buildroot/package, branch 2017.08.1

linux-headers: bump 4.{4, 9, 13}.x series

2017-10-22T22:41:33+00:00

[Peter: drop 4.13.x bump] Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard (cherry picked from commit f7479f4c818f335332fdca128d7d4f3e5e7c02ac) Signed-off-by: Peter Korsgaard

sqlite: add security patches

2017-10-22T22:40:34+00:00

CVE-2017-13685: The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. CVE-2017-15286: SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni (cherry picked from commit d3c96bd5a6d3d64ab9c61104c6078b4bc89b12ec) Signed-off-by: Peter Korsgaard

libffi: add patch to fix MIPS support

2017-10-22T22:40:02+00:00

Building Python 3.x on MIPS with musl fails because the libffi code uses a "#ifdef linux" test to decide if we're building on Linux or not. When building with -std=c99, "linux" is not defined, so instead of including , libffi's code tries to include , which doesn't exist on musl. The right fix is to use __linux__, which is POSIX compliant, and therefore defined even when -std=c99 is used. Note that glibc and uClibc were not affected because they do provide a header in addition to the one. Signed-off-by: Mauro Condarelli [Thomas: reformat patch with Git, add a better commit log and description.] Signed-off-by: Thomas Petazzoni (cherry picked from commit 4852f05907cd365825f37c283a415a77ba1fcba9) Signed-off-by: Peter Korsgaard

xen: add upstream post-4.9.0 security fix for XSA-245

2017-10-22T22:38:31+00:00

Fixes XA-245: ARM: Some memory not scrubbed at boot https://xenbits.xenproject.org/xsa/advisory-245.html Notice: Not applying XSA-237..244 as they are x86 only and have patch file name conflicts between 2017.02.x and master. Signed-off-by: Peter Korsgaard (cherry picked from commit 90b9b457ecd5e6ebea9d48f36c030b95ca67059b) Signed-off-by: Peter Korsgaard

lame: security bump to version 3.100

2017-10-22T22:37:35+00:00

Fixes the following security issues: CVE-2017-9410: fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap CVE-2017-9411: fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash CVE-2017-9412: unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash Drop patches now upstream or no longer needed: 0001-configure.patch: Upstream as mentioned in patch description 0002-gtk1-ac-directives.patch: Upstream as mentioned in patch description/release notes: Resurrect Owen Taylor's code dated from 97-11-3 to properly deal with GTK1. This was transplanted back from aclocal.m4 with a patch provided by Andres Mejia. This change makes it easy to regenerate autotools' files with a simple invocation of autoconf -vfi. 0003-msse.patch: Not needed as -march nowadays implies -msse. With these removed, autoreconf is no longer needed. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni (cherry picked from commit 7e3583dd558925a447eaa4367d659f39482fbbc0) Signed-off-by: Peter Korsgaard

busybox: add upstream post-1.27.2 httpd fix

2017-10-22T22:36:58+00:00

Signed-off-by: Peter Korsgaard (cherry picked from commit ec58149009776f63767644f9a3409f420c271766) Signed-off-by: Peter Korsgaard

busybox: bump to version 1.27.2

2017-10-22T22:36:50+00:00

Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni (cherry picked from commit 5cdb463e442d63f0ba361e7348d0ed56cb9b63d0) Signed-off-by: Peter Korsgaard

musl: add upstream security fix for CVE-2017-15650

2017-10-22T22:35:55+00:00

>From the upstream announcement: http://www.openwall.com/lists/oss-security/2017/10/19/5 Felix Wilhelm has discovered a flaw in the dns response parsing for musl libc 1.1.16 that leads to overflow of a stack-based buffer. Earlier versions are also affected. When an application makes a request via getaddrinfo for both IPv4 and IPv6 results (AF_UNSPEC), an attacker who controls or can spoof the nameservers configured in resolv.conf can reply to both the A and AAAA queries with A results. Since A records are smaller than AAAA records, it's possible to fit more addresses than the precomputed bound, and a buffer overflow occurs. Signed-off-by: Peter Korsgaard (cherry picked from commit 209f42fd3a5f4357e22fb72f1597a6868566aabd) Signed-off-by: Peter Korsgaard

package/go: fix cross-compilation settings

2017-10-22T22:35:28+00:00

This patch fixes a bug with the BR2_TOOLCHAIN_HAS_THREADS variable handling which causes CGO_ENABLED to be always 0. Furthermore, it fixes the cross compilation options for the go compiler: setting CGO_ENABLED should be done only for the target compiler not the host one. Signed-off-by: Angelo Compagnucci Signed-off-by: Thomas Petazzoni Acked-by: Christian Stewart (cherry picked from commit 80ea21bc3c2147adf810731b0b242e94a3ad294e) Signed-off-by: Peter Korsgaard

webkitgtk: security bump to version 2.18.1

2017-10-22T22:28:04+00:00

This is a maintenance release of the current stable WebKitGTK+ version, which contains bugfixes (many of them related to rendering, plus one important fix for touch input) and many security fixes. Release notes: https://webkitgtk.org/2017/10/18/webkitgtk2.18.1-released.html Fixes CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090, CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094, CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099, CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107, CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120, CVE-2017-7142: https://webkitgtk.org/security/WSA-2017-0008.html Signed-off-by: Adrian Perez de Castro Signed-off-by: Thomas Petazzoni (cherry picked from commit 6d623e72770534c8e40e5afd7aa8fb77e49d1974) Signed-off-by: Peter Korsgaard