Compare commits

...

24 Commits

Author SHA1 Message Date
Johan Oudinet
0edec09c32 erlang: enable host-erlang for x86/x86_64 architectures only
And make erlang depends on host-erlang.
This patch aims at avoiding the following autobuilder failures:
http://autobuild.buildroot.net/results/45edf95c0c44c9d553879e0cbb771098d7c63aa1
http://autobuild.buildroot.net/results/a36d00407a371d70b4551a9717ebd6ff852c8bca

Signed-off-by: Johan Oudinet <johan.oudinet@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 11b5afd6d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-02-27 13:43:34 +01:00
Peter Korsgaard
c8eea94905 refpolicy: add upstream patch fixing compile error related to implicit-fallthrough
Fixes:
http://autobuild.buildroot.net/results/958/958ff318cdbedb5b8641b376223491b85a75f084/
http://autobuild.buildroot.net/results/54e/54e240243aba31da33a2cbecdcc234b44f24dcf7/

fc-sort is a host utility compiled with -Werror, and for modern (>= 7.x) gcc
versions, Werror implies -Werror=implicit-fallthrough.

And an upstream patch fixing this issue.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-02-06 13:43:58 +01:00
Fabio Estevam
b4ccebdf8b linux-headers: bump 4.{4, 9}.x series
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2dbfb76d2e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 16:31:08 +01:00
Carlos Santos
40dd5a139e eudev: fix printf usage in init script
Using a variable in a printf format string may lead to undesirable
results if the variable contains format controls, so replace

    printf "foo $var bar"

by

    printf "foo %s bar" "$var"

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 6298ed8bf4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:12:45 +01:00
Carlos Santos
afa5cb9c30 eudev: fix error handling init script
Replace (echo "msg" && exit 1) by { echo "msg"; exit 1; }.

The (list) compound command runs in a subshell, so the "exit" interrupts
the subshell, not the main script. Examples:

    $ sh -c "echo 1; (exit 1); echo 2"
    1
    2
    $ sh -c "echo 1; { exit 1; }; echo 2"
    1
    $

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 3f568fe099)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:12:37 +01:00
Angelo Compagnucci
320552fbd9 linux: bump Linux CIP to v4.4.112-cip18
This patch bump the Linux CIP kernel to version v4.4.112-cip18

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a2f8eafdfa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:12:14 +01:00
Zoltan Gyarmati
6eda76eb85 package/pinentry: avoid building qt5 version if qt4 is enabled
BR2_PACKAGE_PINENTRY_QT5 selects BR2_PACKAGE_QT5, which can lead to Qt
version clash if otherwise Qt4 is selected as well. Making
BR2_PACKAGE_PINENTRY_QT5 depending on !BR2_PACKAGE_QT to avoid this.

Fixes:
     http://autobuild.buildroot.net/results/3c537e1260dc9ce57657ca0d49e318a10aee111e

Signed-off-by: Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d3c12b0cfc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:07:28 +01:00
Bernd Kuhls
77d0d20796 package/berkeleydb: add security fix for CVE-2017-10140
Fixes CVE-2017-10140: Berkeley DB reads DB_CONFIG from cwd

For more details, see:
https://security-tracker.debian.org/tracker/CVE-2017-10140

And add license hash while we are at it.

[Peter: extend commit message]
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit 0b368023f7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:07:13 +01:00
Peter Korsgaard
8c24f6556f dovecot: add upstream security fix for CVE-2017-15132
A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0.  An abort of SASL
authentication results in a memory leak in dovecot's auth client used by
login processes.  The leak has impact in high performance configuration
where same login processes are reused and can cause the process to crash due
to memory exhaustion.

For more details, see:
http://www.openwall.com/lists/oss-security/2018/01/25/4

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 28adb37be4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:04:16 +01:00
Bernd Kuhls
f4caafafc2 package/dovecot: bump version to 2.2.33.2
Added license hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 746f94c282)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:04:09 +01:00
Peter Korsgaard
a01d75d125 openocd: add security fix for CVE-2018-5704
Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP
POST for sending data to 127.0.0.1 port 4444, which allows remote attackers
to conduct cross-protocol scripting attacks, and consequently execute
arbitrary commands, via a crafted web site.

For more details, see:
https://sourceforge.net/p/openocd/mailman/message/36188041/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8fb8dddbf4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:03:33 +01:00
Peter Korsgaard
3738aa22c8 wireshark: security bump to version 2.2.12
Fixes the following security issues:

CVE-2017-17997: MRDISC dissector crash
https://www.wireshark.org/security/wnpa-sec-2018-02.html

CVE-2018-5334: IxVeriWave file parser crash
https://www.wireshark.org/security/wnpa-sec-2018-03.html

CVE-2018-5335: WCP dissector crash
https://www.wireshark.org/security/wnpa-sec-2018-04.html

CVE-2018-5336: Multiple dissectors could crash
https://www.wireshark.org/security/wnpa-sec-2018-01.html

For more information, see the release notes:
https://www.wireshark.org/docs/relnotes/wireshark-2.2.12.html

While we are at it, also add as hash for license file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2d920ad1b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:03:13 +01:00
Bernd Kuhls
2faa1083ce package/transmission: security bump version to 2.93
Fixes CVE-2018-5702:
https://github.com/transmission/transmission/pull/468

Added license hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6e43a52aa8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:02:42 +01:00
Bernd Kuhls
e38b350476 package/clamav: security bump to version 0.99.3
Fixes CVE-2017-12374, CVE-2017-12375, CVE-2017-12376, CVE-2017-12377,
CVE-2017-12378, CVE-2017-12379, CVE-2017-12380.

For details see upstream announcement:
http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html

Added license hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ffb5dee113)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:02:14 +01:00
Mark Hirota
d44a8cf5bc ccache: bump to version 3.3.5
(Likely) fixes #10536

https://bugs.buildroot.org/show_bug.cgi?id=10536

Signed-off-by: Mark Hirota <markhirota@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 01955b5b6e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 12:01:20 +01:00
Fabio Estevam
5b0fc1f262 linux-headers: bump 4.{4, 9, 14}.x series
[Peter: drop 4.14.x bump]
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 770c19df08)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:55:55 +01:00
Fabio Estevam
14fe0b7a8b linux-headers: bump 4.1.x series
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4d7bd9f643)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:55:27 +01:00
Baruch Siach
3502e40753 libcurl: security bump to version 7.58.0
Fixes CVE-2018-1000007: libcurl might leak authentication data to third
parties.

https://curl.haxx.se/docs/adv_2018-b3bf.html

Fixes CVE-2018-1000005: libcurl contains an out bounds read in code handling
HTTP/2 trailers.

https://curl.haxx.se/docs/adv_2018-824a.html

Update license hash due to copyright year change.

[Peter: also add CVE-2018-1000005 reference]
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit e02dd5a492)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:52:49 +01:00
Carlos Santos
c4ccf76195 util-linux: disable useless programs in the host package
Disable all programs that depend on ncurses, as well as utilities that
are useless on the host: agetty, chfn-chsh, chmem, login, lslogins,
mesg, more, newgrp, nologin, nsenter, pg, rfkill, schedutils, setpriv,
setterm, su, sulogin, tunelp, ul, unshare, uuidd, vipw, wall, wdctl,
write, zramctl.

Also add dependency on host-zlib if host cramfs utils are to be built.

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 67170b76af)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:52:12 +01:00
Adrian Perez de Castro
c58c9138df webkitgtk: security bump to version 2.18.6
This is a maintenance release of the current stable WebKitGTK+ version,
which contains security fixes for CVE-2018-4088, CVE-2017-13885,
CVE-2017-7165, CVE-2017-13884, CVE-2017-7160, CVE-2017-7153,
CVE-2017-7153, CVE-2017-7161, and CVE-2018-4096. Additionally, it solves
a GStreamer deadlock when stopping video playback, and contains fixes
and improvements for the WebDriver implementation.

Release notes can be found in the announcement:

  https://webkitgtk.org/2018/01/24/webkitgtk2.18.6-released.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 54798893b8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:51:56 +01:00
Adrian Perez de Castro
160be50110 webkitgtk: Add missing libtasn1 dependency
Nowadays libtasn1 is always required and if not present the CMake
configuration step would fail.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d052ed473d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:51:50 +01:00
Gary Bisson
0b02c13724 fis: fix typo in build command
Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 840d1a8d56)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:51:17 +01:00
Peter Korsgaard
bf2a0b348f squid: add upstream post-3.5.27 security patches
Fixes the following security issues:

SQUID-2018:1 Due to incorrect pointer handling Squid is vulnerable to denial
of service attack when processing ESI responses.

http://www.squid-cache.org/Advisories/SQUID-2018_1.txt

SQUID-2018:2  Due to incorrect pointer handling Squid is vulnerable to
denial of service attack when processing ESI responses or downloading
intermediate CA certificates.

http://www.squid-cache.org/Advisories/SQUID-2018_2.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f481c83b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:50:46 +01:00
Peter Korsgaard
b8db6d6aef squid: bump version to 3.5.27
And add a hash for the license files.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 001b834aac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-01-31 11:50:41 +01:00
32 changed files with 341 additions and 34 deletions

View File

@@ -29,7 +29,7 @@ config BR2_LINUX_KERNEL_LATEST_VERSION
bool "Latest version (4.13)"
config BR2_LINUX_KERNEL_LATEST_CIP_VERSION
bool "Latest CIP SLTS version (v4.4.105-cip15)"
bool "Latest CIP SLTS version (v4.4.112-cip18)"
help
CIP launched in the spring of 2016 to address the needs of
organizations in industries such as power generation and
@@ -117,7 +117,7 @@ endif
config BR2_LINUX_KERNEL_VERSION
string
default "4.13.16" if BR2_LINUX_KERNEL_LATEST_VERSION
default "v4.4.105-cip15" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
default "v4.4.112-cip18" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
default BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE \
if BR2_LINUX_KERNEL_CUSTOM_VERSION
default "custom" if BR2_LINUX_KERNEL_CUSTOM_TARBALL

View File

@@ -0,0 +1,21 @@
Do not access DB_CONFIG when db_home is not set
Fixes CVE-2017-10140:
https://bugzilla.redhat.com/show_bug.cgi?id=1464032#c9
Downloaded from
http://pkgs.fedoraproject.org/cgit/rpms/libdb.git/commit/?id=8047fa8580659fcae740c25e91b490539b8453eb
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
--- db-5.3.28/src/env/env_open.c.old 2017-06-26 10:32:11.011419981 +0200
+++ db-5.3.28/src/env/env_open.c 2017-06-26 10:32:46.893721233 +0200
@@ -473,7 +473,7 @@
env->db_mode = mode == 0 ? DB_MODE_660 : mode;
/* Read the DB_CONFIG file. */
- if ((ret = __env_read_db_config(env)) != 0)
+ if (env->db_home != NULL && (ret = __env_read_db_config(env)) != 0)
return (ret);
/*

View File

@@ -1,2 +1,3 @@
# Locally calculated
sha256 76a25560d9e52a198d37a31440fd07632b5f1f8f9f2b6d5438f4bc3e7c9013ef db-5.3.28.NC.tar.gz
sha256 b78815181a53241f9347c6b47d1031fd669946f863e1edc807a291354cec024b LICENSE

View File

@@ -1,2 +1,3 @@
# Verified key https://samba.org/ftp/ccache/ccache-3.3.4.tar.xz.asc - sha256 computed locally
sha256 24f15bf389e38c41548c9c259532187774ec0cb9686c3497bbb75504c8dc404f ccache-3.3.4.tar.xz
sha256 190576a6e938760ec8113523e6fd380141117303e90766cc4802e770422b30c6 ccache-3.3.5.tar.xz

View File

@@ -4,7 +4,7 @@
#
################################################################################
CCACHE_VERSION = 3.3.4
CCACHE_VERSION = 3.3.5
CCACHE_SITE = https://www.samba.org/ftp/ccache
CCACHE_SOURCE = ccache-$(CCACHE_VERSION).tar.xz
CCACHE_LICENSE = GPL-3.0+, others

View File

@@ -1,2 +1,14 @@
# Locally calculated
sha256 167bd6a13e05ece326b968fdb539b05c2ffcfef6018a274a10aeda85c2c0027a clamav-0.99.2.tar.gz
sha256 00fa5292a6e00a3a4035b826267748965d5d2c4943d8ff417d740238263e8e84 clamav-0.99.3.tar.gz
sha256 0c4fd2fa9733fc9122503797648710851e4ee6d9e4969dd33fcbd8c63cd2f584 COPYING
sha256 d72a145c90918184a05ef65a04c9e6f7466faa59bc1b82c8f6a8ddc7ddcb9bed COPYING.bzip2
sha256 dfb818a0d41411c6fb1c193c68b73018ceadd1994bda41ad541cbff292894bc6 COPYING.file
sha256 6dce638b76399e7521ad8e182d3e33e4496c85b3b69b6ff434b53017101e82ad COPYING.getopt
sha256 a9bdde5616ecdd1e980b44f360600ee8783b1f99b8cc83a2beb163a0a390e861 COPYING.LGPL
sha256 e3a9b913515a42f8ff3ef1551c3a2cdba383c39ed959729e0e2911219496ad74 COPYING.llvm
sha256 d96d71b66aa32c4a2d1619b9ca3347dafa9460bcf0fb5ac2408916067ad31dfc COPYING.lzma
sha256 accdcf2455c07b99abea59016b3663eaef926a92092d103bfaa25fed27cf6b24 COPYING.pcre
sha256 e2c1395a3d9fea6d5d25847c9d783db6e2cc8b085b4025861f459139c5dfd90b COPYING.regex
sha256 1faccc6b5c7b958fb807a3f573d5be9bf7889fe898f7e0617c544b05a81bfd00 COPYING.unrar
sha256 a20d6317c5384e8d4c05f9c31097878675d9429ec46090656166039cc10bc957 COPYING.YARA
sha256 c2f77553f8d870c5635b0dace0519253233f172b33ce1fdf6578610706294eee COPYING.zlib

View File

@@ -4,7 +4,7 @@
#
################################################################################
CLAMAV_VERSION = 0.99.2
CLAMAV_VERSION = 0.99.3
CLAMAV_SITE = https://www.clamav.net/downloads/production
CLAMAV_LICENSE = GPL-2.0
CLAMAV_LICENSE_FILES = COPYING COPYING.bzip2 COPYING.file COPYING.getopt \

View File

@@ -0,0 +1,32 @@
From 902917880ca29f1007750a70cf46e7246b2d0a2a Mon Sep 17 00:00:00 2001
From: Josef 'Jeff' Sipek <jeff.sipek@dovecot.fi>
Date: Tue, 14 Nov 2017 06:01:21 +0100
Subject: [PATCH] byteorder.h: fix uclibc build
Patch suggested on upstream mailinglist:
https://www.dovecot.org/pipermail/dovecot/2017-November/110019.html
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
src/lib/byteorder.h | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/lib/byteorder.h b/src/lib/byteorder.h
index 2f5dc7c17..4ffe8da21 100644
--- a/src/lib/byteorder.h
+++ b/src/lib/byteorder.h
@@ -23,6 +23,11 @@
#ifndef BYTEORDER_H
#define BYTEORDER_H
+#undef bswap_8
+#undef bswap_16
+#undef bswap_32
+#undef bswap_64
+
/*
* These prototypes exist to catch bugs in the code generating macros below.
*/
--
2.11.0

View File

@@ -0,0 +1,33 @@
From 1a29ed2f96da1be22fa5a4d96c7583aa81b8b060 Mon Sep 17 00:00:00 2001
From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Mon, 18 Dec 2017 16:50:51 +0200
Subject: [PATCH] lib-auth: Fix memory leak in auth_client_request_abort()
This caused memory leaks when authentication was aborted. For example
with IMAP:
a AUTHENTICATE PLAIN
*
Broken by 9137c55411aa39d41c1e705ddc34d5bd26c65021
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
src/lib-auth/auth-client-request.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/lib-auth/auth-client-request.c b/src/lib-auth/auth-client-request.c
index 480fb42b3..046f7c307 100644
--- a/src/lib-auth/auth-client-request.c
+++ b/src/lib-auth/auth-client-request.c
@@ -186,6 +186,7 @@ void auth_client_request_abort(struct auth_client_request **_request)
auth_client_send_cancel(request->conn->client, request->id);
call_callback(request, AUTH_REQUEST_STATUS_ABORT, NULL, NULL);
+ pool_unref(&request->pool);
}
unsigned int auth_client_request_get_id(struct auth_client_request *request)
--
2.11.0

View File

@@ -1,2 +1,5 @@
# Locally computed after checking signature
sha256 034be40907748128d65088a4f59789b2f99ae7b33a88974eae0b6a68ece376a1 dovecot-2.2.31.tar.gz
sha256 fe1e3b78609a56ee22fc209077e4b75348fa1bbd54c46f52bde2472a4c4cee84 dovecot-2.2.33.2.tar.gz
sha256 a363b132e494f662d98c820d1481297e6ae72f194c2c91b6c39e1518b86240a8 COPYING
sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING.LGPL
sha256 52b8c95fabb19575281874b661ef7968ea47e8f5d74ba0dd40ce512e52b3fc97 COPYING.MIT

View File

@@ -5,7 +5,7 @@
################################################################################
DOVECOT_VERSION_MAJOR = 2.2
DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).31
DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).33.2
DOVECOT_SITE = http://www.dovecot.org/releases/$(DOVECOT_VERSION_MAJOR)
DOVECOT_INSTALL_STAGING = YES
DOVECOT_LICENSE = LGPL-2.1, MIT, Public Domain, BSD-3-Clause, Unicode-DFS-2015

View File

@@ -1,9 +1,16 @@
config BR2_PACKAGE_HOST_ERLANG_ARCH_SUPPORTS
bool
default y if BR2_HOSTARCH = "x86_64"
default y if BR2_HOSTARCH = "x86"
config BR2_PACKAGE_ERLANG_ARCH_SUPPORTS
bool
# see HOWTO/INSTALL.md for Erlang's supported platforms
# when using its native atomic ops implementation
default y if BR2_i386 || BR2_x86_64 || BR2_powerpc || \
BR2_sparc_v9 || BR2_arm || BR2_aarch64 || BR2_mipsel
# erlang needs host-erlang
depends on BR2_PACKAGE_HOST_ERLANG_ARCH_SUPPORTS
comment "erlang needs a toolchain w/ dynamic library"
depends on BR2_USE_MMU # fork()

View File

@@ -27,9 +27,9 @@ test -r $UDEV_CONFIG || exit 6
case "$1" in
start)
printf "Populating ${udev_root:-/dev} using udev: "
printf "Populating %s using udev: " "${udev_root:-/dev}"
printf '\000\000\000\000' > /proc/sys/kernel/hotplug
$UDEV_BIN -d || (echo "FAIL" && exit 1)
$UDEV_BIN -d || { echo "FAIL"; exit 1; }
udevadm trigger --type=subsystems --action=add
udevadm trigger --type=devices --action=add
udevadm settle --timeout=30 || echo "udevadm settle failed"

View File

@@ -12,7 +12,7 @@ FIS_LICENSE_FILES = fis.c
define FIS_BUILD_CMDS
$(TARGET_CC) $(TARGET_CFLAGS) -std=c99 -o $(@D)/fis \
$(@D)/fis.c $(@D)/crc.c $(TARGE_LDFLAGS)
$(@D)/fis.c $(@D)/crc.c $(TARGET_LDFLAGS)
endef
define FIS_INSTALL_TARGET_CMDS

View File

@@ -1,4 +1,4 @@
# Locally calculated after checking pgp signature
# https://curl.haxx.se/download/curl-7.57.0.tar.xz.asc
sha256 f5f6fd3c72b7b8389969f4fb671ed8532fa9b5bb7a5cae7ca89bc1cea45c7878 curl-7.57.0.tar.xz
sha256 cbcf511f5702f7baf5424193a792bc9c18fab22bcbec2e6a587598389dc632c2 COPYING
# https://curl.haxx.se/download/curl-7.58.0.tar.xz.asc
sha256 6a813875243609eb75f37fa72044e4ad618b55ec15a4eafdac2df6a7e800e3e3 curl-7.58.0.tar.xz
sha256 5f3849ec38ddb927e79f514bf948890c41b8d1407286a49609b8fb1585931095 COPYING

View File

@@ -4,7 +4,7 @@
#
################################################################################
LIBCURL_VERSION = 7.57.0
LIBCURL_VERSION = 7.58.0
LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz
LIBCURL_SITE = https://curl.haxx.se/download
LIBCURL_DEPENDENCIES = host-pkgconf \

View File

@@ -243,9 +243,9 @@ config BR2_DEFAULT_KERNEL_HEADERS
default "3.4.113" if BR2_KERNEL_HEADERS_3_4
default "3.10.108" if BR2_KERNEL_HEADERS_3_10
default "3.12.74" if BR2_KERNEL_HEADERS_3_12
default "4.1.48" if BR2_KERNEL_HEADERS_4_1
default "4.4.112" if BR2_KERNEL_HEADERS_4_4
default "4.9.77" if BR2_KERNEL_HEADERS_4_9
default "4.1.49" if BR2_KERNEL_HEADERS_4_1
default "4.4.114" if BR2_KERNEL_HEADERS_4_4
default "4.9.79" if BR2_KERNEL_HEADERS_4_9
default "4.10.17" if BR2_KERNEL_HEADERS_4_10
default "4.11.12" if BR2_KERNEL_HEADERS_4_11
default "4.12.14" if BR2_KERNEL_HEADERS_4_12

View File

@@ -0,0 +1,50 @@
From 3a223ca3ebc7ac24d7726a0cd58e5695bc813657 Mon Sep 17 00:00:00 2001
From: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Date: Sat, 13 Jan 2018 21:00:47 +0100
Subject: [PATCH] CVE-2018-5704: Prevent some forms of Cross Protocol Scripting
attacks
OpenOCD can be targeted by a Cross Protocol Scripting attack from
a web browser running malicious code, such as the following PoC:
var x = new XMLHttpRequest();
x.open("POST", "http://127.0.0.1:4444", true);
x.send("exec xcalc\r\n");
This mitigation should provide some protection from browser-based
attacks and is based on the corresponding fix in Redis:
https://github.com/antirez/redis/blob/8075572207b5aebb1385c4f233f5302544439325/src/networking.c#L1758
Upstream-status: Under review: http://openocd.zylin.com/#/c/4335/
Change-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581
Signed-off-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Reported-by: Josef Gajdusek <atx@atx.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
src/server/startup.tcl | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/src/server/startup.tcl b/src/server/startup.tcl
index 64ace407..dd1b31e4 100644
--- a/src/server/startup.tcl
+++ b/src/server/startup.tcl
@@ -8,3 +8,14 @@ proc ocd_gdb_restart {target_id} {
# one target
reset halt
}
+
+proc prevent_cps {} {
+ echo "Possible SECURITY ATTACK detected."
+ echo "It looks like somebody is sending POST or Host: commands to OpenOCD."
+ echo "This is likely due to an attacker attempting to use Cross Protocol Scripting"
+ echo "to compromise your OpenOCD instance. Connection aborted."
+ exit
+}
+
+proc POST {args} { prevent_cps }
+proc Host: {args} { prevent_cps }
--
2.11.0

View File

@@ -63,6 +63,7 @@ config BR2_PACKAGE_PINENTRY_QT5
depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL
depends on !BR2_STATIC_LIBS
depends on !BR2_PACKAGE_PINENTRY_QT4
depends on !BR2_PACKAGE_QT
select BR2_PACKAGE_QT5
select BR2_PACKAGE_QT5BASE_GUI
select BR2_PACKAGE_QT5BASE_WIDGETS

View File

@@ -0,0 +1,45 @@
From 89b53fafa9904ba7a3df2ad94d01a485eae5366f Mon Sep 17 00:00:00 2001
From: Guido Trentalancia <guido@trentalancia.net>
Date: Tue, 6 Jun 2017 00:08:13 +0200
Subject: [PATCH] fc_sort: avoid compiler warning/error
Fix a "-Werror=implicit-fallthrough" compiler warning/error on
the switch statement.
This third version (v3) fixes a bug introduced in the first
version and improves the style over the second version.
Signed-off-by: Guido Trentalancia <guido at trentalancia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
support/fc_sort.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/support/fc_sort.c b/support/fc_sort.c
index 5561288a..66cdf39f 100644
--- a/support/fc_sort.c
+++ b/support/fc_sort.c
@@ -292,14 +292,16 @@ void fc_fill_data(file_context_node_t *fc_node)
/* If a escape character is found,
* skip the next character. */
c++;
+ break;
default:
- /* If no meta character has been found yet,
- * add one to the stem length. */
- if (!fc_node->meta)
- fc_node->stem_len++;
break;
}
+ /* If no meta character has been found yet,
+ * add one to the stem length. */
+ if (!fc_node->meta)
+ fc_node->stem_len++;
+
fc_node->str_len++;
c++;
}
--
2.11.0

View File

@@ -0,0 +1,35 @@
From eb2db98a676321b814fc4a51c4fb7928a8bb45d9 Mon Sep 17 00:00:00 2001
From: Amos Jeffries <yadij@users.noreply.github.com>
Date: Fri, 19 Jan 2018 13:54:14 +1300
Subject: [PATCH] ESI: make sure endofName never exceeds tagEnd (#130)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
src/esi/CustomParser.cc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/esi/CustomParser.cc b/src/esi/CustomParser.cc
index d86d2d309..db634d921 100644
--- a/src/esi/CustomParser.cc
+++ b/src/esi/CustomParser.cc
@@ -121,7 +121,7 @@ ESICustomParser::parse(char const *dataToParse, size_t const lengthOfData, bool
char * endofName = strpbrk(const_cast<char *>(tag), w_space);
- if (endofName > tagEnd)
+ if (!endofName || endofName > tagEnd)
endofName = const_cast<char *>(tagEnd);
*endofName = '\0';
@@ -214,7 +214,7 @@ ESICustomParser::parse(char const *dataToParse, size_t const lengthOfData, bool
char * endofName = strpbrk(const_cast<char *>(tag), w_space);
- if (endofName > tagEnd)
+ if (!endofName || endofName > tagEnd)
endofName = const_cast<char *>(tagEnd);
*endofName = '\0';
--
2.11.0

View File

@@ -0,0 +1,31 @@
From 8232b83d3fa47a1399f155cb829db829369fbae9 Mon Sep 17 00:00:00 2001
From: squidadm <squidadm@users.noreply.github.com>
Date: Sun, 21 Jan 2018 08:07:08 +1300
Subject: [PATCH] Fix indirect IP logging for transactions without a client
connection (#129) (#136)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
src/client_side_request.cc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index be124f355..203f89d46 100644
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -488,9 +488,9 @@ clientFollowXForwardedForCheck(allow_t answer, void *data)
* Ensure that the access log shows the indirect client
* instead of the direct client.
*/
- ConnStateData *conn = http->getConn();
- conn->log_addr = request->indirect_client_addr;
- http->al->cache.caddr = conn->log_addr;
+ http->al->cache.caddr = request->indirect_client_addr;
+ if (ConnStateData *conn = http->getConn())
+ conn->log_addr = request->indirect_client_addr;
}
request->x_forwarded_for_iterator.clean();
request->flags.done_follow_x_forwarded_for = true;
--
2.11.0

View File

@@ -1,3 +1,5 @@
# From http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.26.tar.xz.asc
md5 510e2c84773879c00d0e7ced997864d9 squid-3.5.26.tar.xz
sha1 51a664217957b35de8b7fae180b9f93a759a4204 squid-3.5.26.tar.xz
# From http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.27.tar.xz.asc
md5 39ef8199675d48a314b540f92c00c545 squid-3.5.27.tar.xz
sha1 1e69c96d13cd49844da3bcf33a0b428fbe7b6f77 squid-3.5.27.tar.xz
# Locally calculated
sha256 58f5d05257af1fb964fde20e134d660fac9afa86b6fd8c70d63ead63068378fa COPYING

View File

@@ -5,7 +5,7 @@
################################################################################
SQUID_VERSION_MAJOR = 3.5
SQUID_VERSION = $(SQUID_VERSION_MAJOR).26
SQUID_VERSION = $(SQUID_VERSION_MAJOR).27
SQUID_SOURCE = squid-$(SQUID_VERSION).tar.xz
SQUID_SITE = http://www.squid-cache.org/Versions/v3/$(SQUID_VERSION_MAJOR)
SQUID_LICENSE = GPL-2.0+

View File

@@ -1,2 +1,3 @@
# Locally calculated
sha256 3a8d045c306ad9acb7bf81126939b9594553a388482efa0ec1bfb67b22acd35f transmission-2.92.tar.xz
sha256 8815920e0a4499bcdadbbe89a4115092dab42ce5199f71ff9a926cfd12b9b90b transmission-2.93.tar.xz
sha256 20801783bf59e27d03ed6aab625b32a34e221ae95bf801db87827c8023398495 COPYING

View File

@@ -4,7 +4,7 @@
#
################################################################################
TRANSMISSION_VERSION = 2.92
TRANSMISSION_VERSION = 2.93
TRANSMISSION_SITE = https://github.com/transmission/transmission-releases/raw/master
TRANSMISSION_SOURCE = transmission-$(TRANSMISSION_VERSION).tar.xz
TRANSMISSION_DEPENDENCIES = \

View File

@@ -164,8 +164,37 @@ HOST_UTIL_LINUX_CONF_OPTS += \
ifeq ($(BR2_PACKAGE_HOST_UTIL_LINUX),y)
HOST_UTIL_LINUX_CONF_OPTS += --disable-makeinstall-chown
# disable more command because of ncurses dependency
HOST_UTIL_LINUX_CONF_OPTS += --disable-more
# disable commands that have ncurses dependency, as well as
# other ones that are useless on the host
HOST_UTIL_LINUX_CONF_OPTS += \
--disable-agetty \
--disable-chfn-chsh \
--disable-chmem \
--disable-login \
--disable-lslogins \
--disable-mesg \
--disable-more \
--disable-newgrp \
--disable-nologin \
--disable-nsenter \
--disable-pg \
--disable-rfkill \
--disable-schedutils \
--disable-setpriv \
--disable-setterm \
--disable-su \
--disable-sulogin \
--disable-tunelp \
--disable-ul \
--disable-unshare \
--disable-uuidd \
--disable-vipw \
--disable-wall \
--disable-wdctl \
--disable-write \
--disable-zramctl
# Used by cramfs utils
HOST_UTIL_LINUX_DEPENDENCIES += host-zlib
else
HOST_UTIL_LINUX_CONF_OPTS += --disable-all-programs
endif

View File

@@ -36,6 +36,7 @@ config BR2_PACKAGE_WEBKITGTK
select BR2_PACKAGE_LIBGCRYPT
select BR2_PACKAGE_LIBSECRET
select BR2_PACKAGE_LIBSOUP
select BR2_PACKAGE_LIBTASN1
select BR2_PACKAGE_LIBXML2
select BR2_PACKAGE_LIBXSLT
select BR2_PACKAGE_SQLITE

View File

@@ -1,7 +1,7 @@
# From https://webkitgtk.org/releases/webkitgtk-2.18.5.tar.xz.sums
md5 af18c2cfa00cadfd0b4d8db21cab011d webkitgtk-2.18.5.tar.xz
sha1 5f36db464f6b7bbe6a57e55bc9bb172f87a4c398 webkitgtk-2.18.5.tar.xz
sha256 0c6d80cc7eb5d32f8063041fa11a1a6f17a29765c2f69c6bc862cd47c2d539b8 webkitgtk-2.18.5.tar.xz
# From https://webkitgtk.org/releases/webkitgtk-2.18.6.tar.xz.sums
md5 c1a548595135ee75ad3bf2e18ac83112 webkitgtk-2.18.6.tar.xz
sha1 fb0daa85142cfe8822de518dfaa7bd5c3cdd6c23 webkitgtk-2.18.6.tar.xz
sha256 93912cc2f40f12e452be1ca4babdbdaac0ec4f828d441257a6b06c2963bbac3c webkitgtk-2.18.6.tar.xz
# Hashes for license files:
sha256 0b5d3a7cc325942567373b0ecd757d07c132e0ebd7c97bfc63f7e1a76094edb4 Source/WebCore/LICENSE-APPLE

View File

@@ -4,7 +4,7 @@
#
################################################################################
WEBKITGTK_VERSION = 2.18.5
WEBKITGTK_VERSION = 2.18.6
WEBKITGTK_SITE = http://www.webkitgtk.org/releases
WEBKITGTK_SOURCE = webkitgtk-$(WEBKITGTK_VERSION).tar.xz
WEBKITGTK_INSTALL_STAGING = YES
@@ -14,7 +14,7 @@ WEBKITGTK_LICENSE_FILES = \
Source/WebCore/LICENSE-LGPL-2.1
WEBKITGTK_DEPENDENCIES = host-ruby host-flex host-bison host-gperf \
enchant harfbuzz icu jpeg libgcrypt libgtk3 libsecret libsoup \
libxml2 libxslt sqlite webp
libtasn1 libxml2 libxslt sqlite webp
WEBKITGTK_CONF_OPTS = \
-DENABLE_API_TESTS=OFF \
-DENABLE_GEOLOCATION=OFF \

View File

@@ -1,2 +1,4 @@
# From: https://www.wireshark.org/download/src/all-versions/SIGNATURES-2.2.11.txt
sha256 a9f11621e85d7e1d72259157edd94825e72af3fd72e184b8474459f92ad5fc40 wireshark-2.2.11.tar.bz2
# From: https://www.wireshark.org/download/src/all-versions/SIGNATURES-2.2.12.txt
sha256 3274458d1bb1658a5001465ecb07c7cbfc709571ef36bd062897570d4bab3ebc wireshark-2.2.12.tar.bz2
# Locally calculated
sha256 7cdbed2b697efaa45576a033f1ac0e73cd045644a91c79bbf41d4a7d81dac7bf COPYING

View File

@@ -4,7 +4,7 @@
#
################################################################################
WIRESHARK_VERSION = 2.2.11
WIRESHARK_VERSION = 2.2.12
WIRESHARK_SOURCE = wireshark-$(WIRESHARK_VERSION).tar.bz2
WIRESHARK_SITE = https://www.wireshark.org/download/src/all-versions
WIRESHARK_LICENSE = wireshark license