[PATCH] aprutil: Update to version 1.6.5

[Adolf Belka <adolf.belka@ipfire.org>]

- Update from version 1.6.3 to 1.6.5
- Update of rootfile
- 5 CVE fixes in 1.6.4
- Changelog
1.6.5
  *) Fix oracle DBD compilation errors introduced in 1.6.4. PR 70170.
1.6.4
  *) SECURITY: CVE-2026-34502: Heap buffer overflow in APR memcached
     client (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility memcached client
     This issue affects Apache Portable Runtime Utility: from 1.3.0
     through 1.6.3.
     Credits: Elhanan Haenel
  *) SECURITY: CVE-2026-34501: Apache Portable Runtime Utility: Heap
     buffer overflow in APR redis client (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility redis client.
     This issue affects Apache Portable Runtime Utility: from 1.6.0
     through 1.6.3.
     Users are recommended to upgrade to version 1.6.4, which fixes
     the issue.
     Credits: Elhanan Haenel
  *) SECURITY: CVE-2026-34191: Apache Portable Runtime Utility: SQL
     Injection in apr_dbd_oracle (cve.mitre.org)
     Improper Neutralization of Special Elements used in an SQL
     Command ('SQL Injection') vulnerability in Apache Portable
     Runtime Utility via apr_dbd_oracle provider.
     This issue affects Apache Portable Runtime Utility: from 1.6.0
     through 1.6.3.
     Users are recommended to upgrade to version 1.6.4, which fixes
     the issue.
     Credits: Elhanan Haenel
  *) SECURITY: CVE-2026-32327: Apache Portable Runtime Utility:
     apr-util XML stack recursion crash (cve.mitre.org)
     A bug in APR-util version 1.6.3 (and earlier) allows a stack
     recursion attack against any library consumer which parses XML
     from untrusted sources and uses the apr_xml_quote_elem()
     function.
     Users are recommended to upgrade to version 1.6.4, which fixes
     this issue.
     Credits: Younghyo Cho @ CISLab, SeoulTech
  *) SECURITY: CVE-2025-49506: apr_password_validate() vulnerable to
     timing attack (cve.mitre.org)
     APR-util versions 1.6.3 (and earlier) function
     apr_password_validate() was not constant-time with regards to
     hashes or passwords comparisons, potentially leaking their
     content via a side channel timing attack particularly on
     platforms without crypt() such as  Windows, BeOS, NetWare, or
     Android.
     Users are recommended to upgrade to version 1.6.4, which fixes
     this issue.
     Credits: Michael Rowley <michael csirt.global>
  *) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
     avoid producing an empty bucket.  PR 64273
     [Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
  *) apr_brigade: Metadata buckets are now ignored in
     apr_brigade_split_line, apr_brigade_flatten and
     apr_brigade_to_iovec, fixing possible undefined behaviour.  PR 68278
     [Ben Kallus <benjamin.p.kallus.gr dartmouth.edu>, Joe Orton]
  *) apr_crypto_openssl: Compatibility with OpenSSL 3.  [Yann Ylavic]
  *) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL
     on versions 1.1+. [Graham Leggett]
  *) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4.
     [Lubos Uhliarik <luhliari redhat.com>]
  *) configure: Fix Berkeley DB detection with compilers enforcing
     strict C99 compliance.  PR 66396.
     [Florian Weimer <fweimer redhat.com>]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/aprutil |  2 +-
 lfs/aprutil                     | 15 ++++++++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/config/rootfiles/common/aprutil b/config/rootfiles/common/aprutil
index 489616a93..672c5a692 100644
--- a/config/rootfiles/common/aprutil
+++ b/config/rootfiles/common/aprutil
@@ -48,5 +48,5 @@ usr/lib/apr-util-1/apr_dbm_gdbm.so
 #usr/lib/libaprutil-1.la
 #usr/lib/libaprutil-1.so
 usr/lib/libaprutil-1.so.0
-usr/lib/libaprutil-1.so.0.6.3
+usr/lib/libaprutil-1.so.0.6.5
 #usr/lib/pkgconfig/apr-util-1.pc
diff --git a/lfs/aprutil b/lfs/aprutil
index 556f75a22..39761715c 100644
--- a/lfs/aprutil
+++ b/lfs/aprutil
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2023  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -25,7 +25,7 @@
 
 include Config
 
-VER        = 1.6.3
+VER        = 1.6.5
 
 THISAPP    = apr-util-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 5eb56c45ba9d87ff3e3769439a3a9a858a1947de68b34892c729f39736fc41117a41c630c3c4cfb07b444c4ee0d5853ec5be158e8fa0b0c0ab89f0cb51cc9c6d
+$(DL_FILE)_BLAKE2 = ee11e45f0029b336c80536f0b98b48f044229d5b9d8669471a1f0641eee8aa6ddbd8f2249ce6116294dc3d3c5b8b939532c366e6208dafe325eeba1db2603300
 
 install : $(TARGET)
 
@@ -75,8 +75,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
 
-	cd $(DIR_APP) && ./configure --prefix=/usr \
-				--with-apr=/usr --with-gdbm=/usr --with-openssl=/usr --with-crypto --with-expat=/usr
+	cd $(DIR_APP) && ./configure \
+				--prefix=/usr \
+				--with-apr=/usr \
+				--with-gdbm=/usr \
+				--with-openssl=/usr \
+				--with-crypto \
+				--with-expat=/usr
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 
-- 
2.55.0