Commit Graph
242 Commits
Author SHA1 Message Date
Peter Korsgaard fa5f56a06b package/php: security bump version to 7.4.26
Changelog: https://www.php.net/ChangeLog-8.php#7.4.26

Fixes CVE-2021-21707: http://bugs.php.net/79971

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-06 23:19:54 +01:00
Peter Korsgaard 8c9111ca6e package/php: security bump to version 7.4.25
Fixes the following security issue:

- CVE-2021-21703: n PHP versions 7.3.x up to and including 7.3.31, 7.4.x
  below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main
  FPM daemon process running as root and child worker processes running as
  lower-privileged users, it is possible for the child processes to access
  memory shared with the main process and write to it, modifying it in a way
  that would cause the root process to conduct invalid memory reads and
  writes, which can be used to escalate privileges from local unprivileged
  user to the root user.

  For more details, see https://www.ambionics.io/blog/php-fpm-local-root

https://www.php.net/ChangeLog-7.php#7.4.25

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-26 21:08:40 +02:00
Peter Korsgaard d930e0f666 package/php: security bump version to 7.4.24
Changelog: https://www.php.net/ChangeLog-7.php#7.4.24

Fixes CVE-2021-21706: https://bugs.php.net/bug.php?id=81420

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-09 13:40:38 +02:00
Peter Korsgaard 9c1b9ec84b package/php: security bump version to 7.4.23
Quoting https://www.php.net/
"This is a security fix release."

Changelog: https://www.php.net/ChangeLog-7.php#7.4.23

CVE-ID were not mentioned in any of the fixed bugs.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 22:37:07 +02:00
Peter Korsgaard e2e41341c6 package/php: security bump version to 7.4.22
Changelog: https://www.php.net/ChangeLog-7.php#7.4.22

Fixes CVE-2021-21704 & CVE-2021-217045.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-08-05 22:37:43 +02:00
Bernd Kuhls 0d94978371 package/php: bump version to 7.4.20
Changelog: https://www.php.net/ChangeLog-7.php#7.4.20

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f42a500e41)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-07-09 22:47:27 +02:00
Bernd Kuhls a2a1768d2a package/php: bump version to 7.4.19
Changelog: https://www.php.net/ChangeLog-7.php#7.4.19

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f4d0191689)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-12 08:05:29 +02:00
Bernd Kuhls e1d492f17f package/php: security bump version to 7.4.18
Changelog: https://www.php.net/ChangeLog-7.php#7.4.18

Release notes: https://www.php.net/releases/7_4_18.php

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ac3234acd8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-01 14:21:23 +02:00
Bernd Kuhls c14462adc6 package/php: bump version to 7.4.16
Changelog: https://www.php.net/ChangeLog-7.php#7.4.16

Update license hash due to copyright year bump:
http://git.php.net/?p=php-src.git;a=commitdiff;h=8c04944b66fd4a4fa88e54b65a2391397998c51d

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 92797a8923)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-04-03 09:44:30 +02:00
Bernd Kuhls c0ed274ffa package/php: security bump version to 7.4.15
Changelog: https://www.php.net/ChangeLog-7.php#7.4.15

Fixes CVE-2021-21702: http://bugs.php.net/80672

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-04 22:10:58 +01:00
Fabrice Fontaine 85dc033f24 package/php: add PHP_CPE_ID_VENDOR
cpe:2.3:a:php:php is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aphp%3Aphp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-01-18 21:49:12 +01:00
Bernd Kuhls 2136d7ca5c package/php: security bump version to 7.4.14
Fixes CVE-2020-7071: https://bugs.php.net/bug.php?id=77423

Release notes: https://news-web.php.net/php.announce/304
Changelog: https://www.php.net/ChangeLog-7.php#7.4.14

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-07 20:32:13 +01:00
Bernd Kuhls fabb1243ab package/php: needs pcre2
Since 2008 pcre is a hard-dependency of php:
https://github.com/php/php-src/commit/aa64c6727c2d33a647bdbd9769215044f7cf2967

Instead of optionally depending on the pcre2 package and building the
bundled pcre2 code of php in case BR2_PACKAGE_PCRE2 was not selected
we let php depend on pcre2.

While being at it rename the pcre-related configure option due to
upstream commit:
https://github.com/php/php-src/commit/c1a22f3d4e69cb87f8deeed7d03d9434e6901537

Fixes:
http://autobuild.buildroot.net/results/4a5/4a582af6b66c59a61b75a7047d8530202972ebdd/
because the pcre2 package already contains the fix for mips r6.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[yann.morin.1998@free.fr: keep the JIT option]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-01-02 22:07:40 +01:00
Bernd Kuhls 8c38262066 package/php: security bump version to 7.4.13
Rebased patches.

Changelog: https://www.php.net/ChangeLog-7.php#7.4.13

According to the release notes this is a "security bug fix release":
https://news-web.php.net/php.announce/301

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-27 17:50:17 +01:00
Bernd Kuhls 69beb4dd98 package/php: security bump version to 7.4.12
Changelog: https://www.php.net/ChangeLog-7.php#7.4.12

According to the release notes this is a "security bug fix release":
https://news-web.php.net/php.announce/300

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-10-31 16:10:21 +01:00
Fabrice Fontaine 51d9617474 package/php: security bump to version 7.4.11
- Fix CVE-2020-7069: In PHP versions 7.2.x below 7.2.34, 7.3.x below
  7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with
  openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the
  IV is actually used. This can lead to both decreased security and
  incorrect encryption data.
- Fix CVE-2020-7070: In PHP versions 7.2.x below 7.2.34, 7.3.x below
  7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP
  cookie values, the cookie names are url-decoded. This may lead to
  cookies with prefixes like __Host confused with cookies that decode to
  such prefix, thus leading to an attacker being able to forge cookie
  which is supposed to be secure. See also CVE-2020-8184 for more
  information.

https://www.php.net/ChangeLog-7.php#7.4.11

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-04 11:19:51 +02:00
Bernd Kuhls 4fecbce953 package/php: bump version to 7.4.10
Changelog: https://www.php.net/ChangeLog-7.php#7.4.10

Rebased patches 0002 & 0003.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-09-20 15:05:57 +02:00
Fabrice Fontaine de9e0f1f00 package/php: drop BR2_PACKAGE_PHP_EXT_HASH
hash extension can't be disabled since version 7.4.0 and
https://github.com/php/php-src/commit/bf344425812b0f6156d0a8a54ed7bc38054f7636

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-08-23 19:03:20 +02:00
Fabrice Fontaine 6f3e269737 package/php: drop --with-libxml-dir
--with-libxml-dir has been dropped since version 7.4.0 and
https://github.com/php/php-src/commit/29d1b7fd521af288e9f04d784f59a2d15b494a30

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-08-23 19:02:20 +02:00
Bernd Kuhls 46ed4ac847 package/php: bump version to 7.4.9
Changelog of this bugfix release:
https://www.php.net/ChangeLog-7.php#7.4.9

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-08-08 23:19:51 +02:00
Tom Marcuzzi e16f05c0f0 package/php: add FFI extension support
Signed-off-by: Tom Marcuzzi <tom.marcuzzi@orolia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-08-05 23:02:54 +02:00
Bernd Kuhls a6a500bb99 package/php: bump version to 7.4.8
Quoting https://www.php.net/
"For windows users running an official build, this release contains a
 patched version of libcurl addressing CVE-2020-8159.

For all other consumers of PHP, this is a bug fix release."

Changelog: https://www.php.net/ChangeLog-7.php#7.4.8

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-11 15:58:00 +02:00
Bernd Kuhls 759ed10395 package/php: bump version to 7.4.7
Changelog: https://www.php.net/ChangeLog-7.php#7.4.7

Contrary to the release notification on the mailinglist
https://news-web.php.net/php.announce/287
which declares this release as "security bug fix release" no CVE IDs
could be found on the bugtracker entries mentioned in the Changelog.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-06-14 18:30:32 +02:00
Bernd Kuhls 1dd6d52226 package/php: security bump version to 7.4.6
Changelog: https://www.php.net/ChangeLog-7.php#7.4.6

Fixes CVE 2019-11048.

Reformatted hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-05-15 21:25:46 +02:00
Louis Aussedat 31c5fd8f4b package/php: fix gd extension dependencies and options
Due to migration to pkg-config in php 7.4, the detection of
library dependencies has been changed.

source from php.net:
--with-gd becomes --enable-gd
--with-png-dir has been removed. libpng is required.
--with-zlib-dir has been removed. zlib is required.
--with-freetype-dir becomes --with-freetype
--with-jpeg-dir becomes --with-jpeg

Signed-off-by: Louis Aussedat <aussedat.louis@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-04-18 15:25:23 +02:00
Louis Aussedat ac2b371732 package/php: fix zip support
since php7.4, --enable-zip becomes --with-zip due to
migration to pkg-config.

Signed-off-by: Louis Aussedat <aussedat.louis@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-04-18 15:11:16 +02:00
Bernd Kuhls db52b57c3d package/php: security bump version to 7.4.5
Changelog: https://www.php.net/ChangeLog-7.php#7.4.5

Fixes CVE-2020-7067.

Removed patch applied upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-04-17 22:05:53 +02:00
Bernd Kuhls 51cd6b8641 package/php: security bump version to 7.4.4
Changelog: https://www.php.net/ChangeLog-7.php#7.4.4

Fixes CVE-2020-7064, CVE-2020-7065 & CVE-2020-7066.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-03-20 21:53:34 +01:00
Fabrice Fontaine 57bbd39d61 package/php: fix build without zlib
Build will fail if zlib is not found and mysqlnd compression support
is not disabled since version 7.4.1 and
https://github.com/php/php-src/commit/ee4295b4ce421003c2e1d2af98066826deb23319

Fixes:
 - http://autobuild.buildroot.org/results/9496d81437dba55d22a03762dcfe60d632115ab5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-03-08 20:08:21 +01:00
Bernd Kuhls b467d58063 package/php: security bump version to 7.4.3
Changelog: https://www.php.net/ChangeLog-7.php#7.4.3

Fixes CVE-2020-7061, CVE-2020-7062 & CVE-2020-7063.

Removed patch applied upstream:
https://github.com/php/php-src/commit/f0f5c415a6e0abc40514f97113deb52a343174ee

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-02-21 09:41:49 +01:00
Pascal de Bruijn 26c16e9d5b package/php: bump version to 7.4.2
patch 0005 has been sourced from upstream, and can be dropped when
7.4.3 is released.

The mbstrings module used to use a bundled oniguruma library, but now
uses an external one, hence the new dependency on this package for the
mbstrings module.

The hash of the license file has changed due to this change in the
copyright year:

-Copyright (c) 1999 - 2018 The PHP Group. All rights reserved.
+Copyright (c) 1999 - 2019 The PHP Group. All rights reserved.

Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-02-01 23:06:19 +01:00
Bernd Kuhls fc3916efbc package/php: security bump to version 7.3.14
Changelog of 7.3.13: https://www.php.net/ChangeLog-7.php#7.3.13

Fixes CVE-2019-11044, CVE-2019-11045, CVE-2019-11046, CVE-2019-11047,
CVE-2019-11049 & CVE-2019-11050

Changelog of 7.3.14: https://www.php.net/ChangeLog-7.php#7.3.14

Fixes CVE-2020-7059 & CVE-2020-7060.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-24 20:15:49 +01:00
Pascal de Bruijn 5d7b8fef0f package/php: remove sample config in new location
the upstream php-fpm sample configuration is placed in

  /etc/php-fpm.d/www.conf.default

in recent version of php, so adjust the build cleanup
accordingly

Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
[yann.morin.1998@free.fr: only remove the file, not the directory]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2019-12-31 18:26:26 +01:00
Jérémy Rosen 1640fca208 package: rely on systemctl preset-all for upstream-provided services
All these packages have an upstream-provided service, but buildroot
enabled manually the services in exactly the same way as the [Install]
section.

This is not needed anymore

Signed-off-by: Jérémy Rosen <jeremy.rosen@smile.fr>
[yann.morin.1998@free.fr: fix check-package errors]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2019-12-18 18:33:22 +01:00
Peter Korsgaard 7b24bd59c8 Merge branch 'next'
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-12-02 09:39:41 +01:00
Pascal de Bruijn 8d229c12ac package/php: add option for libargon2 support
Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-11-26 23:26:19 +01:00
Bernd Kuhls a7ba9c54b4 package/php: bump version to 7.3.12
Release notes of this bugfix release:
https://www.php.net/ChangeLog-7.php#7.3.12

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-11-23 11:58:22 +01:00
Pascal de Bruijn 0d842d5ded package/php: add option to enable libsodium support
Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-11-09 14:51:28 +01:00
Dan Walkes 1248b86267 package/php: add config scan directory option
To support using multiple php configuration files, we pass
--with-config-file-scan-dir=/etc/php.d. This allows to put snippets of
PHP configuration files in /etc/php.d.

For php option details see link at [1].

[1] https://www.php.net/manual/en/configuration.file.php

Signed-off-by: Dan Walkes <danwalkes@trellis-logic.com>
[Thomas: make it unconditional]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-10-27 19:16:30 +01:00
Bernd Kuhls 335edd0269 package/php: security bump version to 7.3.11
Changelog: http://www.php.net/ChangeLog-7.php#7.3.11

Fixes CVE-2019-11043: https://bugs.php.net/bug.php?id=78599

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-24 23:24:45 +02:00
Bernd Kuhls 7169beb3fc package/php: security bump version to 7.3.10
Release notes: https://www.php.net/archive/2019.php#2019-09-26-1

No CVE IDs can be found in the bug reports mentioned in the Changelog:
https://www.php.net/ChangeLog-7.php#7.3.10

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-09-27 22:17:21 +02:00
Bernd Kuhls 0c5acbbcb6 package/php: security bump version to 7.3.9
Release notes: https://www.php.net/archive/2019.php#2019-08-29-1
Changelog: https://www.php.net/ChangeLog-7.php#7.3.9

Fixes CVE-2019-13224 & CVE-2019-13225:
https://bugs.mageia.org/show_bug.cgi?id=25380

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-30 19:42:57 +02:00
Bernd Kuhls b9833c6f52 package/php: security bump version to 7.3.8
Release notes: https://www.php.net/ChangeLog-7.php#7.3.8

Fixes CVE-2019-11042 & CVE-2019-11041

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 22:53:13 +02:00
Bernd Kuhls 7accdcb3a9 package/php: bump version to 7.3.7
Changelog: https://www.php.net/ChangeLog-7.php#7.3.7

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-05 08:24:11 +02:00
Bernd Kuhls 8d27812ac1 package/php: security bump version to 7.3.6
Release notes: https://www.php.net/archive/2019.php#id2019-05-30-1

Fixes
CVE 2019-11038: https://bugs.php.net/bug.php?id=77973
CVE 2019-11039: https://bugs.php.net/bug.php?id=78069
CVE 2019-11040: https://bugs.php.net/bug.php?id=77988

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-05-30 15:01:47 +02:00
Bernd Kuhls 934239eafb package/php: security bump version to 7.3.5
Release notes: https://www.php.net/archive/2019.php#id2019-05-02-1

Fixes 2019-11036:
* Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-05-05 12:09:32 +02:00
Artem Panfilov 58896f5c97 package/php: fix how external PCRE2 JIT is enabled
This patch adds ac_cv_have_pcre2_jit cache variable to avoid
the tests running on the host system during cross-compiling.

Signed-off-by: Artem Panfilov <panfilov.artyom@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-04-17 08:43:39 +02:00
Bernd Kuhls 614c1e2edd package/php: security bump to version 7.3.4
Changelog: https://www.php.net/ChangeLog-7.php#7.3.4

Fixes these bugs, CVE-ID were not assigned yet:

    Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s).
    Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value).

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-04-07 15:14:06 +02:00
Peter Korsgaard b821ae3d63 package/php: security bump to version 7.3.3
php-7.3.3 fixes a number of security issues (no CVE known, bugtracker issues
not yet public): https://secure.php.net/ChangeLog-7.php#7.3.3

Drop 0004-OPcache-flock-mechanism-is-obviously-linux-so-force-.patch as the
flock detection has been removed since commit 9222702633 (Avoid dependency
on "struct flock" fields order.)

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-03-12 21:33:18 +01:00
Bernd Kuhls e5e40c94b3 package/php: security bump to version 7.3.2
Rebased patch 0004.

This bump fixes https://bugs.php.net/bug.php?id=77369,
status of CVE-ID: needed

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-02-10 10:48:51 +01:00