libcamera has moved for a while now to gitlab.freedesktop.org. The
mirror on git.linuxtv.org is still active, but it isn't the canonical
repository and has less bandwidth than freedesktop.org. Switch the
libcamera source URL to gitlab.freedesktop.org.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
[Julien: removed trailing slash in _SITE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add upstream commit to buildroot to fix build errors introduced by the
upcoming bump of acl to 2.4.0:
https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html
"Compatibility Notes
- libacl now exports the new functions acl_get_file_at(),
acl_set_file_at(), acl_delete_def_file_at(), and acl_extended_file_at(),
which are declared in <sys/acl.h>. This may cause conflicts in programs
that define functions of the same name and link against libacl.
One such program is GNU tar which defines its own versions of functions
like acl_get_file_at(). The fix is to rename those functions. (In the
case if GNU tar, a fix is already on the way.)"
This patch will also fix build errors seen on the autobuilders for
host-tar on hosts which already provide acl >= 2.4.0.
Fixes:
https://autobuild.buildroot.net/results/478/478a9781f481df7cf2eecda80a4c13f900a0dc80/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: server: Don't allow -B (accept blank password) with
-t (two factor auth). If run with -t and -B a user configured with a
blank password would be allowed to log in without pubkey auth.
23ec782856
Reported by nvidia
- Security: server: Fix parsing of long authorized_keys lines.
The remainder of a long line would be handled as the start of a new line.
In the case where external programs add semi-trusted public keys to
authorized_keys, a crafted key might bypass restrictions such as "command=".
8d8e1930b8
Reported by nvidia
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Debian 12 Bookworm snapshot we use, 20250203, uses the new deb822
format [0] for source list files; it carries a source list file that
points to the current repository, not to the snapshot.
Even though we do inject an old-style source list that points to the
snapshot repository, the packages in the current repository are more
recent than the one in the snapshot, so when we install our packages,
they get retrieved mostly from the current repository rather than from
the snapshot. The image is not reproducible.
Switch to using the new deb822-style source list file.
Note: we do not need to carry the "Latest just before" trick: the
snapshot repository will use the most recent actual snapshot before the
requested dated, so we can just use the date of the image we use (stuck
at midnight because we don't have better).
Since the snapshot repository can be really slow, while at the same time
the remote http server not dropping connections, it can take a very long
while to build the image; add a timeout so that stale connections are
detected and re-attemped early-ish (the timeout applies to both the
connect and the actual download, so it should be large enough to
accomodate slowish network connections).
Fixes: c95d5b8e1e (support/docker: move to current bookworm (Debian
12) snapshot)
[0] https://manpages.debian.org/trixie/apt/sources.list.5.en.html#DEB822-STYLE_FORMAT
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Commit da9dcddff1 (package/mosquitto: requires cmake >= 4.3) added
a requirement against cmake 4.3 for the target variant, but forgot
to add the same requirement to the host variant.
Do so, for the same reasons as reported for the target variant in
da9dcddff1.
Fixes: da9dcddff1
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
https://www.openssh.org/releasenotes.html#10.4p1
Changes since OpenSSH 10.3
==========================
This release contains a number of security fixes as well as general
bugfixes and a couple of new features.
Security
========
* sftp(1): when downloading files on the command-line using
"sftp host:/path .", a malicious server could cause the file to
be downloaded to an unexpected location. This issue was identified
by the Swival Security Scanner.
* scp(1): when copying files between two remote destinations, do
not allow a malicious server to write files to the parent
directory of the intended target directory. This issue was
identified by the Swival Security Scanner.
* sshd(8): when using the "internal-sftp" SFTP server implementation
(this is not the default), long command lines were previously
truncated silently after the 9th argument. If a security-relevant
option was in the 10th or later position, it would be discarded.
Reported by Steve Caffrey.
* sshd(8): add a documentation note to mention that the
GSSAPIStrictAcceptorCheck option is ineffective when the server
is joined to a Windows Active Directory. Reported by Yarin Aharoni
of Safebreach.
* sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
as it was documented to do. Note that PermitTunnel is not enabled
by default. Reported independently by Huzaifa Sidhpurwala of
Redhat and Marko Jevtic.
* sshd(8): avoid a potential pre-authentication denial of service
when GSSAPIAuthentication was enabled (this feature is off by
default). This was not mitigated by MaxAuthTries, but would be
penalised by PerSourcePenalties. This was reported by Manfred
Kaiser of the milCERT AT (Austrian Ministry of Defence).
* sshd(8): fix a number of cases where the minimum authentication
delay was not being enforced. Reported by the Orange Cyberdefense
Vulnerability Team.
* ssh(1): fix a possible client-side use-after-free if the server
changes its host key during a key reexchange. This was reported by
Zhenpeng (Leo) Lin of Depthfirst.
[...]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit cc5c36afff bumped fmt to
version 12.2.0 which breaks the gerbera build. To fix the problem we add
two upstream patches.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release notes:
https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
Fixes the following security issues:
https://webkitgtk.org/security/WSA-2026-0003.html
Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, and CVE-2026-43660.
Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
UEFI platforms with a Devicetree have recently gained support for some form
of network booting. [1][2]
On those platforms, the UEFI firmware downloads the disk image over the
network and presents it to UEFI applications using the simple filesystem
protocol. This is sufficient for OS loaders such as e.g. GRUB to find their
configuration and load the kernel image.
The firmware must also describe the ramdisk to the OS, so that it finds its
root filesystem. On ACPI based platforms this is done with an NVDIMM
Firmware Interface Table (NFIT). On Devicetree based platforms, this can be
done with a pmem node. [3]
Add a kernel config fragment to add pmem support, which enables network
boot on UEFI platforms with Devicetree.
Also, briefly mention that we support this scenario in the readme.
This can be tested on Qemu, with the following procedure:
Build aarch64_efi_defconfig in a folder, to obtain output/images/disk.img,
and serve the image over HTTP with python:
$ python -m http.server -d output/images/
In another terminal and another folder, configure a U-Boot based firmware
starting from qemu_aarch64_ebbr_defconfig, and with the following
additional configurations:
BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.04"
BR2_TARGET_UBOOT_NEEDS_DTC=y
Add the following U-Boot configurations to
board/qemu/aarch64-ebbr/u-boot.fragment:
CONFIG_EFI_HTTP_BOOT=y
CONFIG_NET_LWIP=y
Build everything; you should obtain output/images/flash.bin.
Start Qemu as per board/qemu/aarch64-ebbr/readme.txt, but omitting the hd0
-device and -drive stanzas.
U-Boot should start; interrupt it with enter.
At U-Boot prompt, type the following commands:
=> setenv loadaddr 0x43000000
=> efidebug boot rm 0
=> efidebug boot add -u 0 net http://10.0.2.2:8000/disk.img
=> efidebug boot order 0
=> bootefi bootmgr
U-Boot should download the disk image over HTTP and boot Linux with UEFI.
Look for the following message in Linux boot log, to confirm that it did
indeed mount its rootfs from the downloaded image:
EXT4-fs (pmem0p2): mounted filesystem ...
Link: https://www.linaro.org/blog/installing-fedora-with-uefi-http-boot/ [1]
Link: https://docs.u-boot-project.org/en/latest/develop/uefi/uefi.html#uefi-http-boot-using-the-legacy-tcp-stack [2]
Link: https://github.com/ARM-software/edge-iot-arch-guide/blob/main/source/http-boot/pmem_node.md [3]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerability:
- CVE-2025-64503:
cups-filters contains backends, filters, and other software required
to get the cups printing service working on operating systems other
than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
`pdftoraster` tool to write beyond the bounds of an array. First, a
PDF with a large `MediaBox` width value causes `header.cupsWidth` to
become large. Next, the calculation of `bytesPerLine =
(header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
resulting in a small value. Then, `lineBuf` is allocated with the
small `bytesPerLine` size. Finally, `convertLineChunked` calls
`writePixel8`, which attempts to write to `lineBuf` outside of its
buffer size (out of bounds write). In libcupsfilters, the maintainers
found the same `bytesPerLine` multiplication without overflow check,
but the provided test case does not cause an overflow there, because
the values are different. Commit
50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
incorporated into cups-filters version 1.28.18.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64503
- 50d94ca0f2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerability:
- CVE-2026-34933:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4,
any unprivileged local user can crash avahi-daemon by sending a single
D-Bus method call with conflicting publish flags. This issue has been
patched in version 0.9-rc4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-34933
- 0be89b6bb5
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream v85 no longer requires the -Dfwctl=enabled / -Dkeyutils=enabled
workaround, so drop both options along with the stale comment.
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://blog.clamav.net/2026/07/clamav-153-and-145-security-patch.html
Fixes CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243 & CVE-2026-20244.
"Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency
to resolve CVE-2026-41676."
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Removed patch which is included in this bump.
Fixes CVE-2026-5435, CVE-2026-6238 & CVE-2026-6791.
git shortlog 4070d808bea1c077eb7e7d52b52b91cae98205d5..
Adhemerval Zanella (3):
math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
Florian Weimer (8):
iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
resolv: Declare __p_class_syms, __p_type_syms for internal use
resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
resolv: Improve formatting of unknown records in ns_sprintrrf
resolv: Check for inet_ntop failure in ns_sprintrrf
resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
Jakub Jelinek (1):
Rename __unused fields to __glibc_reserved.
John David Anglin (1):
hppa: Fix missing call to __feraiseexcept (BZ 34306)
Pino Toscano (1):
Hurd: comment PF_LINK/AF_LINK defines
Sam James (1):
elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
Samuel Thibault (3):
Hurd: comment PF_ROUTE/AF_ROUTE defines
Hurd: comment ioctls which cannot currently compile
Hurd: restore some SIOC ioctls
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The 'mlkem.h' header is no longer present in wolfssl v5.9.2 [1] and the
content was merged in the 'wc_mlkem.h' header.
[1] 7a2cf5b655
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since the bump of autoconf to version 2.73 in commit a6e8c07a33,
the TestApache test fails on CI runners (and in autobuilders [2]) with
our current docker image (GCC 12.2.0) :
gcc: error: unrecognized command-line option '-std=gnu23'; did you mean '-std=gnu2x'?
make[3]: *** [Makefile:136: tools/gen_test_char] Error 1
Autoconf 2.73 introduced checks for the C23 standard [1]. During the
configuration step, it tests the target compiler. If the target compiler
supports it (e.g., GCC 14+), autoconf caches `ac_cv_prog_cc_c23=yes`
and appends `-std=gnu23` to the compiler flags.
Later in the process, APR uses the `AX_PROG_CC_FOR_BUILD` macro to
configure the host compiler in order to build the `gen_test_char`
utility. However, APR's `ax_prog_cc_for_build.m4` macro uses a
pushdef/popdef mechanism that only isolates older C standards.
It fails to isolate the newly introduced `ac_cv_prog_cc_c23` variable
because the ax_prog_cc_for_build.m4 file was not updated to handle it.
As a result, the host compiler evaluation reads the target's cached
variables, assumes the host compiler also supports C23 (which it may not),
and attempts to use `-std=gnu23`. If the host compiler
(e.g., GCC 12 on GitLab CI) is older, the build crashes.
To fix this without heavily patching APR's m4 macros, we explicitly
disable the C23 standard detection for the host compiler in APR_CONF_ENV
when GCC<14. Since APR is a mature project that does not require C23
features, preventing its use here is a safe and robust workaround.
Doing so will not disable C23 for the target build if the target compiler
is GCC 14+; it will only prevent the host compiler from using it when
building APR's tools; according to the build logs, ac_cv_prog_cc_c23
will be set to "no" for the target compiler if it does not support C23,
and will be set to "-std=gnu23" if it does.
It's important to note that this error could also occur with other
packages that use autotools-package if "AUTORECONF" is set to "yes".
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/15112315884
[1] https://gcc.gnu.org/cgit/gcc/commit/?id=fad61bf73b3158157a136bf4d9373fc3d9afe319
[2] https://autobuild.buildroot.org/results/d7d/d7d2703e42034d9c11de89b2b3b6cf401f677aa3
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Changes with nginx 1.30.3
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers off;"
and "large_client_header_buffers" with large configured values when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
a limited disclosure of worker process memory or segmentation fault
in a worker process (CVE-2026-48142).
Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
