summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #6124 from wigyori/for-15.05-freeradius2for-15.05Daniel Golle2018-06-151-3/+3
|\ | | | | CC: freeradius2: bump to 2.2.10
| * freeradius2: bump to 2.2.10Zoltan HERPAI2018-05-241-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Fix multiple security issues. See http://freeradius.org/security/fuzzer-2017.html Thanks to Guido Vranken for working with us to discover the issues and test the fixes. - FR-GV-207 Avoid zero-length malloc() in data2vp(). - FR-GV-206 correct decoding of option 60. - FR-GV-205 check for "too long" WiMAX options. - FR-GV-204 free VP if decoding fails, so we don't leak memory. - FR-GV-203 fix memory leak when using decode_tlv(). - FR-GV-202 check for "too long" attributes. - FR-GV-201 check input/output length in make_secret(). - FR-AD-001 Use strncmp() instead of memcmp() for bounded data. - Disable in-memory TLS session caches due to OpenSSL API issues. - Allow issuer_cert to be empty. - Look for extensions using correct index. - Fix types. - Work around OpenSSL 1.0.2 problems, which cause failures in TLS-based EAP methods. - Revert RedHat contributed bug which removes run-time checks for OpenSSL consistency. - Allow OCSP responder URL to be later in the packet Fix by Ean Pasternak. - Catch empty subject and non-existent issuer cert in OCSP Fix by Ean Pasternak. - Allow non-FIPS for MD5 Fix by Ean Pasternak. Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
| * freeradius2: update to version 2.2.9Daniel Golle2018-05-241-3/+3
| | | | | | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* | Merge pull request #6120 from wigyori/for-15.05-perlPhilip Prindeville2018-05-293-6/+6
|\ \ | | | | | | CC: perl5: upgrade 3 CPAN packages to fix build
| * | perl-uri: bump to 1.74Zoltan HERPAI2018-05-241-2/+2
| | | | | | | | | | | | Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
| * | perl-html-parser: bump to 3.72Zoltan HERPAI2018-05-241-2/+2
| | | | | | | | | | | | Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
| * | perl-dbi: bump to 1.641Zoltan HERPAI2018-05-241-2/+2
| | | | | | | | | | | | Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
* | | Merge pull request #6126 from wigyori/for-15.05-pcre_nginxThomas Heil2018-05-251-3/+4
|\ \ \ | | | | | | | | CC: pcre: bump to 8.41 and fix CVEs
| * | | pcre: Added fix for CVE-2017-11164 by adding stack recursion limitThomas Heil2018-05-241-1/+2
| | | | | | | | | | | | | | | | Signed-off-by: Thomas Heil <heil@terminal-consulting.de>
| * | | pcre: upgrade to version 8.41 - fixes security issuesThomas Heil2018-05-242-56/+3
| | | | | | | | | | | | | | | | Signed-off-by: Thomas Heil <heil@terminal-consulting.de>
| * | | fix CVE-2017-7186 Fix CVE-2017-7186 mentioned in ↵Thomas Heil2018-05-242-1/+54
| | | | | | | | | | | | | | | | | | | | | | | | https://bugs.exim.org/show_bug.cgi?id=2052 Signed-off-by: Thomas Heil <heil@terminal-consulting.de>
| * | | package: pcre bump to version 8.40heil2018-05-241-2/+2
| | |/ | |/| | | | | | | Signed-off-by: heil <heil@terminal-consulting.de>
* | | Merge pull request #5542 from micmac1/jiri-for-15.05Jiri Slachta2018-01-3033-1098/+1208
|\ \ \ | | | | | | | | libssh2, libxslt, tiff: security bumps (for 15.05)
| * | | tiff: version bump to address open CVEsSebastian Kemper2018-01-3013-1088/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Bumps version to 4.0.9. Otherwise about two dozen packages would need to be backported. There were no ABI/API changes between 4.0.3 and 4.0.9, so this is OK. - Adds a patch from Jow that addresses a macro issue (already in master/lede-17.01) - Adds patches copied from Debian for CVE-2017-18013 and CVE-2017-9935 on top. Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
| * | | libxslt: revision bump to address open CVEsSebastian Kemper2018-01-3018-4/+1009
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Add patches copied from Debian to address open CVEs - Update mail address of maintainer - Fix a typo - Add --disable-silent-rules for verbose build output Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
| * | | libssh2: revision bump to fix CVE-2016-0787Sebastian Kemper2018-01-302-6/+29
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | - adds patch copied from Debian to address CVE - fixes zlib detection - changes http to https links - updates maintainer's mail address Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
* | | Merge pull request #5084 from wigyori/for-15.05-irssiZoltan Herpai2018-01-291-5/+4
|\ \ \ | | | | | | | | CC: net/irssi: upgrade irssi, update download URL
| * | | irssi: update to 0.8.21Peter Wagner2017-11-081-3/+3
| | | | | | | | | | | | | | | | Signed-off-by: Peter Wagner <tripolar@gmx.at>
| * | | irssi: update to 0.8.20Peter Wagner2017-11-081-5/+4
| |/ / | | | | | | | | | Signed-off-by: Peter Wagner <tripolar@gmx.at>
* | | Merge pull request #5102 from wigyori/for-15.05-xupnpdZoltan Herpai2018-01-293-16/+20
|\ \ \ | | | | | | | | CC: multimedia/xupnpd: move download source and upgrade to 2016-07-06
| * | | xupnpd: update to latest versionÁlvaro Fernández Rojas2017-11-101-2/+2
| | | | | | | | | | | | | | | | Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
| * | | xupnpd: Update to 2016-05-11kuoruan2017-11-103-16/+20
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | * Change source url to GitHub * Update to 2016-05-11 * Add LICENSE * Edit Makefile Signed-off-by: Hsing-Wang Liao <kuoruan@gmail.com> Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
* | | Merge pull request #5151 from wigyori/for-15.05-bluezZoltan Herpai2018-01-298-77/+168
|\ \ \ | | | | | | | | CC: bluez: upgrade to 5.47
| * | | bluez: bump to 5.47 fix CVE-2017-1000250Hirokazu MORIKAWA2017-11-186-63/+36
| | | | | | | | | | | | | | | | | | | | | | | | http://www.bluez.org/release-of-bluez-5-47/ Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
| * | | bluez: update to v5.38Álvaro Fernández Rojas2017-11-181-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes https://github.com/openwrt/packages/issues/2523 Closes https://github.com/openwrt/packages/pull/2545 Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
| * | | bluez: Add support for Raspberry Pi 3Álvaro Fernández Rojas2017-11-185-1/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Adds bcm43xx-3wire variant. - Resets UART speed after firmware download. - Prints chip name when firmware isn't found for bcm43xx. - Increases timeout for bcm43xx. - Moves bcm43xx firmware to lib. Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
| * | | bluez: update to v5.37Álvaro Fernández Rojas2017-11-182-6/+6
| | | | | | | | | | | | | | | | Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
| * | | bluez: update to version 5.33Hauke Mehrtens2017-11-182-14/+10
| | | | | | | | | | | | | | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| * | | bluez: update to version 5.31Hauke Mehrtens2017-11-182-8/+8
| | | | | | | | | | | | | | | | Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| * | | bluez: add btmgmt toolHauke Mehrtens2017-11-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The btmgmt tool is needed to activate BL LE support. Currently it is not installed. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| * | | bluez: Add bluez-daemon packageBruno Randolf2017-11-181-6/+33
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move bluetoothd and related programs and files from bluez-utils into bluez-daemon package. The main motivation for this is to remove the dependency to DBus from bluez-utils. The utilities like "hcitool" are useful without it. Also add kmod-bluetooth dependency to bluez-utils, as the utils don't make much sense without bluetooth support in the kernel. Signed-off-by: Bruno Randolf <br1@einfach.org>
* | | Merge pull request #5114 from wigyori/for-15.05-squidMarko Ratkaj2018-01-245-40/+38
|\ \ \ | | | | | | | | CC: squid: upgrade to 3.5.27
| * | | squid: bump to 3.5.27Marko Ratkaj2017-11-123-39/+27
| | | | | | | | | | | | | | | | | | | | | | | | Bump Squid to version 3.5.27 and fix broken menuconfig menu. Signed-off-by: Marko Ratkaj <marko.ratkaj@sartura.hr>
| * | | net/squid: Allow squid to parse mime.confAdam Gensler2017-11-122-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | Copy mime.conf to temporary directory so squid process can properly read the file. Without it squid cannot access mime.conf and throws a warning during startup. Signed-off by: Adam Gensler <openwrt@a.gnslr.us>
| * | | squid: disable krb5Dirk Neukirchen2017-11-091-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - fix build error reported by buildbot by disabling krb5 - libcom_err from krb5 is used - configure output: configure: WARNING: library 'com_err' is required for Heimdal Kerberos - krb5 has its own libcom_err (see krb5 package) with its own symbols - linking with wrong libcom_err from libext2fs produces errors during libgssapi_krb5.so: undefined reference to `error_message@com_err_3_MIT' libgssapi_krb5.so: undefined reference to `remove_error_table@com_err_3_MIT' libgssapi_krb5.so: undefined reference to `add_error_table@com_err_3_MIT' -> remove libext2fs dependency (wasnt working anyway - no PKG_BUILD_DEP) Signed-off-by: Dirk Neukirchen <dirkneukirchen@web.de>
| * | | squid: build-depend on libext2fsDaniel Golle2017-11-091-0/+3
| |/ / | | | | | | | | | | | | | | | squid uses libcom_err, a static library provided by libext2fs Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* | | Merge pull request #5233 from wigyori/for-15.05-bindZoltan Herpai2017-12-075-69/+120
|\ \ \ | | | | | | | | CC: bind: bump to 9.11.2
| * | | bind: bring back PKG_MD5SUM for CCZoltan HERPAI2017-12-061-1/+1
| | | | | | | | | | | | | | | | Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
| * | | bind: version update to 9.11.2Philip Prindeville2017-11-193-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | Also refresh patches and dependencies. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
| * | | bind: Update to 9.10.5-P3Noah Meyerhans2017-11-191-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New upstream release includes fixes for the following security issues: * CVE-2017-3140: With certain RPZ configurations, a response with TTL 0 could cause named to go into an infinite query loop * CVE-2017-3142: An error in TSIG handling could permit unauthorized zone transfers or zone updates. * CVE-2017-3143: An error in TSIG handling could permit unauthorized zone transfers or zone updates. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
| * | | bind: Include dnssec-settime in bind-dnssec/toolSami Olmari2017-11-191-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | <net/bind> Maintainer: @nmeyerhans Compile tested: x86_64, OpenWRT 50107 Run tested: x86 / 64, OpenWRT 50107 Description: Added dnssec-settime into bind-dnssec and bind-tools Signed-off-by: Sami Olmari <sami+git@olmari.fi>
| * | | bind: Update to bind-9.10.5Noah Meyerhans2017-11-191-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change includes fixes for several security issues: * CVE-2017-3138: rndc "" could trigger an assertion failure in named. * CVE-2017-3137: Some chaining (i.e., type CNAME or DNAME) responses to upstream queries could trigger assertion failures. * CVE-2017-3136: dns64 with break-dnssec yes; can result in an assertion failure. * CVE-2017-3135: If a server is configured with a response policy zone (RPZ) that rewrites an answer with local data, and is also configured for DNS64 address mapping, a NULL pointer can be read triggering a server crash. * CVE-2016-9444: named could mishandle authority sections with missing RRSIGs, triggering an assertion failure. * CVE-2016-9131: named mishandled some responses where covering RRSIG records were returned without the requested data, resulting in an assertion failure. * CVE-2016-9131: named incorrectly tried to cache TKEY records which could trigger an assertion failure when there was a class mismatch. * CVE-2016-8864: It was possible to trigger assertions when processing responses containing answers of type DNAME. * CVE-2016-6170: Added the ability to specify the maximum number of records permitted in a zone (max-records #;). This provides a mechanism to block overly large zone transfers, which is a potential risk with slave zones from other parties. * CVE-2016-2776: It was possible to trigger an assertion when rendering a message using a specially crafted request. * CVE-2016-2775: Calling getrrsetbyname() with a non absolute name could trigger an infinite recursion bug in lwresd or named with lwres configured if, when combined with a search list entry from resolv.conf, the resulting name is too long. Signed-off-by: Noah Meyerhans <frodo@morgul.net>
| * | | bind: update to bind-9.10.4-P5Noah Meyerhans2017-11-191-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change fixes multiple denial-of-service vulnerabilities: * CVE-2016-9131: A malformed response to an ANY query can cause an assertion failure during recursion * CVE-2016-9147: An error handling a query response containing inconsistent DNSSEC information could cause an assertion failure * CVE-2016-9444: An unusually-formed DS record response could cause an assertion failure * CVE-2016-9778: An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c Signed-off-by: Noah Meyerhans <frodo@morgul.net>
| * | | bind: disable libjson supportStijn Tintel2017-11-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | If libjson-c is detected during bind-libs configure phase, bind-libs will be built with libjson support. This results in a missing dependency error during install phase. Solve this by disabling libjson support.
| * | | bind: set sysconfdir to /etc/bindNoah Meyerhans2017-11-191-1/+2
| | | | | | | | | | | | | | | | Signed-off-by: Noah Meyerhans <frodo@morgul.net>
| * | | bind: update to 9.10.4-p4Noah Meyerhans2017-11-093-15/+17
| | | | | | | | | | | | | | | | Signed-off-by: Noah Meyerhans <frodo@morgul.net>
| * | | bind: Set PKG_USE_MIPS16:=0Noah Meyerhans2017-11-091-1/+2
| | | |
| * | | bind: Update to 9.9.9-p3 for CVE-2016-2776Noah Meyerhans2017-11-091-3/+3
| | | | | | | | | | | | | | | | Signed-off-by: Noah Meyerhans <frodo@morgul.net>
| * | | net/bind: PKG_RELEASE increasedZoltan HERPAI2017-11-091-1/+1
| | | | | | | | | | | | | | | | Signed-off-by: DonkZZ <donk@evhr.net>
| * | | net/bind: Update db.rootDonkZZ2017-11-091-45/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The contents of the file "db.root" is very old (12 years). Here's a new version downloaded from ftp://ftp.internic.net/domain/ Signed-off-by: DonkZZ <donk@evhr.net>
generated by cgit (git 2.46.0) at 2026-10-12 00:21:54 +0000