections. The patch libfcgi_2.4.0-8.3.debian.tar.xz is taken from the below link: (https://launchpad.net/ubuntu/+source/libfcgi/2.4.0-8.3) The next release of libfcgi is 2.4.1 which may have this fix is yet to be released officially. Signed-off-by: Niranjan Reddy Signed-off-by: Peter Korsgaard

linux-headers: fix circular dependency when HEADERS_AS_KERNEL is used

2016-03-01T08:43:37+00:00

The linux-headers -> linux dependency causes a circular dependency, breaking the source/legal-info/graph-depends/.. targets: make graph-depends Getting targets Getting dependencies for ['toolchain-buildroot', 'toolchain', 'busybox', 'glibc', 'initscripts', 'linux-headers', 'skeleton', 'linux', 'host-fakeroot', 'host-makedevs', 'rootfs-cpio', 'rootfs-initramfs'] Getting dependencies for ['host-kmod', 'host-gcc-final', 'host-gcc-initial', 'host-gawk'] Getting dependencies for ['host-gmp', 'host-binutils', 'host-pkgconf', 'host-mpfr', 'host-mpc'] Getting dependencies for ['host-m4'] Recursion detected for : toolchain which is a dependency of: linux which is a dependency of: linux-headers which is a dependency of: glibc which is a dependency of: host-gcc-final which is a dependency of: toolchain-buildroot which is a dependency of: toolchain Makefile:721: recipe for target 'graph-depends' failed make: *** [graph-depends] Error 1 Fix it by instead duplicating in linux-headers the 10-20 lines of linux.mk logic that infer the _SOURCE/_SITE/_VERSION from the BR2_LINUX_KERNEL_* variables. This does mean that we extract the kernel sources twice though. [Peter: use same git/hg tarball as linux kernel to not clone twice, minor fixes] Signed-off-by: Thomas Petazzoni Signed-off-by: Peter Korsgaard