From ce9ed75bbcc12dd8dc4dee2bdbaffe2f8bf240f8 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Tue, 7 Jul 2026 20:52:07 +0200 Subject: [PATCH 1/4] package/dropbear: security bump version to 2026.92 https://matt.ucc.asn.au/dropbear/CHANGES - Security: server: Don't allow -B (accept blank password) with -t (two factor auth). If run with -t and -B a user configured with a blank password would be allowed to log in without pubkey auth. https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740 Reported by nvidia - Security: server: Fix parsing of long authorized_keys lines. The remainder of a long line would be handled as the start of a new line. In the case where external programs add semi-trusted public keys to authorized_keys, a crafted key might bypass restrictions such as "command=". https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6 Reported by nvidia Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- package/dropbear/dropbear.hash | 2 +- package/dropbear/dropbear.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/dropbear/dropbear.hash b/package/dropbear/dropbear.hash index 31ac153b89f..9df81ea4b58 100644 --- a/package/dropbear/dropbear.hash +++ b/package/dropbear/dropbear.hash @@ -1,5 +1,5 @@ # From https://matt.ucc.asn.au/dropbear/releases/SHA256SUM.asc -sha256 defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34 dropbear-2026.91.tar.bz2 +sha256 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e dropbear-2026.92.tar.bz2 # License file, locally computed sha256 a99ce657d790b761c132ee7e0de18edb437ae6361e536d991c6a12f36e770445 LICENSE diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk index a7de8432afc..e7e6703057a 100644 --- a/package/dropbear/dropbear.mk +++ b/package/dropbear/dropbear.mk @@ -4,7 +4,7 @@ # ################################################################################ -DROPBEAR_VERSION = 2026.91 +DROPBEAR_VERSION = 2026.92 DROPBEAR_SITE = https://matt.ucc.asn.au/dropbear/releases DROPBEAR_SOURCE = dropbear-$(DROPBEAR_VERSION).tar.bz2 DROPBEAR_LICENSE = MIT, BSD-2-Clause, Public domain From e7a6967d280be1bd8461f9c924852d47635348ef Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Wed, 8 Jul 2026 21:39:38 +0200 Subject: [PATCH 2/4] package/tar: fix build with acl-2.4.0 Add upstream commit to buildroot to fix build errors introduced by the upcoming bump of acl to 2.4.0: https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html "Compatibility Notes - libacl now exports the new functions acl_get_file_at(), acl_set_file_at(), acl_delete_def_file_at(), and acl_extended_file_at(), which are declared in . This may cause conflicts in programs that define functions of the same name and link against libacl. One such program is GNU tar which defines its own versions of functions like acl_get_file_at(). The fix is to rename those functions. (In the case if GNU tar, a fix is already on the way.)" This patch will also fix build errors seen on the autobuilders for host-tar on hosts which already provide acl >= 2.4.0. Fixes: https://autobuild.buildroot.net/results/478/478a9781f481df7cf2eecda80a4c13f900a0dc80/ Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- ...0004-Avoid-acl_-prefix-for-functions.patch | 104 ++++++++++++++++++ 1 file changed, 104 insertions(+) create mode 100644 package/tar/0004-Avoid-acl_-prefix-for-functions.patch diff --git a/package/tar/0004-Avoid-acl_-prefix-for-functions.patch b/package/tar/0004-Avoid-acl_-prefix-for-functions.patch new file mode 100644 index 00000000000..aebdc6b2d80 --- /dev/null +++ b/package/tar/0004-Avoid-acl_-prefix-for-functions.patch @@ -0,0 +1,104 @@ +From 08c3fc2e9337094aff01a511170fd35fdb8f1ee3 Mon Sep 17 00:00:00 2001 +From: Pavel Cahyna +Date: Wed, 24 Jun 2026 18:45:30 +0200 +Subject: [PATCH] Avoid acl_ prefix for functions + +The acl.h header from libacl uses acl_ prefix for its functions. Avoid +defining functions with the same name in order to protect its namespace. + +Upstream: https://cgit.git.savannah.gnu.org/cgit/tar.git/commit/?id=08c3fc2e9337094aff01a511170fd35fdb8f1ee3 + +[Bernd: backported to version 1.35] +Signed-off-by: Bernd Kuhls +--- + src/xattrs.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/src/xattrs.c b/src/xattrs.c +index 4f5872c1..f98e8e0f 100644 +--- a/src/xattrs.c ++++ b/src/xattrs.c +@@ -139,13 +139,13 @@ static struct + #ifdef HAVE_POSIX_ACLS + + /* acl-at wrappers, TODO: move to gnulib in future? */ +-static acl_t acl_get_file_at (int, const char *, acl_type_t); +-static int acl_set_file_at (int, const char *, acl_type_t, acl_t); ++static acl_t tar_acl_get_file_at (int, const char *, acl_type_t); ++static int tar_acl_set_file_at (int, const char *, acl_type_t, acl_t); + static int file_has_acl_at (int, char const *, struct stat const *); +-static int acl_delete_def_file_at (int, char const *); ++static int tar_acl_delete_def_file_at (int, char const *); + +-/* acl_get_file_at */ +-#define AT_FUNC_NAME acl_get_file_at ++/* tar_acl_get_file_at */ ++#define AT_FUNC_NAME tar_acl_get_file_at + #define AT_FUNC_RESULT acl_t + #define AT_FUNC_FAIL (acl_t)NULL + #define AT_FUNC_F1 acl_get_file +@@ -159,8 +159,8 @@ static int acl_delete_def_file_at (int, char const *); + #undef AT_FUNC_POST_FILE_PARAM_DECLS + #undef AT_FUNC_POST_FILE_ARGS + +-/* acl_set_file_at */ +-#define AT_FUNC_NAME acl_set_file_at ++/* tar_acl_set_file_at */ ++#define AT_FUNC_NAME tar_acl_set_file_at + #define AT_FUNC_F1 acl_set_file + #define AT_FUNC_POST_FILE_PARAM_DECLS , acl_type_t type, acl_t acl + #define AT_FUNC_POST_FILE_ARGS , type, acl +@@ -170,8 +170,8 @@ static int acl_delete_def_file_at (int, char const *); + #undef AT_FUNC_POST_FILE_PARAM_DECLS + #undef AT_FUNC_POST_FILE_ARGS + +-/* acl_delete_def_file_at */ +-#define AT_FUNC_NAME acl_delete_def_file_at ++/* tar_acl_delete_def_file_at */ ++#define AT_FUNC_NAME tar_acl_delete_def_file_at + #define AT_FUNC_F1 acl_delete_def_file + #define AT_FUNC_POST_FILE_PARAM_DECLS + #define AT_FUNC_POST_FILE_ARGS +@@ -299,10 +299,10 @@ + /* No "default" IEEE 1003.1e ACL set for directory. At this moment, + FILE_NAME may already have inherited default acls from parent + directory; clean them up. */ +- if (acl_delete_def_file_at (chdir_fd, file_name)) ++ if (tar_acl_delete_def_file_at (chdir_fd, file_name)) + WARNOPT (WARN_XATTR_WRITE, + (0, errno, +- _("acl_delete_def_file_at: Cannot drop default POSIX ACLs " ++ _("tar_acl_delete_def_file_at: Cannot drop default POSIX ACLs " + "for file '%s'"), + file_name)); + return; +@@ -316,11 +316,11 @@ + return; + } + +- if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1) ++ if (tar_acl_set_file_at (chdir_fd, file_name, type, acl) == -1) + /* warn even if filesystem does not support acls */ + WARNOPT (WARN_XATTR_WRITE, + (0, errno, +- _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"), ++ _ ("tar_acl_set_file_at: Cannot set POSIX ACLs for file '%s'"), + file_name)); + + acl_free (acl); +@@ -357,10 +357,10 @@ acls_get_text (int parentfd, const char *file_name, acl_type_t type, + char *val = NULL; + acl_t acl; + +- if (!(acl = acl_get_file_at (parentfd, file_name, type))) ++ if (!(acl = tar_acl_get_file_at (parentfd, file_name, type))) + { + if (errno != ENOTSUP) +- call_arg_warn ("acl_get_file_at", file_name); ++ call_arg_warn ("tar_acl_get_file_at", file_name); + return; + } + +-- +2.47.3 + From c804ebff5502eac6e7d84129bfb2becc400898c6 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Wed, 8 Jul 2026 21:39:39 +0200 Subject: [PATCH 3/4] package/attr: security bump version to 2.6.0 https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html Fixes CVE-2026-54369, CVE-2026-54370 and CVE-2026-54371. Removed patches which are included in this release. Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- ...dd-detection-of-symver-gcc-attribute.patch | 75 ------------------- ...-missing-libgen.h-include-for-basena.patch | 32 -------- package/attr/attr.hash | 2 +- package/attr/attr.mk | 6 +- 4 files changed, 2 insertions(+), 113 deletions(-) delete mode 100644 package/attr/0002-configure.ac-add-detection-of-symver-gcc-attribute.patch delete mode 100644 package/attr/0003-tools-attr.c-Add-missing-libgen.h-include-for-basena.patch diff --git a/package/attr/0002-configure.ac-add-detection-of-symver-gcc-attribute.patch b/package/attr/0002-configure.ac-add-detection-of-symver-gcc-attribute.patch deleted file mode 100644 index ee029e9735b..00000000000 --- a/package/attr/0002-configure.ac-add-detection-of-symver-gcc-attribute.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 365426c28f8bf73d34d77cc06b7d5ffeae17f13a Mon Sep 17 00:00:00 2001 -From: Thomas Petazzoni -Date: Tue, 6 Feb 2024 15:33:15 +0100 -Subject: [PATCH] configure.ac: add detection of symver gcc attribute - -On non-ELF platforms, such as microblaze, builds will fail when trying -to add symver information because __attribute__((symver ..)) is not -supported even though __has_attribute(__symver__) returns true. - -Support for symver needs to be detected via a compile test since -__has_attribute can report false positives [0]. - -Add a configure compile check for __attribute__((symver ..)) to ensure -it is supported and define a variable to advertise support. - -[0] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101766#c1 - -Upstream: https://git.savannah.nongnu.org/cgit/attr.git/commit/?id=943c776089dbb24ebbfb7432ba9841f1845bf95a - -Signed-off-by: Thomas Petazzoni -[Giulio: rework local patch for #if nesting] -Signed-off-by: Giulio Benetti ---- - configure.ac | 15 +++++++++++++++ - libattr/syscalls.c | 8 ++++---- - 2 files changed, 19 insertions(+), 4 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 7e362e9..98477b5 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -57,6 +57,21 @@ AS_CASE([$host_os], - [linux*], [os_linux=yes]) - AM_CONDITIONAL([OS_LINUX], [test "x$os_linux" = "xyes"]) - -+AC_CACHE_CHECK(whether __attribute__((__symver__())) is supported, -+ gcc_cv_symver_attribute, -+ [cat > conftest.c </dev/null 2>&1; then \ -+ gcc_cv_symver_attribute=yes -+ fi -+ rm -f conftest.[cs] -+]) -+AS_IF([test $gcc_cv_symver_attribute = yes], -+ [AC_DEFINE(HAVE_SYMVER_ATTRIBUTE, [], [GCC supports symver attribute])]) -+ - AC_CONFIG_COMMANDS([include/attr], - [dnl - rm -rf include/attr -diff --git a/libattr/syscalls.c b/libattr/syscalls.c -index 907560a..7ee6d39 100644 ---- a/libattr/syscalls.c -+++ b/libattr/syscalls.c -@@ -31,10 +31,10 @@ - * prefer symver attribute if available (since gcc 10), - * fall back to traditional .symver asm directive otherwise. - */ --#ifdef __has_attribute --# if __has_attribute(__symver__) --# define SYMVER(cn, vn) __typeof(cn) cn __attribute__((__symver__(vn))) --# elif __has_attribute(__no_reorder__) -+#if defined(HAVE_SYMVER_ATTRIBUTE) -+# define SYMVER(cn, vn) __typeof(cn) cn __attribute__((__symver__(vn))) -+#elif defined(__has_attribute) -+# if __has_attribute(__no_reorder__) - /* - * Avoid wrong partitioning with older gcc and LTO. May not work reliably - * with all versions; use -flto-partition=none if you encounter problems. --- -2.34.1 - diff --git a/package/attr/0003-tools-attr.c-Add-missing-libgen.h-include-for-basena.patch b/package/attr/0003-tools-attr.c-Add-missing-libgen.h-include-for-basena.patch deleted file mode 100644 index 304177257c2..00000000000 --- a/package/attr/0003-tools-attr.c-Add-missing-libgen.h-include-for-basena.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 8a80d895dfd779373363c3a4b62ecce5a549efb2 Mon Sep 17 00:00:00 2001 -From: "Haelwenn (lanodan) Monnier" -Date: Sat, 30 Mar 2024 10:17:10 +0100 -Subject: [PATCH] tools/attr.c: Add missing libgen.h include for basename(3) - -Fixes compilation issue with musl and modern C99 compilers. - -See: https://bugs.gentoo.org/926294 - -Upstream: https://git.savannah.nongnu.org/cgit/attr.git/commit/?id=8a80d895dfd779373363c3a4b62ecce5a549efb2 - -Signed-off-by: Yegor Yefremov -Signed-off-by: Romain Naour ---- - tools/attr.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/tools/attr.c b/tools/attr.c -index f12e4af..6a3c1e9 100644 ---- a/tools/attr.c -+++ b/tools/attr.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - - #include - --- -2.45.0 - diff --git a/package/attr/attr.hash b/package/attr/attr.hash index f63c0e312a8..be858a663ff 100644 --- a/package/attr/attr.hash +++ b/package/attr/attr.hash @@ -1,5 +1,5 @@ # Locally calculated after checking pgp signature -sha256 f2e97b0ab7ce293681ab701915766190d607a1dba7fae8a718138150b700a70b attr-2.5.2.tar.xz +sha256 6c8a2148a7b85043b68492bce43316b0e2e214fc4e628c7ede078e76e216330b attr-2.6.0.tar.xz # Locally calculated sha256 98f318493be6b08bff3cd295791cde06c54e17882a3c74a1ed245eaa02533d52 doc/COPYING diff --git a/package/attr/attr.mk b/package/attr/attr.mk index 1d24144f46e..f9bdfa930f2 100644 --- a/package/attr/attr.mk +++ b/package/attr/attr.mk @@ -4,16 +4,12 @@ # ################################################################################ -ATTR_VERSION = 2.5.2 +ATTR_VERSION = 2.6.0 ATTR_SOURCE = attr-$(ATTR_VERSION).tar.xz ATTR_SITE = http://download.savannah.gnu.org/releases/attr ATTR_LICENSE = GPL-2.0+ (programs), LGPL-2.1+ (libraries) ATTR_LICENSE_FILES = doc/COPYING doc/COPYING.LGPL ATTR_CPE_ID_VALID = YES - -# Flag added for patch dealing with symver in configure.ac -ATTR_AUTORECONF = YES - ATTR_INSTALL_STAGING = YES ATTR_CONF_OPTS = --disable-nls From d1111db6fc1b96579d799acba3edc177de9dc7a9 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Wed, 8 Jul 2026 21:39:40 +0200 Subject: [PATCH 4/4] package/acl: security bump version to 2.4.0 https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html Fixes CVE-2026-54369, CVE-2026-54370 and CVE-2026-54371. Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- package/acl/acl.hash | 2 +- package/acl/acl.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/acl/acl.hash b/package/acl/acl.hash index a6094fb985c..bca535af596 100644 --- a/package/acl/acl.hash +++ b/package/acl/acl.hash @@ -1,5 +1,5 @@ # Locally calculated after checking pgp signature -sha256 97203a72cae99ab89a067fe2210c1cbf052bc492b479eca7d226d9830883b0bd acl-2.3.2.tar.xz +sha256 e661131456d2708a01c614a0f400e11d7d1bfaeb6f3e74b75bb980b72f0161a3 acl-2.4.0.tar.xz # Locally calculated sha256 a45a845012742796534f7e91fe623262ccfb99460a2bd04015bd28d66fba95b8 doc/COPYING diff --git a/package/acl/acl.mk b/package/acl/acl.mk index 6ae0581ef5d..f311526be6d 100644 --- a/package/acl/acl.mk +++ b/package/acl/acl.mk @@ -4,7 +4,7 @@ # ################################################################################ -ACL_VERSION = 2.3.2 +ACL_VERSION = 2.4.0 ACL_SOURCE = acl-$(ACL_VERSION).tar.xz ACL_SITE = https://download.savannah.nongnu.org/releases/acl ACL_LICENSE = GPL-2.0+ (programs), LGPL-2.1+ (libraries)