mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
f6e0ad3858
This fixes the following vulnerabilities:
- CVE-2026-29111 (fixed in 258.5):
systemd, a system and service manager, (as PID 1) hits an assert and
freezes execution when an unprivileged IPC API call is made with
spurious data. On version v249 and older the effect is not an assert,
but stack overwriting, with the attacker controlled content. From
version v250 and newer this is not possible as the safety check causes
an assert instead. This IPC call was added in v239, so versions older
than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11
contain patches. No known workarounds are available.
https://www.cve.org/CVERecord?id=CVE-2026-29111
- CVE-2026-40226 (fixed in 258.6):
In nspawn in systemd 233 through 259 before 260, an escape-to-host
action can occur via a crafted optional config file.
https://www.cve.org/CVERecord?id=CVE-2026-40226
https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Marcus: note which minor versions included the respective security fixes]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
17 lines
1.5 KiB
Plaintext
17 lines
1.5 KiB
Plaintext
# sha256 locally computed
|
|
sha256 6bd311c25f00d634ae3b4544d582e27df0d4166e6ba3d403b18b3129d7f44cae systemd-258.7.tar.gz
|
|
sha256 ac4985facb553559981f507982444d779115e3e3a4c8b7847ae956198490c1b3 LICENSE.GPL2
|
|
sha256 6d9bb3b7fc818a8facc4cc296060a0883fef8710d6498f86165335846e82ee9d LICENSE.LGPL2.1
|
|
sha256 c9e7bf5b7c243c719b8b43c36158effb9b54c5e80abc9d82e4b2d4b2a4aa64ad LICENSES/alg-sha1-public-domain.txt
|
|
sha256 e5a8645ad94aab24e312dd0c6be2aa54236eb9374480b1b14ea5c61598874fd5 LICENSES/BSD-2-Clause.txt
|
|
sha256 83bb6bd9ccd2cf5230cb1807ed16258289768dc4d9cb80069a814e04415a1275 LICENSES/BSD-3-Clause.txt
|
|
sha256 a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499 LICENSES/CC0-1.0.txt
|
|
sha256 c7e6735d511987e7ed4c4a08b335d578335088e06225955ec8944973dbc0640c LICENSES/LGPL-2.0-or-later.txt
|
|
sha256 5bcef4fedbfc08776630e65d5d0d074dd31208037eddb167ca46a9ec4f737764 LICENSES/Linux-syscall-note.txt
|
|
sha256 790ac93fb2859097bdda4cf08b5a4feb5e479d0cb2c74f403248241bc3e7c216 LICENSES/lookup3-public-domain.txt
|
|
sha256 8a6fc0879cecc0b96bf4c08159b9d733bf0f15fcf32879aec98c4ffd05424554 LICENSES/MIT-0.txt
|
|
sha256 b85dcd3e453d05982552c52b5fc9e0bdd6d23c6f8e844b984a88af32570b0cc0 LICENSES/MIT.txt
|
|
sha256 2a98749f6bec00dfaed86fa9c1edea871aaae4f11ee4d100b671aaf4ce353a73 LICENSES/murmurhash2-public-domain.txt
|
|
sha256 1a7adaa2c86cedfd6c7f5c0c7c72fd6d3e02cd0c9593f21fdb53c89bb2b130ec LICENSES/OFL-1.1.txt
|
|
sha256 bce1d2e9bad517b493168b37604c5d02a7fb638b4d1b9fc730adafa06c603456 LICENSES/README.md
|