Update for 2019.08-rc3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/dovecot-pigeonhole: security bump version to 0.5.7.2
2019-08-28 23:02:48 +02:00 · 2019-08-28 17:16:42 +02:00 · 2019-08-28 17:16:34 +02:00 · 2019-08-28 15:04:22 +02:00 · 2019-08-28 15:04:16 +02:00 · 2019-08-27 23:19:40 +02:00
37 changed files with 353 additions and 91 deletions
@@ -1,3 +1,15 @@
+2019.08-rc3, released August 28th, 2019
+
+	Fixes all over the tree.
+
+	Updated/fixed packages: clamav, dovecot, dovecot-pigeonhole,
+	gcc, intel-microcode, libmicrohttpd, libmodplug, mpg123,
+	nginx, openldap, python, qemu, samba4, squid, strace, vlc
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#11686: fbdev_drv.so: undefined symbol: shadowUpdatePackedWeak,..
+
 2019.08-rc2, released August 20th, 2019

 	Fixes all over the tree.
@@ -92,9 +92,9 @@ all:
 .PHONY: all

 # Set and export the version string
-export BR2_VERSION := 2019.08-rc2
+export BR2_VERSION := 2019.08-rc3
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1566304000
+BR2_VERSION_EPOCH = 1567026000

 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -76,37 +76,37 @@
 	</div>
      </div>

-      <h3 style="text-align: center;">Latest release candidate: <b>2019.08-rc2</b></h3>
+      <h3 style="text-align: center;">Latest release candidate: <b>2019.08-rc3</b></h3>
      <div class="row mt centered">
 	<div class="col-sm-6">
 	  <div class="flip-container center-block" ontouchstart="this.classList.toggle('hover');">
 	    <div class="flipper">
 	      <div class="front">
-		<a href="/downloads/buildroot-2019.08-rc2.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2019.08-rc3.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
 	      </div>
 	      <div class="back">
-		<a href="/downloads/buildroot-2019.08-rc2.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2019.08-rc3.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
 	      </div>
 	    </div>
 	  </div>

-	  <h3><a href="/downloads/buildroot-2019.08-rc2.tar.gz">buildroot-2019.08-rc2.tar.gz</a></h3>
-	  <p><a href="/downloads/buildroot-2019.08-rc2.tar.gz.sign">PGP signature</a></p>
+	  <h3><a href="/downloads/buildroot-2019.08-rc3.tar.gz">buildroot-2019.08-rc3.tar.gz</a></h3>
+	  <p><a href="/downloads/buildroot-2019.08-rc3.tar.gz.sign">PGP signature</a></p>
 	</div>
 	<div class="col-sm-6">
 	  <div class="flip-container center-block" ontouchstart="this.classList.toggle('hover');">
 	    <div class="flipper">
 	      <div class="front">
-		<a href="/downloads/buildroot-2019.08-rc2.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2019.08-rc3.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
 	      </div>
 	      <div class="back">
-		<a href="/downloads/buildroot-2019.08-rc2.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2019.08-rc3.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
 	      </div>
 	    </div>
 	  </div>

-	  <h3><a href="/downloads/buildroot-2019.08-rc2.tar.bz2">buildroot-2019.08-rc2.tar.bz2</a></h3>
-	  <p><a href="/downloads/buildroot-2019.08-rc2.tar.bz2.sign">PGP signature</a></p>
+	  <h3><a href="/downloads/buildroot-2019.08-rc3.tar.bz2">buildroot-2019.08-rc3.tar.bz2</a></h3>
+	  <p><a href="/downloads/buildroot-2019.08-rc3.tar.bz2.sign">PGP signature</a></p>
 	</div>
      </div>

@@ -9,6 +9,27 @@
 <h2>News</h2>
 <ul class="timeline">

+  <li>
+    <div class="timeline-badge"><i class="glyphicon glyphicon-thumbs-up"></i></div>
+    <div class="timeline-panel">
+      <div class="timeline-heading">
+	<h4 class="timeline-title">2019.08-rc3 released</h4>
+	<p><small class="text-muted"><i class="glyphicon glyphicon-time"></i>28 August 2019</small></p>
+      </div>
+      <div class="timeline-body">
+        <p>Another week, another release candidate with more cleanups and build fixes. See the
+	  <a href="http://git.buildroot.net/buildroot/plain/CHANGES?id=2019.08-rc3">CHANGES</a>
+	  file for details.</p>
+
+	<p>Head to the <a href="/downloads/">downloads page</a> to pick up the
+	  <a href="/downloads/buildroot-2019.08-rc3.tar.bz2">2019.08-rc3
+	  release candidate</a>, and report any problems found to the
+	  <a href="support.html">mailing list</a> or
+	  <a href="https://bugs.buildroot.org">bug tracker</a>.</p>
+      </div>
+    </div>
+  </li>
+
  <li class="timeline-inverted">
    <div class="timeline-badge"><i class="glyphicon glyphicon-thumbs-up"></i></div>
    <div class="timeline-panel">
@@ -1,5 +1,5 @@
 # Locally calculated
-sha256 68d42aac4a9cbde293288533a9a3c3d55863de38f2b8707c1ef2d987b1260338  clamav-0.101.3.tar.gz
+sha256 0bf094f0919d158a578421d66bc2569c8c8181233ba162bb51722f98c802bccd  clamav-0.101.4.tar.gz
 sha256 0c4fd2fa9733fc9122503797648710851e4ee6d9e4969dd33fcbd8c63cd2f584  COPYING
 sha256 d72a145c90918184a05ef65a04c9e6f7466faa59bc1b82c8f6a8ddc7ddcb9bed  COPYING.bzip2
 sha256 dfb818a0d41411c6fb1c193c68b73018ceadd1994bda41ad541cbff292894bc6  COPYING.file
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CLAMAV_VERSION = 0.101.3
+CLAMAV_VERSION = 0.101.4
 CLAMAV_SITE = https://www.clamav.net/downloads/production
 CLAMAV_LICENSE = GPL-2.0
 CLAMAV_LICENSE_FILES = COPYING COPYING.bzip2 COPYING.file COPYING.getopt \
@@ -1,3 +1,3 @@
 # Locally computed after checking signature
-sha256 3270b24c1f75a7c144f54d6d08ce994176e39c2cdb3ac4dd80ad5e64aaaa2028  dovecot-2.3-pigeonhole-0.5.7.1.tar.gz
+sha256 d59d0c5c5225a126e5b98bf95d75e8dd368bdeeb3da2e9766dbe4fddaa9411b0  dovecot-2.3-pigeonhole-0.5.7.2.tar.gz
 sha256 fc9e9522216f2a9a28b31300e3c73c1df56acc27dfae951bf516e7995366b51a  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-DOVECOT_PIGEONHOLE_VERSION = 0.5.7.1
+DOVECOT_PIGEONHOLE_VERSION = 0.5.7.2
 DOVECOT_PIGEONHOLE_SOURCE = dovecot-2.3-pigeonhole-$(DOVECOT_PIGEONHOLE_VERSION).tar.gz
 DOVECOT_PIGEONHOLE_SITE = https://pigeonhole.dovecot.org/releases/2.3
 DOVECOT_PIGEONHOLE_LICENSE = LGPL-2.1
@@ -1,5 +1,5 @@
 # Locally computed after checking signature
-sha256 c5a51d6f76e6e9c843df69e52a364a4c65c4c60e0c51d992eaa45f22f71803c3  dovecot-2.3.7.1.tar.gz
+sha256 666ce084760a47e601d49a9be3c7993c48789d332631e8dfb45f443b367b1260  dovecot-2.3.7.2.tar.gz
 sha256 a363b132e494f662d98c820d1481297e6ae72f194c2c91b6c39e1518b86240a8  COPYING
 sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING.LGPL
 sha256 52b8c95fabb19575281874b661ef7968ea47e8f5d74ba0dd40ce512e52b3fc97  COPYING.MIT
@@ -5,7 +5,7 @@
 ################################################################################

 DOVECOT_VERSION_MAJOR = 2.3
-DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).7.1
+DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).7.2
 DOVECOT_SITE = https://dovecot.org/releases/$(DOVECOT_VERSION_MAJOR)
 DOVECOT_INSTALL_STAGING = YES
 DOVECOT_LICENSE = LGPL-2.1, MIT, Public Domain, BSD-3-Clause, Unicode-DFS-2015
@@ -59,6 +59,12 @@ config BR2_GCC_VERSION_8_X

 config BR2_GCC_VERSION_9_X
 	bool "gcc 9.x"
+	# or1k needs binutils >= 2.32
+	depends on !(BR2_or1k && \
+		(BR2_BINUTILS_VERSION_2_30_X || BR2_BINUTILS_VERSION_2_31_X))
+	# uClibc doesn't build with upstream or1k gcc
+	# https://mailman.uclibc-ng.org/pipermail/devel/2019-August/001885.html
+	depends on !(BR2_or1k && BR2_TOOLCHAIN_USES_UCLIBC)
 	# powerpc spe support has been deprecated since gcc 8.x.
 	# https://gcc.gnu.org/ml/gcc/2018-04/msg00102.html
 	depends on !BR2_powerpc_SPE
@@ -1,3 +1,3 @@
 # Locally computed
-sha256 9e67903a5b62b51f5e031b59a8046d3dff226834d79899799943803481a55d20  intel-microcode-20190514a.tar.gz
+sha256 74ec7415988d40fa53686d994cf8cb27accdbd35c5373c4c3afc2e93372ebba5  intel-microcode-20190618.tar.gz
 sha256 1f8bf63fc2b1b486c507b98ff7d283c7eb58c7945746b94188a310d6787cbee5  license
@@ -4,7 +4,7 @@
 #
 ################################################################################

-INTEL_MICROCODE_VERSION = 20190514a
+INTEL_MICROCODE_VERSION = 20190618
 INTEL_MICROCODE_SITE = $(call github,intel,Intel-Linux-Processor-Microcode-Data-Files,microcode-$(INTEL_MICROCODE_VERSION))
 INTEL_MICROCODE_LICENSE = PROPRIETARY
 INTEL_MICROCODE_LICENSE_FILES = license
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256 e792d8ed5990823a0baadea0adf94365999e702f6f1314ef9c555018dafc350e  libmicrohttpd-0.9.64.tar.gz
+sha256 4e66d4db1574f4912fbd2690d10d227cc9cc56df6a10aa8f4fc2da75cea7ab1b  libmicrohttpd-0.9.66.tar.gz
 sha256 7399547209438c93f9b90297954698773d4846cea44cde5ca982c84c45952a3b  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBMICROHTTPD_VERSION = 0.9.64
+LIBMICROHTTPD_VERSION = 0.9.66
 LIBMICROHTTPD_SITE = $(BR2_GNU_MIRROR)/libmicrohttpd
 LIBMICROHTTPD_LICENSE_FILES = COPYING
 LIBMICROHTTPD_INSTALL_STAGING = YES
@@ -1,3 +1,3 @@
 # Locally computed:
-sha256  77462d12ee99476c8645cb5511363e3906b88b33a6b54362b4dbc0f39aa2daad  libmodplug-0.8.8.5.tar.gz
+sha256  457ca5a6c179656d66c01505c0d95fafaead4329b9dbaa0f997d00a3508ad9de  libmodplug-0.8.9.0.tar.gz
 sha256  49942e7b3b175f549e751feb08b5270ca6f6c5fb7a1be9f9517db275ec32c92e  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBMODPLUG_VERSION = 0.8.8.5
+LIBMODPLUG_VERSION = 0.8.9.0
 LIBMODPLUG_SITE = http://downloads.sourceforge.net/project/modplug-xmms/libmodplug/$(LIBMODPLUG_VERSION)
 LIBMODPLUG_INSTALL_STAGING = YES
 LIBMODPLUG_LICENSE = Public Domain
@@ -1,7 +1,7 @@
-# From https://sourceforge.net/projects/mpg123/files/mpg123/1.25.11/
-sha1 25f3e8f8599d3ffc480858799ea6f8620f48543d  mpg123-1.25.11.tar.bz2
-md5 64749512a6fdc117227abe13fee4cc36  mpg123-1.25.11.tar.bz2
+# From https://sourceforge.net/projects/mpg123/files/mpg123/1.25.12/
+sha1 4ece1ec124a6ca085e1d68f7ede6d5619fc587ff  mpg123-1.25.12.tar.bz2
+md5 ddb38254966eb38c77f220d456a1839d  mpg123-1.25.12.tar.bz2
 # Locally calculated
-sha256 df063307faa27c7d9efe63d2139b1564cfc7cdbb7c6f449c89ef8faabfa0eab2  mpg123-1.25.11.tar.bz2
+sha256 1ffec7c9683dfb86ea9040d6a53d6ea819ecdda215df347f79def08f1fe731d1  mpg123-1.25.12.tar.bz2
 # License file
 sha256  f40e0dd86b27b52e429b693a87b3ca63ae0a98a4d142e77207aa6bdf1db7a295  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-MPG123_VERSION = 1.25.11
+MPG123_VERSION = 1.25.12
 MPG123_SOURCE = mpg123-$(MPG123_VERSION).tar.bz2
 MPG123_SITE = http://downloads.sourceforge.net/project/mpg123/mpg123/$(MPG123_VERSION)
 MPG123_CONF_OPTS = --disable-lfs-alias
@@ -1,4 +1,4 @@
 # Locally calculated after checking pgp signature
-sha256	4fd376bad78797e7f18094a00f0f1088259326436b537eb5af69b01be2ca1345	nginx-1.16.0.tar.gz
+sha256	f11c2a6dd1d3515736f0324857957db2de98be862461b5a542a3ac6188dbe32b	nginx-1.16.1.tar.gz
 # License files, locally calculated
 sha256	28ad30e2f64bd89ac1287b4606906bb99ed04d9f4e13fb6564a0be9c8a23f509	LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-NGINX_VERSION = 1.16.0
+NGINX_VERSION = 1.16.1
 NGINX_SITE = http://nginx.org/download
 NGINX_LICENSE = BSD-2-Clause
 NGINX_LICENSE_FILES = LICENSE
@@ -1,7 +1,7 @@
-# From http://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-2.4.47.md5
-md5 e508f97bfd778fec7799f286e5c07176  openldap-2.4.47.tgz
-# From http://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-2.4.47.sha1
-sha1 c59d52dd75f7d1c7b02f83725da36c322d439674  openldap-2.4.47.tgz
+# From http://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-2.4.48.md5
+md5 0729a0711fe096831dedc159e0bbe73f  openldap-2.4.48.tgz
+# From http://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-2.4.48.sha1
+sha1 c1984e80f6db038b317bf931866adb38e5537dcd  openldap-2.4.48.tgz
 # Locally computed
-sha256 f54c5877865233d9ada77c60c0f69b3e0bfd8b1b55889504c650047cc305520b  openldap-2.4.47.tgz
+sha256 d9523ffcab5cd14b709fcf3cb4d04e8bc76bb8970113255f372bc74954c6074d  openldap-2.4.48.tgz
 sha256 310fe25c858a9515fc8c8d7d1f24a67c9496f84a91e0a0e41ea9975b1371e569  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-OPENLDAP_VERSION = 2.4.47
+OPENLDAP_VERSION = 2.4.48
 OPENLDAP_SOURCE = openldap-$(OPENLDAP_VERSION).tgz
 OPENLDAP_SITE = http://www.openldap.org/software/download/OpenLDAP/openldap-release
 OPENLDAP_LICENSE = OpenLDAP Public License
@@ -0,0 +1,216 @@
+From bb8071a4cae5ab3fe321481dd3d73662ffb26052 Mon Sep 17 00:00:00 2001
+From: Victor Stinner <victor.stinner@gmail.com>
+Date: Tue, 21 May 2019 15:12:33 +0200
+Subject: [PATCH] bpo-30458: Disallow control chars in http URLs (GH-12755)
+ (GH-13154) (GH-13315)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Disallow control chars in http URLs in urllib2.urlopen.  This
+addresses a potential security problem for applications that do not
+sanity check their URLs where http request headers could be injected.
+
+Disable https related urllib tests on a build without ssl (GH-13032)
+These tests require an SSL enabled build. Skip these tests when
+python is built without SSL to fix test failures.
+
+Use httplib.InvalidURL instead of ValueError as the new error case's
+exception. (GH-13044)
+
+Backport Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
+
+(cherry picked from commit 7e200e0763f5b71c199aaf98bd5588f291585619)
+
+Notes on backport to Python 2.7:
+
+* test_urllib tests urllib.urlopen() which quotes the URL and so is
+  not vulerable to HTTP Header Injection.
+* Add tests to test_urllib2 on urllib2.urlopen().
+* Reject non-ASCII characters: range 0x80-0xff.
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ Lib/httplib.py                                     | 16 +++++++
+ Lib/test/test_urllib.py                            | 25 +++++++++++
+ Lib/test/test_urllib2.py                           | 51 +++++++++++++++++++++-
+ Lib/test/test_xmlrpc.py                            |  8 +++-
+ .../2019-04-10-08-53-30.bpo-30458.51E-DA.rst       |  1 +
+ 5 files changed, 99 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
+
+diff --git a/Lib/httplib.py b/Lib/httplib.py
+index 60a8fb4e35..1b41c346e0 100644
+--- a/Lib/httplib.py
+++ b/Lib/httplib.py
+@@ -247,6 +247,16 @@ _MAXHEADERS = 100
+ _is_legal_header_name = re.compile(r'\A[^:\s][^:\r\n]*\Z').match
+ _is_illegal_header_value = re.compile(r'\n(?![ \t])|\r(?![ \t\n])').search
+ 
+# These characters are not allowed within HTTP URL paths.
+#  See https://tools.ietf.org/html/rfc3986#section-3.3 and the
+#  https://tools.ietf.org/html/rfc3986#appendix-A pchar definition.
+# Prevents CVE-2019-9740.  Includes control characters such as \r\n.
+# Restrict non-ASCII characters above \x7f (0x80-0xff).
+_contains_disallowed_url_pchar_re = re.compile('[\x00-\x20\x7f-\xff]')
+# Arguably only these _should_ allowed:
+#  _is_allowed_url_pchars_re = re.compile(r"^[/!$&'()*+,;=:@%a-zA-Z0-9._~-]+$")
+# We are more lenient for assumed real world compatibility purposes.
+
+ # We always set the Content-Length header for these methods because some
+ # servers will otherwise respond with a 411
+ _METHODS_EXPECTING_BODY = {'PATCH', 'POST', 'PUT'}
+@@ -927,6 +937,12 @@ class HTTPConnection:
+         self._method = method
+         if not url:
+             url = '/'
+        # Prevent CVE-2019-9740.
+        match = _contains_disallowed_url_pchar_re.search(url)
+        if match:
+            raise InvalidURL("URL can't contain control characters. %r "
+                             "(found at least %r)"
+                             % (url, match.group()))
+         hdr = '%s %s %s' % (method, url, self._http_vsn_str)
+ 
+         self._output(hdr)
+diff --git a/Lib/test/test_urllib.py b/Lib/test/test_urllib.py
+index 1ce9201c06..d7778d4194 100644
+--- a/Lib/test/test_urllib.py
+++ b/Lib/test/test_urllib.py
+@@ -257,6 +257,31 @@ class urlopen_HttpTests(unittest.TestCase, FakeHTTPMixin):
+         finally:
+             self.unfakehttp()
+ 
+    def test_url_with_control_char_rejected(self):
+        for char_no in range(0, 0x21) + range(0x7f, 0x100):
+            char = chr(char_no)
+            schemeless_url = "//localhost:7777/test%s/" % char
+            self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
+            try:
+                # urllib quotes the URL so there is no injection.
+                resp = urllib.urlopen("http:" + schemeless_url)
+                self.assertNotIn(char, resp.geturl())
+            finally:
+                self.unfakehttp()
+
+    def test_url_with_newline_header_injection_rejected(self):
+        self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
+        host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
+        schemeless_url = "//" + host + ":8080/test/?test=a"
+        try:
+            # urllib quotes the URL so there is no injection.
+            resp = urllib.urlopen("http:" + schemeless_url)
+            self.assertNotIn(' ', resp.geturl())
+            self.assertNotIn('\r', resp.geturl())
+            self.assertNotIn('\n', resp.geturl())
+        finally:
+            self.unfakehttp()
+
+     def test_read_bogus(self):
+         # urlopen() should raise IOError for many error codes.
+         self.fakehttp('''HTTP/1.1 401 Authentication Required
+diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py
+index 6d24d5ddf8..9531818e16 100644
+--- a/Lib/test/test_urllib2.py
+++ b/Lib/test/test_urllib2.py
+@@ -15,6 +15,9 @@ try:
+ except ImportError:
+     ssl = None
+ 
+from test.test_urllib import FakeHTTPMixin
+
+
+ # XXX
+ # Request
+ # CacheFTPHandler (hard to write)
+@@ -1262,7 +1265,7 @@ class HandlerTests(unittest.TestCase):
+         self.assertEqual(len(http_handler.requests), 1)
+         self.assertFalse(http_handler.requests[0].has_header(auth_header))
+ 
+-class MiscTests(unittest.TestCase):
+class MiscTests(unittest.TestCase, FakeHTTPMixin):
+ 
+     def test_build_opener(self):
+         class MyHTTPHandler(urllib2.HTTPHandler): pass
+@@ -1317,6 +1320,52 @@ class MiscTests(unittest.TestCase):
+             "Unsupported digest authentication algorithm 'invalid'"
+         )
+ 
+    @unittest.skipUnless(ssl, "ssl module required")
+    def test_url_with_control_char_rejected(self):
+        for char_no in range(0, 0x21) + range(0x7f, 0x100):
+            char = chr(char_no)
+            schemeless_url = "//localhost:7777/test%s/" % char
+            self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
+            try:
+                # We explicitly test urllib.request.urlopen() instead of the top
+                # level 'def urlopen()' function defined in this... (quite ugly)
+                # test suite.  They use different url opening codepaths.  Plain
+                # urlopen uses FancyURLOpener which goes via a codepath that
+                # calls urllib.parse.quote() on the URL which makes all of the
+                # above attempts at injection within the url _path_ safe.
+                escaped_char_repr = repr(char).replace('\\', r'\\')
+                InvalidURL = httplib.InvalidURL
+                with self.assertRaisesRegexp(
+                    InvalidURL, "contain control.*" + escaped_char_repr):
+                    urllib2.urlopen("http:" + schemeless_url)
+                with self.assertRaisesRegexp(
+                    InvalidURL, "contain control.*" + escaped_char_repr):
+                    urllib2.urlopen("https:" + schemeless_url)
+            finally:
+                self.unfakehttp()
+
+    @unittest.skipUnless(ssl, "ssl module required")
+    def test_url_with_newline_header_injection_rejected(self):
+        self.fakehttp(b"HTTP/1.1 200 OK\r\n\r\nHello.")
+        host = "localhost:7777?a=1 HTTP/1.1\r\nX-injected: header\r\nTEST: 123"
+        schemeless_url = "//" + host + ":8080/test/?test=a"
+        try:
+            # We explicitly test urllib2.urlopen() instead of the top
+            # level 'def urlopen()' function defined in this... (quite ugly)
+            # test suite.  They use different url opening codepaths.  Plain
+            # urlopen uses FancyURLOpener which goes via a codepath that
+            # calls urllib.parse.quote() on the URL which makes all of the
+            # above attempts at injection within the url _path_ safe.
+            InvalidURL = httplib.InvalidURL
+            with self.assertRaisesRegexp(
+                InvalidURL, r"contain control.*\\r.*(found at least . .)"):
+                urllib2.urlopen("http:" + schemeless_url)
+            with self.assertRaisesRegexp(InvalidURL, r"contain control.*\\n"):
+                urllib2.urlopen("https:" + schemeless_url)
+        finally:
+            self.unfakehttp()
+
+
+ 
+ class RequestTests(unittest.TestCase):
+ 
+diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py
+index 36b3be67fd..90ccb30716 100644
+--- a/Lib/test/test_xmlrpc.py
+++ b/Lib/test/test_xmlrpc.py
+@@ -659,7 +659,13 @@ class SimpleServerTestCase(BaseServerTestCase):
+     def test_partial_post(self):
+         # Check that a partial POST doesn't make the server loop: issue #14001.
+         conn = httplib.HTTPConnection(ADDR, PORT)
+-        conn.request('POST', '/RPC2 HTTP/1.0\r\nContent-Length: 100\r\n\r\nbye')
+        conn.send('POST /RPC2 HTTP/1.0\r\n'
+                  'Content-Length: 100\r\n\r\n'
+                  'bye HTTP/1.1\r\n'
+                  'Host: %s:%s\r\n'
+                  'Accept-Encoding: identity\r\n'
+                  'Content-Length: 0\r\n\r\n'
+                  % (ADDR, PORT))
+         conn.close()
+ 
+ class SimpleServerEncodingTestCase(BaseServerTestCase):
+diff --git a/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
+new file mode 100644
+index 0000000000..47cb899df1
+--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2019-04-10-08-53-30.bpo-30458.51E-DA.rst
+@@ -0,0 +1 @@
+Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request.  Such potentially malicious header injection URLs now cause an httplib.InvalidURL exception to be raised.
+-- 
+2.11.0
+
@@ -1,5 +1,5 @@
 # Locally computed, tarball verified with GPG signature
-sha256 6a0508df079a0a33c2487ca936a56c12122f105b8a96a44374704bef6c69abfc  qemu-3.1.0.tar.xz
+sha256 d7c69fef3fb4bfbac99e3f2ac9fb8d6409db4faadf2e37337d544e3fdb4fde3a  qemu-3.1.1.tar.xz
 sha256 6f04ae8364d0079a192b14635f4b1da294ce18724c034c39a6a41d1b09df6100  COPYING
 sha256 48ffe9fc7f1d5462dbd19340bc4dd1d8a9e37c61ed535813e614cbe4a5f0d4df  COPYING.LIB

@@ -8,7 +8,7 @@ ifeq ($(BR2_csky),y)
 QEMU_VERSION = b517e1dc3125a57555d67a8deed9eac7b42288e2
 QEMU_SITE = $(call github,c-sky,qemu,$(QEMU_VERSION))
 else
-QEMU_VERSION = 3.1.0
+QEMU_VERSION = 3.1.1
 QEMU_SOURCE = qemu-$(QEMU_VERSION).tar.xz
 QEMU_SITE = http://download.qemu.org
 endif
@@ -1,37 +0,0 @@
-From 41eeabcb0175659aebf6d480c43fb64310f37d9c Mon Sep 17 00:00:00 2001
-From: Andrew Bartlett <abartlet@samba.org>
-Date: Wed, 20 Mar 2019 13:57:50 +1300
-Subject: [PATCH] build: Allow build when --disable-gnutls is set
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=13844
-
-Signed-off-by: Andrew Bartlett <abartlet@samba.org>
-
-Downloaded from
-https://github.com/openwrt/packages/blob/master/net/samba4/patches/005-samba-4.10-disable_gnutls_build_fix.patch
-
-Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
- lib/mscat/wscript | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/lib/mscat/wscript b/lib/mscat/wscript
-index 7ca9ef567ee..4d1f752a3c1 100644
--- a/lib/mscat/wscript
-+++ b/lib/mscat/wscript
-@@ -12,7 +12,11 @@ def configure(conf):
-         if not conf.find_program('asn1Parser', var='ASN1PARSER'):
-             Logs.warn('WARNING: ans1Parser hasn\'t been found! Please install it (e.g. libtasn1-bin)')
- 
-    conf.CHECK_FUNCS_IN('gnutls_pkcs7_get_embedded_data_oid', 'gnutls')
-+    # GnuTLS is currently able to be disabled
-+    if conf.env.enable_gnutls:
-+        conf.CHECK_FUNCS_IN('gnutls_pkcs7_get_embedded_data_oid', 'gnutls')
-+    else:
-+        Logs.warn('WARNING: gnutls disabled so dumpmscat will not be built')
- 
- def build(bld):
-     if (bld.CONFIG_SET('HAVE_LIBTASN1') and
-- 
-2.11.0
-
@@ -1,4 +1,4 @@
 # Locally calculated after checking pgp signature
-# https://download.samba.org/pub/samba/stable/samba-4.10.6.tar.asc
-sha256 9efbeb52db1203dc779b118f1c48c161e569f7a6af5101e745497ee6296eef42  samba-4.10.6.tar.gz
+# https://download.samba.org/pub/samba/stable/samba-4.10.7.tar.asc
+sha256 34f30494b6b63700f54be22be636e8a6e0430577166a76a017075e11c02a1ebb  samba-4.10.7.tar.gz
 sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-SAMBA4_VERSION = 4.10.6
+SAMBA4_VERSION = 4.10.7
 SAMBA4_SITE = https://download.samba.org/pub/samba/stable
 SAMBA4_SOURCE = samba-$(SAMBA4_VERSION).tar.gz
 SAMBA4_INSTALL_STAGING = YES
@@ -0,0 +1,42 @@
+From 5dbaf8eebc5b66230e0131b09651c7e40bf0e9de Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Tue, 20 Aug 2019 21:41:16 +0200
+Subject: [PATCH] acinclude/os-deps.m4: fix cross-compilation
+
+Do not check check file descriptor maximum value through AC_RUN_IFELSE
+when cross-compiling as this will raise an error
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: https://github.com/squid-cache/squid/pull/464]
+---
+ acinclude/os-deps.m4 | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/acinclude/os-deps.m4 b/acinclude/os-deps.m4
+index b50717517..ec10a54c6 100644
+--- a/acinclude/os-deps.m4
+++ b/acinclude/os-deps.m4
+@@ -169,7 +169,9 @@ AC_MSG_CHECKING(Maximum number of filedescriptors we can open)
+ SQUID_STATE_SAVE(maxfd)
+ dnl FreeBSD pthreads break dup2().
+   AS_CASE([$host_os],[freebsd],[ LDFLAGS=`echo $LDFLAGS | sed -e "s/-pthread//"` ])
+-  AC_RUN_IFELSE([AC_LANG_SOURCE([[
+  dnl AC_RUN_IFELSE can't be run when cross-compiling
+  AS_CASE([$cross_compiling],[no],[
+    AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <stdlib.h>
+@@ -231,7 +233,8 @@ int main(int argc, char **argv) {
+ 	fprintf (fp, "%d\n", i & ~0x3F);
+ 	return 0;
+ }
+-  ]])],[squid_filedescriptors_limit=`cat conftestval`],[],[])
+    ]])],[squid_filedescriptors_limit=`cat conftestval`],[],[])
+  ])
+   dnl Microsoft MSVCRT.DLL supports 2048 maximum FDs
+   AS_CASE(["$host_os"],[mingw|mingw32],[squid_filedescriptors_limit="2048"])
+   AC_MSG_RESULT($squid_filedescriptors_limit)
+-- 
+2.20.1
+
@@ -1,6 +1,6 @@
-# From http://www.squid-cache.org/Versions/v4/squid-4.6.tar.xz.asc
-md5 e25e7cc37754ad14d8aa368c0c210e54 squid-4.6.tar.xz
-sha1 0396fe8077049000407d13aca8efdd9228e69d98 squid-4.6.tar.xz
+# From http://www.squid-cache.org/Versions/v4/squid-4.8.tar.xz.asc
+md5 08e018f2d8db4911ee90591284fa1ca5 squid-4.8.tar.xz
+sha1 4ff1390eee3ec20cefa5565cbb56e1a89a12bfc1 squid-4.8.tar.xz
 # Locally calculated
-sha256 015bade5d3a4905142c4c605df5c4216471e3d8338079955e0e44b0ae0303d41 squid-4.6.tar.xz
+sha256 78cdb324d93341d36d09d5f791060f6e8aaa5ff3179f7c949cd910d023a86210 squid-4.8.tar.xz
 sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING
@@ -4,13 +4,15 @@
 #
 ################################################################################

-SQUID_VERSION = 4.6
+SQUID_VERSION = 4.8
 SQUID_SOURCE = squid-$(SQUID_VERSION).tar.xz
 SQUID_SITE = http://www.squid-cache.org/Versions/v4
 SQUID_LICENSE = GPL-2.0+
 SQUID_LICENSE_FILES = COPYING
 SQUID_DEPENDENCIES = libcap host-libcap libxml2 host-pkgconf \
 	$(if $(BR2_PACKAGE_LIBNETFILTER_CONNTRACK),libnetfilter_conntrack)
+# We're patching acinclude/os-deps.m4
+SQUID_AUTORECONF = YES
 SQUID_CONF_ENV = \
 	ac_cv_epoll_works=yes \
 	ac_cv_func_setresuid=yes \
@@ -2,7 +2,7 @@ config BR2_PACKAGE_STRACE
 	bool "strace"
 	# needs at least kernel headers 4.0 on nios2
 	depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_4_0 || !BR2_nios2
-	depends on !BR2_nds32
+	depends on !BR2_nds32 && !BR2_RISCV_32
 	help
 	  A useful diagnostic, instructional, and debugging tool.
 	  Allows you to track what system calls a program makes
@@ -1,9 +1,9 @@
-# From http://download.videolan.org/pub/videolan/vlc/3.0.7.1/vlc-3.0.7.1.tar.xz.sha256
-sha256 0655804371096772f06104b75c21cde8a76e3b6c8a2fdadc97914f082c6264f5 vlc-3.0.7.1.tar.xz
-# From http://download.videolan.org/pub/videolan/vlc/3.0.7.1/vlc-3.0.7.1.tar.xz.sha1
-sha1 3f6f9e56695eeea662b86602963721f1ac7afd23 vlc-3.0.7.1.tar.xz
-# From http://download.videolan.org/pub/videolan/vlc/3.0.7.1/vlc-3.0.7.1.tar.xz.md5
-md5 1adf2fe21070378b0e45ad163d3b232d vlc-3.0.7.1.tar.xz
+# From http://download.videolan.org/pub/videolan/vlc/3.0.8/vlc-3.0.8.tar.xz.sha256
+sha256 e0149ef4a20a19b9ecd87309c2d27787ee3f47dfd47c6639644bc1f6fd95bdf6 vlc-3.0.8.tar.xz
+# From http://download.videolan.org/pub/videolan/vlc/3.0.8/vlc-3.0.8.tar.xz.sha1
+sha1 424a9795e051c198e7fa28107b15809ee6820d43 vlc-3.0.8.tar.xz
+# From http://download.videolan.org/pub/videolan/vlc/3.0.8/vlc-3.0.8.tar.xz.md5
+md5 744442ec0c145453ea1d257914c8072e vlc-3.0.8.tar.xz
 # Locally computed
 sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
 sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING.LIB
@@ -4,7 +4,7 @@
 #
 ################################################################################

-VLC_VERSION = 3.0.7.1
+VLC_VERSION = 3.0.8
 VLC_SITE = https://get.videolan.org/vlc/$(VLC_VERSION)
 VLC_SOURCE = vlc-$(VLC_VERSION).tar.xz
 VLC_LICENSE = GPL-2.0+, LGPL-2.1+
Author	SHA1	Message	Date
Peter Korsgaard	cd8ab1853d	Update for 2019.08-rc3 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-28 23:02:48 +02:00
Bernd Kuhls	77b2dd9a53	package/dovecot-pigeonhole: security bump version to 0.5.7.2 Release notes: https://dovecot.org/pipermail/dovecot/2019-August/116876.html Fixes * CVE-2019-11500: ManageSieve protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-28 17:16:42 +02:00
Bernd Kuhls	4afd405eff	package/dovecot: security bump version to 2.3.7.2 Release notes: https://dovecot.org/pipermail/dovecot/2019-August/116874.html Fixes * CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Found by Nick Roessler and Rafi Rubin. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-28 17:16:34 +02:00
Peter Korsgaard	e941599f69	package/python: add upstream security fix for CVE-2019-9740 An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-28 15:04:22 +02:00
Peter Korsgaard	a0b032ad85	package/qemu: security bump to version 3.1.1 Fixes the following security issues: CVE-2018-16872: A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-28 15:04:16 +02:00
Sørensen, Stefan	ca2dea3b75	package/openldap: security bump to version 2.4.48 Security fixes: CVE-2019-13057: Fixed slapd to restrict rootDN proxyauthz to its own databases CVE-2019-13565: Fixed slapd to initialize SASL SSF per connection Full changelog: https://www.openldap.org/lists/openldap-announce/201907/msg00001.html Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> [Peter: fix sha256 hash line] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-27 23:19:40 +02:00
Bernd Kuhls	4e5e44278a	package/intel-microcode: security bump version to 20190618 Release notes: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/blob/master/releasenote Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Reviewed-by: Carlos Santos <unixmania@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-27 23:07:55 +02:00
Peter Korsgaard	b907d344d8	package/mpg123: security bump to version 1.25.12 >From the release notes: - Fix an out-of-bounds read of maximal two bytes for truncated RVA2 frames (oss-fuzz-bug 15975). The earlier fix around the same location needed one thought more. Actually, another though was needed, oss-fuzz-bug 16009 documents the incomplete fix. - Fix an invalid write of one zero byte for empty ID3v2 frames that demand de-unsyncing (oss-fuzz-bug 16050). - Fix dynamic build with gcc -fsanitize=address (check for all dl functions before deciding that separate -ldl is not needed). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-27 22:18:05 +02:00
Bernd Kuhls	ad9efda578	package/vlc: security bump version to 3.0.8 Release notes: https://www.videolan.org/developers/vlc-branch/NEWS Fixes the following security bugs: * Fix a buffer overflow in the MKV demuxer (CVE-2019-14970) * Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962) * Fix a read buffer overflow in the FAAD decoder * Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438) * Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776) * Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778) * Fix a use after free in the ASF demuxer (CVE-2019-14533) * Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602) * Fix a null dereference in the dvdnav demuxer * Fix a null dereference in the ASF demuxer (CVE-2019-14534) * Fix a null dereference in the AVI demuxer * Fix a division by zero in the CAF demuxer (CVE-2019-14498) * Fix a division by zero in the ASF demuxer (CVE-2019-14535) Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-25 08:51:45 +02:00
Bernd Kuhls	661949b3f5	package/libmodplug: bump version to 0.8.9 Needed for security bump of vlc to 3.0.8: http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commitdiff;h=48f014768dc22ecad23d0e9f53c38805a3aff832 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-25 08:51:38 +02:00
Baruch Siach	2604f55093	package/strace: disable for riscv32 strace does not support riscv32 yet. https://lists.strace.io/pipermail/strace-devel/2019-August/009068.html Fixes: http://autobuild.buildroot.net/results/912776cc1da1719806058516a2cc2a47c8dbad9b/ Cc: Mark Corbin <mark.corbin@embecosm.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-25 08:51:05 +02:00
Bernd Kuhls	e7606d31f9	package/samba4: bump version to 4.10.7 Release notes of this bugfix release: https://www.samba.org/samba/history/samba-4.10.7.html Removed 0005-disable_gnutls_build_fix.patch, applied upstream: https://git.samba.org/samba.git/?p=samba.git;a=commitdiff;h=8128ceceb8702e596183dd509dd6f952a2f4efc2 Renumbered remaining patches. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-25 08:50:26 +02:00
Bernd Kuhls	914ba20600	package/clamav: security bump version to 0.101.4 Fixes CVE-2019-12900 and adds an additional fix for CVE-2019-12625. Release notes: https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-25 08:49:12 +02:00
Peter Korsgaard	24309ef4ab	package/nginx: security bump to version 1.16.1 Fixes the following security issues: Security: when using HTTP/2 a client might cause excessive memory consumption and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516). For details, see the advisory: https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-25 08:48:20 +02:00
Romain Naour	295307700b	package/gcc: allow uclibc only for gcc or1k (5.x) uClibc doesn't build with the upstream binutils 2.32.x and gcc or1k port due to the following error: LD libuClibc-1.0.31.so /opt/openrisc--uclibc--bleeding-edge-1/lib/gcc/or1k-buildroot-linux-uclibc/9.2.0/../../../../or1k-buildroot-linux-uclibc/bin/ld: libc/libc_so.a(or1k_clone.os): pc-relative relocation against dynamic symbol __syscall_error See: https://gitlab.com/kubu93/toolchains-builder/-/jobs/270854456 This error message come from a new check in binutils 2.32.x: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=f2c1801f6255a3f9f483ae2f07c7d7da0ddae4af This issue has been reported on the uClibc-ng mailing list: https://mailman.uclibc-ng.org/pipermail/devel/2019-August/001885.html Since gcc 9.1 needs binutils 2.32.x or later to build successfully for or1k, there is no binutils version left that can build gcc 9.1 and uClibc. For now, disable uClibc if gcc 9.1 is used for or1k. Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Waldemar Brodkorb <mail@waldemar-brodkorb.de> [Arnout: invert the logic, like in the rest of the file] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>	2019-08-21 23:50:33 +02:00
Romain Naour	e0ba09768e	package/gcc: gcc 9.x for or1k needs binutils >= 2.32 With binutils 2.30.x or 2.31.x, the assembler doesn't support the code generated by gcc 9.1: Error: junk at end of line `l.movhi r17,gotoffha(.LC0)' gotoffha is supported by binutils since version 2.32 [1]. It was added by the ork1 gcc port merged into gcc 9.x [2]. So, for or1k we can select gcc 9.x only if binutils 2.32 (or later) is selected. Tested using qemu_or1k_defconfig and selecting musl libc, binutils 2.32 and gcc 9.1. [1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=1c4f3780f7d939402cfe555007ebff45c8e38951 [2] https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=d61fdfe71cfd42aa6454f2267a48c97820918fe3 Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Waldemar Brodkorb <mail@waldemar-brodkorb.de> [Arnout: invert the logic, like in the rest of the file] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>	2019-08-21 23:46:10 +02:00
Pierre-Jean Texier	1e4e7db74c	package/libmicrohttpd: bump to version 0.9.66 See https://lists.gnu.org/archive/html/libmicrohttpd/2019-08/msg00000.html Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> (cherry picked from commit `b4da9642c5`) Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>	2019-08-21 23:12:15 +02:00
Arnout Vandecappelle (Essensium/Mind)	ac7d6c81f4	package/squid: remove trailing whitespace Commit `7792c4f1bc` introduced trailing whitespace. Remove it. Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/276636839 Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>	2019-08-21 22:44:42 +02:00
Fabrice Fontaine	7792c4f1bc	package/squid: security bump to version 4.8 - Add a patch to fix cross-compilation - Fix the following CVEs: - SQUID-2019:6 (CVE-2019-13345), Jul 12, 2019 Fixed from 4.8 Multiple Cross-Site Scripting issues in cachemgr.cgi - SQUID-2019:5 (CVE-2019-12527), Jul 12, 2019 Fixed from 4.8 Heap Overflow issue in HTTP Basic Authentication processing - SQUID-2019:3 (CVE-2019-12525), Jul 12, 2019 Fixed from 4.8 Denial of Service in HTTP Digest Authentication processing - SQUID-2019:2 (CVE-2019-12529), Jul 12, 2019 Fixed from 4.8 Denial of Service in HTTP Basic Authentication processing - SQUID-2019:1 (CVE-2019-12824), Jul 12, 2019 Fixed from 4.8 Denial of Service issue in cachemgr.cgi Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2019-08-21 08:29:23 +02:00