diff --git a/configs/acmesystems_acqua_a5_256mb_defconfig b/configs/acmesystems_acqua_a5_256mb_defconfig index ca4ba27a2829..f2ab66631f09 100644 --- a/configs/acmesystems_acqua_a5_256mb_defconfig +++ b/configs/acmesystems_acqua_a5_256mb_defconfig @@ -23,6 +23,7 @@ BR2_TARGET_AT91BOOTSTRAP3=y BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_GIT=y BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_REPO_URL="https://github.com/linux4sam/at91bootstrap.git" BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_REPO_VERSION="v3.10.3" +BR2_TARGET_AT91BOOTSTRAP3_LICENSE_FILES="" BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="acqua-256m" BR2_PACKAGE_HOST_DOSFSTOOLS=y BR2_PACKAGE_HOST_GENIMAGE=y diff --git a/configs/acmesystems_acqua_a5_512mb_defconfig b/configs/acmesystems_acqua_a5_512mb_defconfig index 240dfc46b6bb..172eaef39f1e 100644 --- a/configs/acmesystems_acqua_a5_512mb_defconfig +++ b/configs/acmesystems_acqua_a5_512mb_defconfig @@ -23,6 +23,7 @@ BR2_TARGET_AT91BOOTSTRAP3=y BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_GIT=y BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_REPO_URL="https://github.com/linux4sam/at91bootstrap.git" BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_REPO_VERSION="v3.10.3" +BR2_TARGET_AT91BOOTSTRAP3_LICENSE_FILES="" BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="acqua-512m" BR2_PACKAGE_HOST_DOSFSTOOLS=y BR2_PACKAGE_HOST_GENIMAGE=y diff --git a/package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch b/package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch new file mode 100644 index 000000000000..d0a31ed8217f --- /dev/null +++ b/package/busybox/0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch @@ -0,0 +1,42 @@ +From: Radoslav Kolev +Date: Fri, 21 Nov 2025 11:21:18 +0200 +Subject: wget: don't allow control characters or spaces in the URL +Forwarded: yes, https://lists.busybox.net/pipermail/busybox/2025-November/091840.html +Bug-Debian: https://bugs.debian.org/1120795 + +Fixes CVE-2025-60876 malicious URL can be used to inject +HTTP headers in the request. + +Signed-off-by: Radoslav Kolev +Reviewed-by: Emmanuel Deloget +Upstream: https://sources.debian.org/data/main/b/busybox/1%3A1.37.0-10/debian/patches/wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch +Upstream: https://lists.busybox.net/pipermail/busybox/2025-November/091840.html +CVE: CVE-2025-60876 +Signed-off-by: Thomas Perale +--- + networking/wget.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/networking/wget.c b/networking/wget.c +index ec3767793..fa555427b 100644 +--- a/networking/wget.c ++++ b/networking/wget.c +@@ -536,6 +536,15 @@ static void parse_url(const char *src_url, struct host_info *h) + { + char *url, *p, *sp; + ++ /* Fix for CVE-2025-60876 - don't allow control characters or spaces in the URL */ ++ /* otherwise a malicious URL can be used to inject HTTP headers in the request */ ++ const unsigned char *u = (void *) src_url; ++ while (*u) { ++ if (*u <= ' ') ++ bb_simple_error_msg_and_die("Unencoded control character found in the URL!"); ++ u++; ++ } ++ + free(h->allocated); + h->allocated = url = xstrdup(src_url); + +-- +2.47.3 + diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk index 7ae9c1d41e24..a33548c355eb 100644 --- a/package/busybox/busybox.mk +++ b/package/busybox/busybox.mk @@ -19,6 +19,9 @@ BUSYBOX_IGNORE_CVES += CVE-2022-28391 # 0013-testsuite-tar-tests-fix-test-after-cve-2025-46394.patch BUSYBOX_IGNORE_CVES += CVE-2025-46394 +# 0014-wget-dont-allow-control-characters-or-spaces-in-the-URL.patch +BUSYBOX_IGNORE_CVES += CVE-2025-60876 + BUSYBOX_CFLAGS = \ $(TARGET_CFLAGS) diff --git a/package/coreutils/coreutils.hash b/package/coreutils/coreutils.hash index d01955d927e6..ce507a301597 100644 --- a/package/coreutils/coreutils.hash +++ b/package/coreutils/coreutils.hash @@ -1,5 +1,3 @@ -# From https://lists.gnu.org/archive/html/coreutils-announce/2025-09/msg00000.html -sha1 a6a58e00688fe0705a7051b36592f1e43e89a9ef coreutils-9.8.tar.xz -sha256 e6d4fd2d852c9141a1c2a18a13d146a0cd7e45195f72293a4e4c044ec6ccca15 coreutils-9.8.tar.xz # Locally computed +sha256 16535a9adf0b10037364e2d612aad3d9f4eca3a344949ced74d12faf4bd51d25 coreutils-9.10.tar.xz sha256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986 COPYING diff --git a/package/coreutils/coreutils.mk b/package/coreutils/coreutils.mk index b764cb5843ec..01c0cc72f162 100644 --- a/package/coreutils/coreutils.mk +++ b/package/coreutils/coreutils.mk @@ -4,7 +4,7 @@ # ################################################################################ -COREUTILS_VERSION = 9.8 +COREUTILS_VERSION = 9.10 COREUTILS_SITE = $(BR2_GNU_MIRROR)/coreutils COREUTILS_SOURCE = coreutils-$(COREUTILS_VERSION).tar.xz COREUTILS_LICENSE = GPL-3.0+ @@ -16,6 +16,7 @@ COREUTILS_CPE_ID_VENDOR = gnu # if the system is compliant even with this option passed COREUTILS_CONF_OPTS = --disable-rpath \ --disable-year2038 \ + --enable-install-program=kill,uptime \ $(if $(BR2_TOOLCHAIN_USES_MUSL),--with-included-regex) ifeq ($(BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES),y) @@ -57,7 +58,7 @@ COREUTILS_CONF_ENV = ac_cv_c_restrict=no \ COREUTILS_BIN_PROGS = base64 cat chgrp chmod chown cp date dd df dir echo false \ kill link ln ls mkdir mknod mktemp mv nice printenv pwd rm rmdir \ - vdir sleep stty sync touch true uname join + vdir sleep stty sync touch true uname uptime join ifeq ($(BR2_PACKAGE_ACL),y) COREUTILS_DEPENDENCIES += acl diff --git a/package/haproxy/haproxy.hash b/package/haproxy/haproxy.hash index 42f340fa8063..ce5dae17e703 100644 --- a/package/haproxy/haproxy.hash +++ b/package/haproxy/haproxy.hash @@ -1,5 +1,5 @@ -# From: http://www.haproxy.org/download/2.6/src/haproxy-2.6.22.tar.gz.sha256 -sha256 4c0797f450f997dc287d2c7aafa7a0e5b7a2d71593a2cd58e664e8f3aea614fa haproxy-2.6.22.tar.gz +# From: http://www.haproxy.org/download/2.6/src/haproxy-2.6.23.tar.gz.sha256 +sha256 1281d57f25e98456a042c81f32801a106a293c1340b0c06debb2a87d6a7b3611 haproxy-2.6.23.tar.gz # Locally computed: sha256 0717ca51fceaa25ac9e5ccc62e0c727dcf27796057201fb5fded56a25ff6ca28 LICENSE sha256 5df07007198989c622f5d41de8d703e7bef3d0e79d62e24332ee739a452af62a doc/lgpl.txt diff --git a/package/haproxy/haproxy.mk b/package/haproxy/haproxy.mk index 77195d966b38..51878e754fd2 100644 --- a/package/haproxy/haproxy.mk +++ b/package/haproxy/haproxy.mk @@ -5,12 +5,16 @@ ################################################################################ HAPROXY_VERSION_MAJOR = 2.6 -HAPROXY_VERSION = $(HAPROXY_VERSION_MAJOR).22 +HAPROXY_VERSION = $(HAPROXY_VERSION_MAJOR).23 HAPROXY_SITE = http://www.haproxy.org/download/$(HAPROXY_VERSION_MAJOR)/src HAPROXY_LICENSE = GPL-2.0+ and LGPL-2.1+ with exceptions HAPROXY_LICENSE_FILES = LICENSE doc/lgpl.txt doc/gpl.txt HAPROXY_CPE_ID_VENDOR = haproxy +# Incomplete NVD annotations, fixed since v2.6.15 +# https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=832b672eee54866c7a42a1d46078cc9ae0d544d9 +HAPROXY_IGNORE_CVES += CVE-2023-45539 + HAPROXY_MAKE_OPTS = \ LD=$(TARGET_CC) \ PREFIX=/usr \ diff --git a/package/intel-mediadriver/intel-mediadriver.hash b/package/intel-mediadriver/intel-mediadriver.hash index ca7993be2352..bf3a8a2c5e0c 100644 --- a/package/intel-mediadriver/intel-mediadriver.hash +++ b/package/intel-mediadriver/intel-mediadriver.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 c59cbef1de138bcda45b93ad2b7f3db65619756d5c126fb32a30076ba5bb71b0 intel-media-26.1.1.tar.gz +sha256 e2eea3df18d766059d6667a187ae47d0ea986fa0502d8ba8fdf92183e65e9871 intel-media-26.1.2.tar.gz sha256 74979d5aaee78b8da82e3aafd415a216b6131dfff6d95d6930927c8a4e3bded3 LICENSE.md diff --git a/package/intel-mediadriver/intel-mediadriver.mk b/package/intel-mediadriver/intel-mediadriver.mk index 75eb8591934f..43f3bed9eb17 100644 --- a/package/intel-mediadriver/intel-mediadriver.mk +++ b/package/intel-mediadriver/intel-mediadriver.mk @@ -6,7 +6,7 @@ # based on https://software.intel.com/en-us/articles/build-and-debug-open-source-media-stack -INTEL_MEDIADRIVER_VERSION = 26.1.1 +INTEL_MEDIADRIVER_VERSION = 26.1.2 INTEL_MEDIADRIVER_SITE = https://github.com/intel/media-driver/archive INTEL_MEDIADRIVER_SOURCE= intel-media-$(INTEL_MEDIADRIVER_VERSION).tar.gz INTEL_MEDIADRIVER_LICENSE = MIT, BSD-3-Clause diff --git a/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.hash b/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.hash index 7497d862db7f..9cd12ae9c103 100644 --- a/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.hash +++ b/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 67fd57d1c5709b58bb6406d60e3f2c4e0b47bd38c4a82c4c46619b78f6c23e72 intel-vpl-gpu-rt-26.1.1.tar.gz +sha256 1f0b4a81b206253d315d795e5c075312f6b20e0110c7cf9bc83d24bd548fc015 intel-vpl-gpu-rt-26.1.2.tar.gz sha256 c31c3cc5fd66d1250dbca1c3d9011a9f874537442ac71c8de80f2f0fed13f297 LICENSE diff --git a/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.mk b/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.mk index 54921be12d54..6468462fc29b 100644 --- a/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.mk +++ b/package/intel-vpl-gpu-rt/intel-vpl-gpu-rt.mk @@ -4,7 +4,7 @@ # ################################################################################ -INTEL_VPL_GPU_RT_VERSION = 26.1.1 +INTEL_VPL_GPU_RT_VERSION = 26.1.2 INTEL_VPL_GPU_RT_SITE = $(call github,intel,vpl-gpu-rt,intel-onevpl-$(INTEL_VPL_GPU_RT_VERSION)) INTEL_VPL_GPU_RT_LICENSE = MIT INTEL_VPL_GPU_RT_LICENSE_FILES = LICENSE diff --git a/package/kodi-pvr-mythtv/kodi-pvr-mythtv.hash b/package/kodi-pvr-mythtv/kodi-pvr-mythtv.hash index a8b6ca79b6c0..c187fb00548d 100644 --- a/package/kodi-pvr-mythtv/kodi-pvr-mythtv.hash +++ b/package/kodi-pvr-mythtv/kodi-pvr-mythtv.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 c34a54d06aefef1c4c250ab766c459becc1fdaf42782da75cf749b71585bf6dd kodi-pvr-mythtv-21.2.14-Omega.tar.gz +sha256 47d058a9bd960ccdc3352b2fac6f4aeb7587bad50cf1daee20d643c5e64deeb2 kodi-pvr-mythtv-21.2.15-Omega.tar.gz sha256 310782e1abd43c4de6217c513e328bddf999d39302d67c6e05b10a59959827af LICENSE.md diff --git a/package/kodi-pvr-mythtv/kodi-pvr-mythtv.mk b/package/kodi-pvr-mythtv/kodi-pvr-mythtv.mk index 78ea3041b7a6..9b1b336dfd59 100644 --- a/package/kodi-pvr-mythtv/kodi-pvr-mythtv.mk +++ b/package/kodi-pvr-mythtv/kodi-pvr-mythtv.mk @@ -4,7 +4,7 @@ # ################################################################################ -KODI_PVR_MYTHTV_VERSION = 21.2.14-Omega +KODI_PVR_MYTHTV_VERSION = 21.2.15-Omega KODI_PVR_MYTHTV_SITE = $(call github,janbar,pvr.mythtv,$(KODI_PVR_MYTHTV_VERSION)) KODI_PVR_MYTHTV_LICENSE = GPL-2.0+ KODI_PVR_MYTHTV_LICENSE_FILES = LICENSE.md diff --git a/package/less/less.hash b/package/less/less.hash index 49dcaf28efe4..5f0b0f3846fc 100644 --- a/package/less/less.hash +++ b/package/less/less.hash @@ -1,6 +1,6 @@ # Locally calculated after checking pgp signature # using DSA key F153A7C833235259 -# https://www.greenwoodsoftware.com/less/less-691.sig -sha256 88b480eda1bb4f92009f7968b23189eaf1329211f5a3515869e133d286154d25 less-691.tar.gz +# https://www.greenwoodsoftware.com/less/less-692.sig +sha256 61300f603798ecf1d7786570789f0ff3f5a1acf075a6fb9f756837d166e37d14 less-692.tar.gz # Locally calculated sha256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986 COPYING diff --git a/package/less/less.mk b/package/less/less.mk index 6f78fb67c76e..49156a805bdc 100644 --- a/package/less/less.mk +++ b/package/less/less.mk @@ -4,7 +4,7 @@ # ################################################################################ -LESS_VERSION = 691 +LESS_VERSION = 692 LESS_SITE = http://www.greenwoodsoftware.com/less LESS_LICENSE = GPL-3.0+ LESS_LICENSE_FILES = COPYING diff --git a/package/php/php.hash b/package/php/php.hash index 6d13f11e56b9..5747e153f2b5 100644 --- a/package/php/php.hash +++ b/package/php/php.hash @@ -1,5 +1,5 @@ # From https://www.php.net/downloads.php?source=Y -sha256 cb75a9b00a2806f7390dd64858ef42a47b443b3475769c8af6af33a18b1381f1 php-8.5.2.tar.xz +sha256 ce65725b8af07356b69a6046d21487040b11f2acfde786de38b2bfb712c36eb9 php-8.5.3.tar.xz # License file sha256 b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a LICENSE diff --git a/package/php/php.mk b/package/php/php.mk index 2c91ef7b6382..4cba87a06ec3 100644 --- a/package/php/php.mk +++ b/package/php/php.mk @@ -4,7 +4,7 @@ # ################################################################################ -PHP_VERSION = 8.5.2 +PHP_VERSION = 8.5.3 PHP_SITE = https://www.php.net/distributions PHP_SOURCE = php-$(PHP_VERSION).tar.xz PHP_INSTALL_STAGING = YES