summaryrefslogtreecommitdiffstats
path: root/package
Commit message (Collapse)AuthorAgeFilesLines
...
* asterisk: security bump to version 14.7.6Peter Korsgaard2018-02-252-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: AST-2018-002: Crash when given an invalid SDP media format description By crafting an SDP message with an invalid media format description Asterisk crashes when using the pjsip channel driver because pjproject's sdp parsing algorithm fails to catch the invalid media format description. AST-2018-003: Crash with an invalid SDP fmtp attribute By crafting an SDP message body with an invalid fmtp attribute Asterisk crashes when using the pjsip channel driver because pjproject's fmtp retrieval function fails to check if fmtp value is empty (set empty if previously parsed as invalid). AST-2018-004: Crash when receiving SUBSCRIBE request When processing a SUBSCRIBE request the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed despite having a fixed limit of 32. If more than 32 Accept headers were present the code would write outside of its memory and cause a crash. AST-2018-005: Crash when large numbers of TCP connections are closed suddenly A crash occurs when a number of authenticated INVITE messages are sent over TCP or TLS and then the connection is suddenly closed. This issue leads to a segmentation fault. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* azmq: add NPTL dependencyFabrice Fontaine2018-02-251-3/+3
| | | | | | | | | | | boost-log depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL so add this dependency to azmq Fixes: - http://autobuild.buildroot.net/results/ffa5f21d7e7c38ea7adebc84f1cc8ee4cff74f1b Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* patch: security bump to version 2.7.6Baruch Siach2018-02-233-2/+37
| | | | | | | | | | | | | | | | | | Fixes CVE-2016-10713: Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. Add upstream patch fixing CVE-2018-6951: There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue. This bump does NOT fix CVE-2018-6952. See upstream bug #53133 (https://savannah.gnu.org/bugs/index.php?53133). Add license file hash. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* mbedtls: security bump to version 2.7.0Baruch Siach2018-02-232-4/+4
| | | | | | | | | | | | | | | CVE-2018-0487: Remote attackers can execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session. CVE-2018-0488: When the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 14, 15}.x seriesFabio Estevam2018-02-221-4/+4
| | | | | Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/{mesa3d, mesa3d-headers}: bump version to 17.3.5Romain Naour2018-02-213-7/+7
| | | | | | | | | | This is a emergency release fixing major a issue in the RADV driver [1]. [1] https://lists.freedesktop.org/archives/mesa-announce/2018-February/000401.html Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/gpsd: disable profiling support on ARCZoltan Gyarmati2018-02-211-0/+2
| | | | | | | | | | | | | With the currently used ARC glibc version the profiling build fails with linking error to __mcount. The ARC glibc version arc-2018.03-eng007+ fixes this, therefore when glibc is bumped, this restriction can be removed. Fixes: http://autobuild.buildroot.net/results/88870f5bf4aff557d8eac4e1cc5d3e397e607af0/ Signed-off-by: Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* exim: add upstream security fixPeter Korsgaard2018-02-201-0/+37
| | | | | | | | | | | | | | | Fixes the following security issue: CVE-2018-6789: Meh Chang discovered a buffer overflow flaw in a utility function used in the SMTP listener of Exim, a mail transport agent. A remote attacker can take advantage of this flaw to cause a denial of service, or potentially the execution of arbitrary code via a specially crafted message. Dropped ChangeLog hunk and adjusted file path of upstream commit so it applies to tarball. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* quagga: add upstream security fixesPeter Korsgaard2018-02-194-0/+338
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2018-5378 It was discovered that the Quagga BGP daemon, bgpd, does not properly bounds check data sent with a NOTIFY to a peer, if an attribute length is invalid. A configured BGP peer can take advantage of this bug to read memory from the bgpd process or cause a denial of service (daemon crash). https://www.quagga.net/security/Quagga-2018-0543.txt CVE-2018-5379 It was discovered that the Quagga BGP daemon, bgpd, can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes, resulting in a denial of service (bgpd daemon crash). https://www.quagga.net/security/Quagga-2018-1114.txt CVE-2018-5380 It was discovered that the Quagga BGP daemon, bgpd, does not properly handle internal BGP code-to-string conversion tables. https://www.quagga.net/security/Quagga-2018-1550.txt CVE-2018-5381 It was discovered that the Quagga BGP daemon, bgpd, can enter an infinite loop if sent an invalid OPEN message by a configured peer. A configured peer can take advantage of this flaw to cause a denial of service (bgpd daemon not responding to any other events; BGP sessions will drop and not be reestablished; unresponsive CLI interface). https://www.quagga.net/security/Quagga-2018-1975.txt Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* qt5webengine: fix build issue with alsaGaël PORTAY2018-02-192-0/+16
| | | | | | | | | | | | | | | | | Qt WebEngine auto-guesses if it compiles support for alsa. When the alsa-lib config is enabled but the features mixer, rawmidi, hwdep and seq are not also enabled, it leads to a build failure. Lets the developer decide whether or not support for alsa in Qt WebEngine by adding the new config BR2_PACKAGE_QT5WEBENGINE_ALSA that selects the features it needs when it is set. Fixes [1]. [1]: http://autobuild.buildroot.net/results/d81537a8f67bb0a3625057560b2f16daf4828f98/build-end.log Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* wireguard: bump version to 0.0.20180218Peter Korsgaard2018-02-192-3/+3
| | | | | | Fixes a memory leak and various minor tooling fixes. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* e2fsprogs: bump version to 1.43.9Peter Korsgaard2018-02-193-44/+3
| | | | | | | | | | | | | | | | | | | | | | | Drop 0001-libext2fs-fix-build-failure-in-swapfs.c-on-big-endia.patch as it is now upstream. Only contains minor bugfixes since 1.43.8 and no new features. >From the release notes: Remove the huge file flag from libe2p (and hence from chattr/lsattr), since it was never made visible by the kernel. Remove the description of some compression related flags, and add a description of the encrypted file flag, and the project hierarchy flag. Remove a misplaced "MNP is unsupported" message from debugfs. Fix a build failure in lib/ext2fs/swapfs.c on big-endian systems. (Addresses Debian Bug #886119) Fix various Debian packaging issues. (Addresses Debian Bug #269569). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* mariadb: security bump version to 10.1.31Ryan Coe2018-02-192-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release notes: https://mariadb.com/kb/en/mariadb-10131-release-notes/ Changelog: https://mariadb.com/kb/en/mariadb-10131-changelog/ Fixes the following security vulnerabilities: CVE-2018-2562 - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVE-2018-2622 - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE-2018-2640 - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE-2018-2665 - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE-2018-2668 - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.58 and prior, 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVE-2018-2612 - Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.6.38 and prior and 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. Signed-off-by: Ryan Coe <bluemrp9@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* zic: bump to 2018cAdam Duskett2018-02-192-3/+3
| | | | | Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* jq: compile as _GNU_SOURCE to fix segfault when compiled with gcc 6Thomas De Schampheleire2018-02-191-2/+4
| | | | | | | | | | | | | When compiling host-jq with gcc 6+, running it gives an immediate segfault. Reported upstream: https://github.com/stedolan/jq/issues/1598 The issue can be solved by compiling with _GNU_SOURCE as extra preprocessor define. Once the issue is solved upstream, this change can be reverted. As the issue will normally be the same for target, apply the same fix there. Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 14, 15}.x seriesFabio Estevam2018-02-181-4/+4
| | | | | Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libvorbis: add upstream security fixesPeter Korsgaard2018-02-182-0/+92
| | | | | | | | | | | | | | | Fixes the following security issues: CVE-2017-14632: Libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. CVE-2017-14633: In libvorbis 1.3.5, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* glibc: security bump to the latest commit on 2.26 branchPeter Korsgaard2018-02-182-2/+2
| | | | | | | | | | | | | | | Fixes the following security issues according to NEWS: CVE-2018-6485: An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka CVE-2018-6551: The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libcpprestsdk: needs host-pkgconfPeter Korsgaard2018-02-151-1/+1
| | | | | | | | Commit d2f0a9bba400 (libcpprestsdk: fix building as a static library) changed libcpprestsdk to use pkg-config to find the linker flags for openssl, so ensure it is available. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/{mesa3d, mesa3d-headers}: bump version to 17.3.4Bernd Kuhls2018-02-153-7/+7
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/ffmpeg: bump version to 3.4.2Bernd Kuhls2018-02-152-2/+2
| | | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* pure-ftpd: Config.in: fix help text wrappingGaël PORTAY2018-02-141-2/+2
| | | | | | | | | | | This commit fixes the warnings reported by check-package on the help text of package Config.in file, related to the formatting of the help text: should start with a tab, then 2 spaces, then at most 62 characters. Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Acked-by: Sam Voss <sam.voss@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* gconf: Config.in: fix help text wrappingGaël PORTAY2018-02-141-3/+3
| | | | | | | | | | This commit fixes the warnings reported by check-package on the help text of package Config.in file, related to the formatting of the help text: should start with a tab, then 2 spaces, then at most 62 characters. Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/*/Config.in.host: fix help text check-package warningsGaël PORTAY2018-02-146-15/+17
| | | | | | | | | | This commit fixes the warnings reported by check-package on the help text of all package Config.in.host files, related to the formatting of the help text: should start with a tab, then 2 spaces, then at most 62 characters. Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* qt5: fetch sources using https URLsGaël PORTAY2018-02-143-5/+5
| | | | | Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* qt5webengine: replace $(HOST_DIR)/usr/bin with $(HOST_DIR)/binGaël PORTAY2018-02-131-1/+1
| | | | | | | Apply effect of commit 0f9c0bf3d5 to Qt WebEngine. Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* qt5webkit{, -examples}: use https link in hashfileGaël PORTAY2018-02-132-4/+4
| | | | | | | All Qt modules but qt5webkit use https link in their hashfile. Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* libcpprestsdk: fix building as a static libraryAdam Duskett2018-02-131-0/+38
| | | | | | | | | | | | | | | | Use pkg-config to find OpenSSL. This will automatically find any dependent libraries and put them in the correct order for linking. Upstream status: submitted https://github.com/Microsoft/cpprestsdk/pull/688 Fixes: http://autobuild.buildroot.net/results/be9e8d1717968a0ff8f01f7fadfa79825ac88b94/ Signed-off-by: Adam Duskett <aduskett@gmail.com> Reviewed-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* linux-headers: bump 4.{9, 14}.x seriesFabio Estevam2018-02-131-2/+2
| | | | | Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* rustc: fix check-package warningsEric Le Bihan2018-02-131-2/+1
| | | | | | | | | | | | utils/check-package complains as follows: package/rustc/Config.in.host:6: attributes order: type, default, depends on, select, help (http://nightly.buildroot.org/#_config_files) package/rustc/Config.in.host:79: empty line at end of file This patch fixes these warnings. Signed-off-by: Eric Le Bihan <eric.le.bihan.dev@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* rustc: use RUSTC_{HOST,TARGET}_NAMEEric Le Bihan2018-02-136-14/+14
| | | | | | | | | | | | | | | utils/check-package complains as follows: package/rustc/rustc.mk:10: possible typo: RUST_TARGET_NAME -> *RUSTC* package/rustc/rustc.mk:18: possible typo: RUST_HOST_NAME -> *RUSTC* As RUST_{HOST,TARGET}_NAME are related to the Rust compiler, it sounds sensible to rename them to RUSTC_{HOST,TARGET}_NAME. So update all rust related packages to use the new variables. Signed-off-by: Eric Le Bihan <eric.le.bihan.dev@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/mesa3d-demos: remove duplicate osmesa optionAudrey Motheron2018-02-131-1/+0
| | | | | | | | | --disable-osmesa option is unconditionally added to CONF_OPTS even if --enable-osmesa is used latter. Signed-off-by: Audrey Motheron <audrey.motheron@gmail.com> Reviewed-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* systemd: resolved was renamed to resolve in meson buildWaldemar Brodkorb2018-02-131-2/+2
| | | | | | | | While the conversion to meson, this seems to be missed. Found while trying to build systemd with uClibc toolchain. Signed-off-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* php: disable valgrindAdam Duskett2018-02-131-0/+5
| | | | | | | | | | | | Introduced in PHP7.2, if a host has valgrind headers installed, PHP will detect them and set HAVE_VALGRIND to 1. Disable this entry after configuring. fixes: http://autobuild.buildroot.net/results/d59/d59b5961890aeddcd6d59ed52243be6554d1fe21 Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* librsvg: security bump to version 2.40.20Baruch Siach2018-02-132-3/+3
| | | | | | | | | | Fixes CVE-2018-1000041: information disclosure via a crafted SVG file. Bump to the latest (maybe last) release in the 2.40.x series. Newer versions require a Rust compiler. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* linux-headers: bump 4.15.x seriesFabio Estevam2018-02-131-1/+1
| | | | | Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: use https URLsDanilo Bargen2018-02-132-2/+2
| | | | | | | | | While a hash check is being done, it's still better to use a download URL with HTTPS. Signed-off-by: Danilo Bargen <mail@dbrgn.ch> Reviewed-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* postgresql: update license file hashBaruch Siach2018-02-131-1/+1
| | | | | | | | | | | | | | Copyright year update. Fixes: http://autobuild.buildroot.net/results/d79/d7989660584430945644e3a4406ba33cee22863d/ http://autobuild.buildroot.net/results/b51/b5141b64ed838caa1daca1bf4fe322dd2afaf0b5/ http://autobuild.buildroot.net/results/a37/a375d533036a1b95af32b6bda086e93174b8c5f0/ Cc: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Reviewed-by: Matt Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* busybox: add upstream security fixesBaruch Siach2018-02-132-0/+135
| | | | | | | | | | | | CVE-2017-15873: Integer overflow in decompress_bunzip2.c leads to a read access violation CVE-2017-15874: Integer overflow in decompress_unlzma.c leads to a read access violation Cc: Adam Duskett <aduskett@gmail.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* qt5tools: fix typo in <pkg>_SOURCEGaël PORTAY2018-02-101-1/+1
| | | | | | | | | | The QT5TOOLS_SOURCE variable uses mismatch QT5BASE_VERSION variable. This commit fixes the typo by using the appropriate QT5TOOLS_VERSION variable. Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* qt5enginio: bump to 1.6.3Gaël PORTAY2018-02-102-3/+3
| | | | | | | | | | | | Qt Enginio has been bumped to 1.6.3 with Qt 5.6.3. This new version follows the Qt release number and has only one change since 1.6.2[1]. [1]: https://github.com/qt/qtenginio/commit/e447818458c9211e95ee5e75e294f76b6abf32d4 Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* qt53d: fix typo in <pkg>_SOURCESGaël PORTAY2018-02-101-1/+1
| | | | | | | | | | The QT53D_SOURCE variable uses mismatch QT5SVG_VERSION variable. This commit fixes the typo by using the appropriate QT53D_VERSION variable. Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* rsync: security bump to version 3.1.3Baruch Siach2018-02-106-147/+5
| | | | | | | | | | | | Fixes CVE-2018-5764: remote attackers can bypass an argument-sanitization protection mechanism Drop upstream patches. Add license file hash. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* libxml2: add security fixBaruch Siach2018-02-101-0/+33
| | | | | | | | | | CVE-2017-8872: An attackers can cause a denial of service (buffer over-read) or information disclosure. Patch from the upstream bug tracker. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* keepalived: fix build with 4.15+ kernel headersBaruch Siach2018-02-101-0/+59
| | | | | | | | | | | | | | | Kernel version 4.15 change the logic of libc-compat.h in a way that introduced libc/kernel network headers collision. Add a patch for fixing that. Fixes: http://autobuild.buildroot.net/results/000/000293275076c59e298d235e93ce9a92b66360e7/ http://autobuild.buildroot.net/results/2ba/2ba8722a42aa9b92f5194595f53130c97647b9b8/ http://autobuild.buildroot.net/results/114/114136447c9b18436ff9b2804c440a2e37576452/ Cc: Ilias Apalodimas <apalos@gmail.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* postgresql: security bump to 10.2Adam Duskett2018-02-102-3/+3
| | | | | | | | | | | | | from https://www.postgresql.org/about/news/1829/ [1] CVE-2018-1052: Fix the processing of partition keys containing multiple expressions [2] CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* nftables: fix build with glibc before 2.19Baruch Siach2018-02-101-0/+38
| | | | | | | | | | | | | Add a patch that has a local definition of IPPROTO_MH. This fixes build with glibc before 2.19 that missed IPPROTO_MH. Fixes: http://autobuild.buildroot.net/results/b0a/b0ab6c8c765977cfdc9791d768d3ec2cf129d25d/ http://autobuild.buildroot.net/results/3ef/3ef36d9d03497ee1d5d20bd44aee6ccf12868f7b/ http://autobuild.buildroot.net/results/445/445f2291ebba521f0faac961ca8868ae99b2d795/ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* rust-bin: fix indentationThomas Petazzoni2018-02-081-1/+1
| | | | | | | | This fixes the following check-package warning: ./package/rust-bin/rust-bin.mk:27: expected indent with tabs Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* glibc: security bump to the latest commit on 2.26 branchPeter Korsgaard2018-02-082-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues according to NEWS: CVE-2017-1000408: Incorrect array size computation in _dl_init_paths leads to the allocation of too much memory. (This is not a security bug per se, it is mentioned here only because of the CVE assignment.) Reported by Qualys. CVE-2017-1000409: Buffer overflow in _dl_init_paths due to miscomputation of the number of search path components. (This is not a security vulnerability per se because no trust boundary is crossed if the fix for CVE-2017-1000366 has been applied, but it is mentioned here only because of the CVE assignment.) Reported by Qualys. CVE-2017-16997: Incorrect handling of RPATH or RUNPATH containing $ORIGIN for AT_SECURE or SUID binaries could be used to load libraries from the current directory. CVE-2018-1000001: Buffer underflow in realpath function when getcwd function succeeds without returning an absolute path due to unexpected behaviour of the Linux kernel getcwd syscall. Reported by halfdog. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* ltp-testsuite: add numactl as optional dependencyBaruch Siach2018-02-081-0/+7
| | | | | | | | | | | | | Make the detection of libnuma in the configure script consistent when the numactl package is enabled. ltp-testsuite does not currently take explicit enable/disable for libnuma, so none are used. The next ltp-testsuite version will add these options. Cc: Petr Vorel <petr.vorel@gmail.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
OpenPOWER on IntegriCloud