summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* linux-headers: bump to 4.15 kernel versionFabio Estevam2018-01-291-2/+11
| | | | | | | Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 79df9ad59912eac38d5a7fe5a5dd4f11314a138e) Signed-off-by: Joel Stanley <joel@jms.id.au>
* toolchain: add 4.15.x choice for headersFabio Estevam2018-01-292-0/+9
| | | | | | | Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit ea0f6e8f06be4e405b1610b0e2dbde70c1d5d80a) Signed-off-by: Joel Stanley <joel@jms.id.au>
* Merge tag '2017.11.2' into 2017.11-op-buildJoel Stanley2018-01-29112-300/+910
|\ | | | | | | Release 2017.11.2
| * Update for 2017.11.22017.11.2Peter Korsgaard2018-01-212-2/+37
| | | | | | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/xen: Force disable SDL for xen-qemu buildAlistair Francis2018-01-211-0/+1
| | | | | | | | | | | | | | | | | | | | Fixes autobuilder issue: http://autobuild.buildroot.net/results/8bcb80dc93d38bb38ca32ad93d52c22d1176d57e/ Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit a5dd72181e1a79ffe65c788a2c1db9acdf6aa933) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * rpcbind: Backport fixes to memory leak security fixEd Blake2018-01-212-0/+129
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 954509f added a security fix for CVE-2017-8779, involving pairing all svc_getargs() calls with svc_freeargs() to avoid a memory leak. However it also introduced a couple of issues: - The call to svc_freeargs() from rpcbproc_callit_com() may result in an attempt to free static memory, resulting in undefined behaviour. - A typo in the svc_freeargs() call from pmapproc_dump() causes NIS (aka ypbind) to fail. Backport upstream fixes for these issues to version 0.2.3. Signed-off-by: Ed Blake <ed.blake@sondrel.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 5a9a95d0eb15c189f1361c12c105eb0ba8842c77) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * iputils: fix ping and traceroute6 executable permissionsEinar Jon Gunnarsson2018-01-211-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | The iputils executables are installed without the setuid bit set, which prevents some programs from working. This patch adds a permission table to fix the permissions of the ping and traceroute6 executables. Signed-off-by: Einar Jon Gunnarsson <tolvupostur@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit b0e2d00289eeb1a7201ba49e5cedfd3175f92140) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * toolchain/toolchain-external: libatomic should also be copied for musl ↵Thomas Petazzoni2018-01-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | toolchains libatomic, like libgcc_s, is provided by gcc, so there is no reason to copy it over only for the glibc and uclibc cases, it should also be copied for the musl case. Without this, a program linked with libatomic on a musl system will fail to run due to the missing library. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit ece9385523351d20e314bddc1f277aef8de7fb40) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 4.{4, 9, 14}.x seriesFabio Estevam2018-01-211-2/+2
| | | | | | | | | | | | | | | | [Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit f8fc447c20745bf851ceba8ac0963439103acb0e) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * bind: security bump to version 9.11.2-P1Peter Korsgaard2018-01-212-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issue: CVE-2017-3145: Improper sequencing during cleanup can lead to a use-after-free error, triggering an assertion failure and crash in named. For more details, see the advisory: https://lists.isc.org/pipermail/bind-announce/2018-January/001072.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit d72a2b9247d885c4fc5c2ca6066d3ae6a27a8653) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-firmware: fix install for Chelsio T[45]Ricardo Martincoski2018-01-161-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | It's broken since 1c9846ec "linux-firmware: Bump to the latest version" Fix it by updating the name of the file to install. Do not use * since it would install also old versions that would take 1MB extra space in the target. Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com> Cc: Peter Korsgaard <peter@korsgaard.com> Cc: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * support/kconfig: apply upstream nconfig ncurses/ncursesw fixGuillermo A. Amaral2018-01-163-1/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Buildroot's "make nconfig" command stopped working a while ago on Gentoo systems. Running the command would result in a crash. The issue is caused by lxdialog's cflags which are also used to build nconfig; It would detect *ncursesw* and turn on WIDECHAR support -- but the Makefile would still link to plain *ncurses* while building nconfig (which was built without WIDECHAR support). This would cause a crash after using *wattrset* on a WINDOW instance. WIDECHAR *wattrset* would try to set the _color member in the WINDOW struct which does not exist in the NON-WIDECHAR ncurses instance. It would end up clobbering data outside the struct (usually _line entries). An upstream patch fixes the issue, so we're applying it to Buildroot's kconfig. Signed-off-by: Guillermo A. Amaral <g@maral.me> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 8aa4ee2b02abe2a04b15ee3ef53887ade9a4afc4) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/ti-cgt-pru: bump to 2.2.1Romain Naour2018-01-162-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | See: http://www.ti.com/tool/download/PRU-CGT-2-2 The ti-cgt-pru v2.1.x installer are affected by a bug with recent distribution (Fedora 27 and Ubuntu 17.10) using kernel 4.13 or 4.14 with a glibc 2.26. The installer is stuck in a futex(wait) system call. While at it, add license hash. Fixes: http://autobuild.buildroot.net/results/68f/68f60ad38d9b6eae83b5d233966616a25d8c9391 Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Ash Charles <ash.charles@savoirfairelinux.com> Cc: Matthew Weber <matthew.weber@rockwellcollins.com> Tested-by: Matt Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 0e162b932d67668a4f075da803efb62b01ec917d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * system: only expose getty options for busybox and sysvinitThomas Petazzoni2018-01-161-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Only busybox and sysvinit handle the BR2_TARGET_GENERIC_GETTY_TERM and BR2_TARGET_GENERIC_GETTY_OPTIONS options; the other init systems do not. So, protect those options behind appropriate dependencies on busybox or sysvinit. Fixes #10301. Reported-by: Michael Heinemann <posted@heine.so> Suggested-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 5e23eb5da7b3848cc6b317af9d8c23aac3a13260) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * mcookie: correct wrong memset argumentPeter Korsgaard2018-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #10216 Building mcookie generates a warning about possible wrong arguments to memset: mcookie.c:207:26: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess] memset(ctx, 0, sizeof(ctx)); /* In case it's sensitive */ ctx is a pointer to a structure, so the code should use the size of the structure and not the size of the pointer when it tries to clear the structure, similar to how it got fixed upstream back in 2009: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/commit/lib/md5.c?id=6596057175c6ed342dc20e85eae8a42eb29b629f Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 40f4191f2a1246b792ffc0c02b6c9bd2d62649f2) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * lz4: install programs as well as librariesThomas Petazzoni2018-01-161-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to commit 8ad38a4fc2007df4bee9a941aed46c8771b6a84c ("package/lz4: bump version to r131"), the lz4 package was installing both libraries and programs, but this commit changed the behavior to only install libraries. The contributor might have been confused by the fact that the build command was "$(MAKE) ... -C $(@D) liblz4", suggesting that only the library was built. But since the install command was "$(MAKE) ... -C $(@D) install", the programs were effectively built as part of the install step, and installed as well. Since it makes sense for lz4 to also installs its programs, this commit adjusts the package accordingly. It is worth mentioning that using the "all" target during the build step is important. Indeed, otherwise the programs/Makefile has a "default" target that doesn't build everything (especially the lz4c program) and it end up being built as part of the install step, due to how the makefile dependencies are handled in the lz4 project. To make sure that everything gets built during the build step, we explicitly use the "all" target. Fixes bug #9996 Reported-by: Jamin Collins <jamin.collins@gmail.com> Initial-analysis-by: Arnout Vandecappelle <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 6f1c11f79a64387c1f1749550804f8aae0cfa7a7) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * busybox: don't remove S01logging when CONFIG_SYSLOGD is disabledThomas Petazzoni2018-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current busybox.mk explicitly removes S01logging if CONFIG_SYSLOGD is disabled in the Busybox configuration. However: - This causes the removal of the S01logging script potentially installed by another package (currently syslog-ng, rsyslog and sysklogd can all install a S01logging script). - We generally don't try to clean-up stuff that we may have installed in a previous make invocation and that is no longer needed following a configuration change. Fixes bug #10176 Reported-by: Karl Krach <mail@kkrach.de> Fix-provided-by: Karl Krach <mail@kkrach.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 84e835ea9261b3e844f1a18489dd89253e3eb839) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/kmsxx: don't install static libraries when BR2_SHARED_STATIC_LIBS=yThomas Petazzoni2018-01-161-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The kmsxx build system can only build either shared libraries *or* static libraries, not both. Therefore, the build currently fails when BR2_SHARED_STATIC_LIBS=y because we try to install the static libraries, that haven't been built. We fix this by not installing the static libraries when BR2_SHARED_STATIC_LIBS=y, making BR2_SHARED_STATIC_LIBS=y essentially the same as BR2_SHARED_LIBS=y for this package. Fixes bug #10331. Reported-by: Frederic MATHIEU <frederic.mathieu@dualis.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 28d5ca9c96f5144e86fac7ec6485fa5634cd6e97) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/avahi: fix typo in avahi_tmpfiles.confThomas Petazzoni2018-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | There is an obvious typo in avahi_tmpfiles.conf: avahi-autoipd is badly spelled. Fixes bug #10641. Reported-by: Michael Heinemann <posted@heine.so> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit c427ce4d9f54d9b6433969ecb0fc8a4a5a9ba9b5) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/intel-microcode: security bump to version 20180108Bernd Kuhls2018-01-162-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Quoting releasenote: "Intel Processor Microcode Package for Linux 20180108 Release -- Updates upon 20171117 release -- IVT C0 (06-3e-04:ed) 428->42a SKL-U/Y D0 (06-4e-03:c0) ba->c2 BDW-U/Y E/F (06-3d-04:c0) 25->28 HSW-ULT Cx/Dx (06-45-01:72) 20->21 Crystalwell Cx (06-46-01:32) 17->18 BDW-H E/G (06-47-01:22) 17->1b HSX-EX E0 (06-3f-04:80) 0f->10 SKL-H/S R0 (06-5e-03:36) ba->c2 HSW Cx/Dx (06-3c-03:32) 22->23 HSX C0 (06-3f-02:6f) 3a->3b BDX-DE V0/V1 (06-56-02:10) 0f->14 BDX-DE V2 (06-56-03:10) 700000d->7000011 KBL-U/Y H0 (06-8e-09:c0) 62->80 KBL Y0 / CFL D0 (06-8e-0a:c0) 70->80 KBL-H/S B0 (06-9e-09:2a) 5e->80 CFL U0 (06-9e-0a:22) 70->80 CFL B0 (06-9e-0b:02) 72->80 SKX H0 (06-55-04:b7) 2000035->200003c GLK B0 (06-7a-01:01) 1e->22" Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 19ab5952fafb6cb3d9ae00efec362fcebac5df99) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/intel-microcode: bump version to 20171117Bernd Kuhls2018-01-162-3/+4
| | | | | | | | | | | | | | | | | | Added license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 6d2d6cbf90c56f28caad8d78bc4ee7b28dc4423b) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * webkitgtk: security bump to version 2.18.5Adrian Perez de Castro2018-01-162-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a maintenance release of the current stable WebKitGTK+ version, which contains mitigations for CVE-2017-5753 and CVE-2017-5715, the vulnerabilities known as the "Spectre" attack. It also contains a fix which allows building the reference documentation with newer gtk-doc versions. Release notes can be found in the announcement: https://webkitgtk.org/2018/01/10/webkitgtk2.18.5-released.html Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 4c5bc08ba3198075dcf6f96b34684d577cfe5a69) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 4.{4, 9, 14}.x seriesFabio Estevam2018-01-161-2/+2
| | | | | | | | | | | | | | | | [Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit f932dc96260bf56d732d3e7088c228775a286f90) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * asterisk: security bump to version 14.7.5Peter Korsgaard2018-01-162-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: * AST-2017-014: Crash in PJSIP resource when missing a contact header A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled a user would have to first be authorized before reaching the crash point. For more details, see the announcement: https://www.asterisk.org/downloads/asterisk-news/asterisk-13185-1475-1515-and-1318-cert2-now-available-security Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 4f13dc362d5c9c63fb5a21ede7cf902c1281cef0) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 3.2.x seriesFabio Estevam2018-01-081-1/+1
| | | | | | | | | | | | | | Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit a24ed4127eafa8d2f1bea13142f5632f4c62031f) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * ntp: does not work with libresslPeter Korsgaard2018-01-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #10556 The --with-crypto handling in ntp only works with libopenssl, not with libressl, where it ends up with compilation issues like: ntp_control.c:(.text+0x64): undefined reference to `EVP_MD_CTX_new' ntp_control.c:(.text+0x10c): undefined reference to `EVP_MD_CTX_free' libntpd.a(ntp_crypto.o): In function `bighash': ntp_crypto.c:(.text+0x2e8): undefined reference to `EVP_MD_CTX_new' ntp_crypto.c:(.text+0x328): undefined reference to `EVP_MD_CTX_free' libntpd.a(ntp_crypto.o): In function `crypto_verify': ntp_crypto.c:(.text+0x6cc): undefined reference to `EVP_MD_CTX_new' ntp_crypto.c:(.text+0x710): undefined reference to `EVP_MD_CTX_free' ntp_crypto.c:(.text+0x72c): undefined reference to `EVP_MD_CTX_free' So ensure we only pass --with-crypto when libopenssl is used. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 522111f81c7d535f4f362ad4a15d141d0eb39ec5) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * asterisk: security bump to version 14.6.2Peter Korsgaard2018-01-085-39/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: 14.6.1: * AST-2017-005 (applied to all released versions): The "strictrtp" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The "nat" and "rtp_symmetric" options for chan_sip and chan_pjsip respectively enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. This option is not enabled by default but is commonly enabled to handle devices behind NAT. A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected the new code allowed a new source address to be learned at all times. If a flood of RTP traffic was received the strict RTPsupport would allow the new address to provide media and with symmetric RTP enabled outgoing traffic would be sent to this new address, allowing the media to be hijacked. Provided the attacker continued to send traffic they would continue to receive traffic as well. * AST-2017-006 (applied to all released versions): The app_minivm module has an “externnotify” program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection. * AST-2017-007 (applied only to 13.17.1 and 14.6.1): A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash For more details, see the announcement: https://www.asterisk.org/downloads/asterisk-news/asterisk-11252-13171-1461-116-cert17-1313-cert5-now-available-security 14.6.2: * AST-2017-008: Insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the “nat” and “symmetric_rtp” options allow redirecting where Asterisk sends the next RTCP report. The RTP stream qualification to learn the source address of media always accepted the first RTP packet as the new source and allowed what AST-2017-005 was mitigating. The intent was to qualify a series of packets before accepting the new source address. For more details, see the announcement: https://www.asterisk.org/downloads/asterisk-news/asterisk-11253-13172-1462-116-cert18-1313-cert6-now-available-security Drop 0004-configure-in-cross-complation-assimne-eventfd-are-av.patch as this is now handled differently upstream (by disabling eventfd for cross compilation, see commit 2e927990b3d2 (eventfd: Disable during cross compilation)). If eventfd support is needed then this should be submitted upstream. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 3f1d2c6c746a04d19a493f4e7b866e84e3aa7dc8) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * irssi: security bump to version 1.0.6Peter Korsgaard2018-01-082-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | >From the advisory (https://irssi.org/security/irssi_sa_2018_01.txt): Multiple vulnerabilities have been located in Irssi. (a) When the channel topic is set without specifying a sender, Irssi may dereference NULL pointer. Found by Joseph Bisch. (CWE-476) CVE-2018-5206 was assigned to this issue. (b) When using incomplete escape codes, Irssi may access data beyond the end of the string. (CWE-126) Found by Joseph Bisch. CVE-2018-5205 was assigned to this issue. (c) A calculation error in the completion code could cause a heap buffer overflow when completing certain strings. (CWE-126) Found by Joseph Bisch. CVE-2018-5208 was assigned to this issue. (d) When using an incomplete variable argument, Irssi may access data beyond the end of the string. (CWE-126) Found by Joseph Bisch. CVE-2018-5207 was assigned to this issue. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit aebdb1cd4b4034542eb7c50fc4b6a265c5ba5c77) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * toolchain: m68k coldfire is also affected by gcc bug 64735Jan Heylen2018-01-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Verified experimentally by using exception_ptr with m68k_cf5208 and looking at the value of ATOMIC_INT_LOCK_FREE. ATOMIC_INT_LOCK_FREE=1, so the issue is present. Also verified that gcc 7.x fixed it also for cf5208. Signed-off-by: Jan Heylen <jan.heylen@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 98b3b83fb54323cd1be0f38084a51c4e0c939e65) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/x11r7/xlib_libXpm: disable gettext detection when not neededBernd Kuhls2018-01-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch originates from FreeBSD: https://lists.freebsd.org/pipermail/freebsd-x11/2015-July/016528.html https://svnweb.freebsd.org/ports/head/x11/libXpm/Makefile?r1=384234&r2=391122&pathrev=391122 Fixes http://autobuild.buildroot.net/results/f24/f24dc74c111690f068833ff6fc72df9a0853d210/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 6653b0929fc3f4007294e289f88afa3920af2a89) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/pound: Fix build with openssl 1.0.2Bernd Kuhls2018-01-081-0/+127
| | | | | | | | | | | | | | | | | | | | Fixes http://autobuild.buildroot.net/results/5be/5be1082dee8387b1140d802ac3c788896a4bf980/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit d28fa26f272fddb1573da2d20e52412fd70dff4b) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * core/infra: fix build on toolchain without C++Yann E. MORIN2018-01-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Autotools-based packages that do not need C++ but check for it, and use libtool, will fail to configure on distros that lack /lib/cpp. This is the case for example on Arch Linux, where expat fails to build with: configure: error: in `/home/dkc/src/buildroot/build/build/expat-2.2.4': configure: error: C++ preprocessor "/lib/cpp" fails sanity check This is because libtool uses AC_PROC_CXXCPP, which can not be avoided, and does require a cpp that passes some "sanity" checks (does not choke on valid input, but does choke on invalid input). So we can use neither /bin/false nor /bin/true... We instead need something that can digest some basic C++ preprocessor input. We can't use the target preprocessor: that does not work, because it obviously has no C++ cupport: arm-linux-cpp.br_real: error: conftest.cpp: C++ compiler not installed on this system We can however consider that the host machine does have a C++ compiler, so we use the host' cpp, which is gcc's compiler wrapper that ends up calling the host's C++ preprocessor. That would give us a valid C++ preprocessor when we don't have one, in fact. But autotools will then correctly fail anyway, because there is indeed no C++ compiler at all, as we can see in this excerpt of a configure log from expat: checking whether we are using the GNU C++ compiler... no checking whether false accepts -g... no checking dependency style of false... none checking how to run the C++ preprocessor... cpp checking whether the false linker (/home/ymorin/dev/buildroot/O/host/bin/arm-linux-ld) supports shared libraries... yes libtool.m4: error: problem compiling CXX test program checking for false option to produce PIC... -DPIC checking if false PIC flag -DPIC works... no checking if false static flag works... no checking if false supports -c -o file.o... no checking if false supports -c -o file.o... (cached) no checking whether the false linker (/home/ymorin/dev/buildroot/O/host/bin/arm-linux-ld) supports shared libraries... yes So, using the host's C++ preprocessor (by way of gcc's wrapper) leads to a working situation, where the end result is as expected. Reported-by: Damien Riegel <damien.riegel@savoirfairelinux.com> Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Damien Riegel <damien.riegel@savoirfairelinux.com> Cc: Vivien Didelot <vivien.didelot@savoirfairelinux.com> Cc: Peter Korsgaard <peter@korsgaard.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit bd39d11d2eaa679f09ab49fd3e4cd5511a168d1c) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/php: security bump to 7.1.13Bernd Kuhls2018-01-084-30/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Removed 0008-fix-asm-constraints-in-aarch64-multiply-macro.patch, patch was applied upstream: https://github.com/php/php-src/commit/d6d4f2a9b38cd7fa7e938142e49e5a514d612e52 Renumbered patch 0009. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 2c59323b846f9eefafb0d3c5d892119d2aa7becd) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/php: bump version to 7.1.12Bernd Kuhls2018-01-082-2/+2
| | | | | | | | | | | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit ab01a1279c4990d201e6a560dbe9cc5b25a20fae) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 4.{4, 9, 14}.x seriesFabio Estevam2018-01-081-2/+2
| | | | | | | | | | | | | | | | [Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 7f02b4ae4525cdfb2a67286f982264c7de1e73dc) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * mariadb: security bump version to 10.1.30Ryan Coe2018-01-082-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release notes: https://mariadb.com/kb/en/mariadb-10130-release-notes/ Changelog: https://mariadb.com/kb/en/mariadb-10130-changelog/ Fixes the following security vulnerability: CVE-2017-15365 - Replication in sql/event_data_objects.cc occurs before ACL checks. Signed-off-by: Ryan Coe <bluemrp9@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit ca1f2d266ddba2f530731e91ebbf792638cee8bb) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 4.{4, 9, 14}.x seriesFabio Estevam2018-01-081-2/+2
| | | | | | | | | | | | | | | | [Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 1897a56a2baae64f40dc9b155443d13818ef726b) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 3.2.x seriesFabio Estevam2018-01-081-1/+1
| | | | | | | | | | | | | | Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 28d57106b87ef97480374925e5f44dc541eba381) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * support/scripts: sort pie chartsThomas De Schampheleire2018-01-082-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Make sure that the pie charts produced by 'graph-build' and 'graph-size' targets are sorted on the size of each piece of the pie. Otherwise, making visual analysis is difficult, as one needs to look at the legends of each piece and do the sorting manually in their head. Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit a3f37c53d5b7ecd8ebae4b0baabb66147896302b) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * coreutils: expand list of files moved from /usr/bin to /binCarlos Santos2018-01-081-2/+2
| | | | | | | | | | | | | | | | | | | | BusyBox installs kill, link, mktemp, nice and printenv on /bin, so ensure that coreutils replaces them. Signed-off-by: Carlos Santos <casantos@datacom.ind.br> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 443897bce4b01eae98155ac947d3387e6a2f289e) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * eeprog: fix homepage linkBaruch Siach2018-01-081-1/+1
| | | | | | | | | | | | | | | | | | | | The current link leads to a 400 Bad Request error page. Cc: Matt Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit b0748bd1baf60461425ec124fd4f3be68f2dd4d6) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * tar: do not build SELinux support for host variantThomas Petazzoni2018-01-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | If we don't explicitly disable SELinux support in the host-tar build, it might pick up system-wide installed SELinux libraries, causing the tar in HOST_DIR/bin/ to depend on the host SELinux libraries, which is not desirable to make the SDK portable/relocatable. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 121807c08927c0a0d04c965beb6a8785ea89e47f) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/matchbox-lib: correctly fix the .pc fileYann E. MORIN2018-01-082-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | First, the .pc file was so far fixed as a post-configure hook of the matchbox-fakekey package, by directly tweaking the .pc file installed in staging by matchbox-lib. That's uterly wrong and bad. So, we move the fix to matchbox-lib. Second, it was incorreclty tweaking the .pc file when xlib_libXft was not enabled, because only then a path to staging was present. Third, even when xlib_libXft was enabled, the tweaking was still wrong, because unnecessary. Fix all that. Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 84a2645e5b2600d28d91005937c17bec554dd4d1) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * matchbox-lib: fix dependenciesYann E. MORIN2018-01-083-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | matchbox-lib build-depends on xlib_libXext, but forgets to select it. It also build-depends on expat without selecting it, but it does need it. Fix that: select xlib_libXext, remove expat. Add myself to developpers for matchbox packages. Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Arnout Vandecappelle <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 2cfda4704e0fbf486bf1255c0779caed1ffab946) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * libiio: fix libavahi-client dependencyMarcus Folkesson2018-01-081-2/+2
| | | | | | | | | | | | | | | | | | Avahi needs avahi-daemon and D-Bus to build avahi-client. Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 18e00edb7796790b1ac1a0f6982ab8e25e27c691) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * Update for 2017.11.12017.11.1Peter Korsgaard2017-12-312-2/+14
| | | | | | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 4.{9, 14}.x seriesFabio Estevam2017-12-301-1/+1
| | | | | | | | | | | | | | | | [Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit e4bdd2a8241eb0c3b6e2634c2b693a743e99cec8) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/nut: don't build in parallelYann E. MORIN2017-12-281-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The conditions are not trivial to reproduce, but it can happen that the headers are not fully regenerated by the time they are included. This only happens when a python and/or perl interpreter are available, with a high number of jobs and a high load. Fixes: http://autobuild.buildroot.org/results/523/5231ff39a0839ec5e1962662004214d4b0773068/ http://autobuild.buildroot.org/results/5a7/5a75d44c028e77b58f0fd9ab794952f2b477dd84/ Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 1d8de10c5fb36619708898a529977058886f31d1) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * linux-headers: bump 4.{1, 4, 9, 14}.x seriesFabio Estevam2017-12-271-3/+3
| | | | | | | | | | | | | | | | [Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 634bdbd52e7451b615b8972f0d3973e5b76ef987) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| * package/libpqxx: fix broken sed callRomain Naour2017-12-272-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | Backport 2 upstream fix. Fixes: http://autobuild.buildroot.net/results/0d1/0d131f9fa5cce259d999f7d57f9092675bfc24c7 Signed-off-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit de035220aa17cfa223a2de8d5d1233d95d6dd0e7) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
OpenPOWER on IntegriCloud