[PATCH] aprutil: Update to version 1.6.5

[PATCH] aprutil: Update to version 1.6.5

[Adolf Belka]

- Update from version 1.6.3 to 1.6.5
- Update of rootfile
- 5 CVE fixes in 1.6.4
- Changelog
1.6.5
  *) Fix oracle DBD compilation errors introduced in 1.6.4. PR 70170.
1.6.4
  *) SECURITY: CVE-2026-34502: Heap buffer overflow in APR memcached
     client (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility memcached client
     This issue affects Apache Portable Runtime Utility: from 1.3.0
     through 1.6.3.
     Credits: Elhanan Haenel
  *) SECURITY: CVE-2026-34501: Apache Portable Runtime Utility: Heap
     buffer overflow in APR redis client (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache Portable
     Runtime Utility redis client.
     This issue affects Apache Portable Runtime Utility: from 1.6.0
     through 1.6.3.
     Users are recommended to upgrade to version 1.6.4, which fixes
     the issue.
     Credits: Elhanan Haenel
  *) SECURITY: CVE-2026-34191: Apache Portable Runtime Utility: SQL
     Injection in apr_dbd_oracle (cve.mitre.org)
     Improper Neutralization of Special Elements used in an SQL
     Command ('SQL Injection') vulnerability in Apache Portable
     Runtime Utility via apr_dbd_oracle provider.
     This issue affects Apache Portable Runtime Utility: from 1.6.0
     through 1.6.3.
     Users are recommended to upgrade to version 1.6.4, which fixes
     the issue.
     Credits: Elhanan Haenel
  *) SECURITY: CVE-2026-32327: Apache Portable Runtime Utility:
     apr-util XML stack recursion crash (cve.mitre.org)
     A bug in APR-util version 1.6.3 (and earlier) allows a stack
     recursion attack against any library consumer which parses XML
     from untrusted sources and uses the apr_xml_quote_elem()
     function.
     Users are recommended to upgrade to version 1.6.4, which fixes
     this issue.
     Credits: Younghyo Cho @ CISLab, SeoulTech
  *) SECURITY: CVE-2025-49506: apr_password_validate() vulnerable to
     timing attack (cve.mitre.org)
     APR-util versions 1.6.3 (and earlier) function
     apr_password_validate() was not constant-time with regards to
     hashes or passwords comparisons, potentially leaking their
     content via a side channel timing attack particularly on
     platforms without crypt() such as  Windows, BeOS, NetWare, or
     Android.
     Users are recommended to upgrade to version 1.6.4, which fixes
     this issue.
     Credits: Michael Rowley <michael csirt.global>
  *) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
     avoid producing an empty bucket.  PR 64273
     [Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
  *) apr_brigade: Metadata buckets are now ignored in
     apr_brigade_split_line, apr_brigade_flatten and
     apr_brigade_to_iovec, fixing possible undefined behaviour.  PR 68278
     [Ben Kallus <benjamin.p.kallus.gr dartmouth.edu>, Joe Orton]
  *) apr_crypto_openssl: Compatibility with OpenSSL 3.  [Yann Ylavic]
  *) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL
     on versions 1.1+. [Graham Leggett]
  *) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4.
     [Lubos Uhliarik <luhliari redhat.com>]
  *) configure: Fix Berkeley DB detection with compilers enforcing
     strict C99 compliance.  PR 66396.
     [Florian Weimer <fweimer redhat.com>]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/aprutil |  2 +-
 lfs/aprutil                     | 15 ++++++++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/config/rootfiles/common/aprutil b/config/rootfiles/common/aprutil
index 489616a93..672c5a692 100644
--- a/config/rootfiles/common/aprutil
+++ b/config/rootfiles/common/aprutil
@@ -48,5 +48,5 @@ usr/lib/apr-util-1/apr_dbm_gdbm.so
 #usr/lib/libaprutil-1.la
 #usr/lib/libaprutil-1.so
 usr/lib/libaprutil-1.so.0
-usr/lib/libaprutil-1.so.0.6.3
+usr/lib/libaprutil-1.so.0.6.5
 #usr/lib/pkgconfig/apr-util-1.pc
diff --git a/lfs/aprutil b/lfs/aprutil
index 556f75a22..39761715c 100644
--- a/lfs/aprutil
+++ b/lfs/aprutil
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2023  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -25,7 +25,7 @@
 
 include Config
 
-VER        = 1.6.3
+VER        = 1.6.5
 
 THISAPP    = apr-util-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 5eb56c45ba9d87ff3e3769439a3a9a858a1947de68b34892c729f39736fc41117a41c630c3c4cfb07b444c4ee0d5853ec5be158e8fa0b0c0ab89f0cb51cc9c6d
+$(DL_FILE)_BLAKE2 = ee11e45f0029b336c80536f0b98b48f044229d5b9d8669471a1f0641eee8aa6ddbd8f2249ce6116294dc3d3c5b8b939532c366e6208dafe325eeba1db2603300
 
 install : $(TARGET)
 
@@ -75,8 +75,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
 
-	cd $(DIR_APP) && ./configure --prefix=/usr \
-				--with-apr=/usr --with-gdbm=/usr --with-openssl=/usr --with-crypto --with-expat=/usr
+	cd $(DIR_APP) && ./configure \
+				--prefix=/usr \
+				--with-apr=/usr \
+				--with-gdbm=/usr \
+				--with-openssl=/usr \
+				--with-crypto \
+				--with-expat=/usr
 	cd $(DIR_APP) && make $(MAKETUNING)
 	cd $(DIR_APP) && make install
 
-- 
2.55.0

[PATCH] core205: Ship aprutil

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/205/filelists/aprutil | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/205/filelists/aprutil

diff --git a/config/rootfiles/core/205/filelists/aprutil b/config/rootfiles/core/205/filelists/aprutil
new file mode 120000
index 000000000..999f9f84b
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/aprutil
@@ -0,0 +1 @@
+../../../common/aprutil
\ No newline at end of file
-- 
2.55.0

[PATCH] core205: Ship openssh

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/205/filelists/openssh | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/205/filelists/openssh

diff --git a/config/rootfiles/core/205/filelists/openssh b/config/rootfiles/core/205/filelists/openssh
new file mode 120000
index 000000000..d8c77fd8e
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/openssh
@@ -0,0 +1 @@
+../../../common/openssh
\ No newline at end of file
-- 
2.55.0

[PATCH] core205: Ship procps

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/205/filelists/procps | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/205/filelists/procps

diff --git a/config/rootfiles/core/205/filelists/procps b/config/rootfiles/core/205/filelists/procps
new file mode 120000
index 000000000..e17e8ed70
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/procps
@@ -0,0 +1 @@
+../../../common/procps
\ No newline at end of file
-- 
2.55.0

[PATCH] core205: Ship wpa_supplicant

[Adolf Belka]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/core/205/filelists/wpa_supplicant | 1 +
 1 file changed, 1 insertion(+)
 create mode 120000 config/rootfiles/core/205/filelists/wpa_supplicant

diff --git a/config/rootfiles/core/205/filelists/wpa_supplicant b/config/rootfiles/core/205/filelists/wpa_supplicant
new file mode 120000
index 000000000..1d04c03c0
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/wpa_supplicant
@@ -0,0 +1 @@
+../../../common/wpa_supplicant
\ No newline at end of file
-- 
2.55.0

[PATCH] fontconfig: Update to version 2.18.3

[Adolf Belka]

- Update from version 2.18.2 to 2.18.3
- No change in rootfile
- Changelog
2.18.3
      ci: Add --werror option to the build script
      fc-cat: exit with non-zero if not successfully done
      Workaround a longstanding use-after-free warning
      Fix a null pointer dereference
      Add Noto Sans as system-ui for fallback
      Drop Noto Sans CJK KR from 60-nonlatin.conf
      Correct sat.orth
      Add an orth file for Balinese
      Update orth files for jv, so, su, tl to use native scripts
      Add orth files for scripts used by Noto font families
      Update mni.orth to use Meetei Mayek script
      Add orth files for Cuneiform languages (akk, sux, hit)
      ci: Suppress abidiff false positives for all internal structs
      test: Add cache format compatibility tests for orth file additions
      Add orth files for ancient scripts (xna, hlu, ecy)
      fc-cache: Create backward-compatible cache symlinks for cross-version discovery
      ci: Update dependencies
      Add implicit rule to update genericfamily property against syntactic-sugar
      fc-genconf: Use alias syntactic-sugar instead of the pair of test-edit config
      Allow to limit the targeted family for TTC
      test: Fix test_genconf.py to avoid unexpected family name in testing conf
      ci: Enable -Werror in CI
      ci: drop duplicate pipelines
      ci: cleanup
      ci: gate distro jobs until all tests passed
      ci: reduce more duplicate jobs
      ci: Update base ci-templates
      test: Fix compiler warnings
      fc-fontations: Allow unnecessary_transmutes lint in bindgen-generated Rust code
      Fix another compiler warnings
      ci: Bump FreeBSD version to 14.4
      Fix the compiler warnings on MinGW
      Update INSTALL
      Fix "FileType is deprecated"
      Fix unknown type name locale_t on macOS

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/fontconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/fontconfig b/lfs/fontconfig
index d4f1f672b..56a662258 100644
--- a/lfs/fontconfig
+++ b/lfs/fontconfig
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.18.2
+VER        = 2.18.3
 SUMMARY    = Library for configuring and customizing font access
 
 THISAPP    = fontconfig-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 537f0f26a13dd967899becb331e303d5ff1d635c64488ca131d0847b2f2a364735f51a0ca9f5cef3e1d7dc7ead9409b1b6d52ad0546bafaeca4a7e46ca86716c
+$(DL_FILE)_BLAKE2 = 33b7d89e7f3d4c43cbd4129e75f9ff2ddd8358aa9e7a9bd72ee72fe64beacbf0ab7e7760c91bc35a77548ffcc367acf7280ea56f002c6d9afa3f0e286831d6b6
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] libffi: Update to version 3.8.0

[Adolf Belka]

- Update from version 3.7.1 to 3.8.0
- Update of rootfile
- Changelog
3.8.0
New features
    FFI_TYPE_VECTOR (SIMD) type support with libffi-computed layout, for aarch64 and
	x86-64 (#1000, closes #773).
    ffi_call_plan_size — report the total memory a reusable call plan owns, for
	embedders that account for the memory held by long-lived plans.
    powerpc64 ELFv2 _Complex long double support for both IBM-128 (double-double) and
	IEEE-128 formats (#1003, closes #1001).
Fixes
    powerpc64 big-endian ELFv2 closures returning 5-, 6-, or 7-byte structs: missing
	return jump-table entries produced a wrong result and leaked a libffi code
	pointer.
    ia64 return-value jump-table desync after the FFI_TYPE_LAST bump, which corrupted
	small-struct and HFA returns.
    powerpc Darwin closure returns broken by #951 (#1002).
    i386 FreeBSD/OpenBSD small structs now returned in registers (1, 2, 4, or 8 bytes),
	matching the platform ABI and fixing a segfault on struct returns through
	ffi_call and closures.
Performance
    Cache the static trampoline "unsupported" verdict on hosts whose page size exceeds
	the trampoline table mapping, avoiding redundant re-initialization on every
	closure allocation (e.g. 64K-page aarch64).

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/libffi | 2 +-
 lfs/libffi                     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/common/libffi b/config/rootfiles/common/libffi
index 3282b8113..41cc47b9e 100644
--- a/config/rootfiles/common/libffi
+++ b/config/rootfiles/common/libffi
@@ -4,7 +4,7 @@
 #usr/lib/libffi.la
 #usr/lib/libffi.so
 usr/lib/libffi.so.8
-usr/lib/libffi.so.8.4.1
+usr/lib/libffi.so.8.5.0
 #usr/lib/pkgconfig/libffi.pc
 #usr/share/info/libffi.info
 #usr/share/man/man3/ffi.3
diff --git a/lfs/libffi b/lfs/libffi
index 2cfdbc414..df8f5c3ac 100644
--- a/lfs/libffi
+++ b/lfs/libffi
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.7.1
+VER        = 3.8.0
 
 THISAPP    = libffi-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 642741667d55aa2921fc250adea68eafd2519e786199fd2d0463a57ab6e830b51d97a361156bc2761d8c1bfecb9156ddc3147b6f81f4379bc054b98a29675526
+$(DL_FILE)_BLAKE2 = 589f87f79ea637dbddd00db3e320090f17855da5b1669a42b154f1c61bcafd1e8a964738d25b424c95ba5e148565df4b7379800ba42f40149c74d749f4f4b096
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] openssh: Update to version 10.5p1

[Adolf Belka]

- Update from version 10.4p1 to 10.5p1
- No change in rootfile
- Changelog
10.5p1
Potentially-incompatible changes
 * Portable OpenSSH now requires ECC (Elliptic Curve Cryptography)
   support in libcrypto, including support for the NISTP521 curve.
   ECC is included in the default build configurations of all
   versions of all libcrypto implementations currently supported by
   OpenSSH, including LibreSSL, OpenSSL, BoringSSL and AWS LC.
   The --without-openssl build configuration is not affected.
Security
 * ssh-agent(1): fix an interaction between agent locking and the
   session-bind@openssh.com extension that is used to identify
   forwarded agents. These binding requests were refused when the
   agent was locked, with the result that operations that were
   intended to be limited to local use only could be performed
   remotely, including the ability to add PKCS#11 tokens and make
   use of keys that had destination restrictions applied.
   Reported by sn0x-sharma
 * ssh(1): avoid potential realloc use-after-free in the client if a
   remote forwarding is added via the local session multiplexing
   socket while a remote forwarding open request is pending with the
   server. Report and fix from Brian Mingus of Cognatory
 * sshd(8): make the authorized_keys "restrict" keyword apply
   correctly to tunnel forwarding too (which is administratively
   disabled by default). Reported by Erichen, Institute of Computing
   Technology, Chinese Academy of Sciences
New features
 * ssh-keygen(1): add ability to set or clear the touch-required and
   verify-required flags on FIDO private keys when resetting a
   private key's passphrase.
 * ssh(1): tweak ordering of certificates tried during pubkey
    authentication to prefer FIDO keys that do not require user
    presence (touch) first, and FIDO keys that require user
    verification via PIN or biometrics last. This effectively tries
    low-friction authenticators before higher friction ones.
 * ssh(1): add a "ssh -Z user@host" mode that prints the keys that
   will be tried for public key authentication in the order that
   they will be used.
 * sshd(8) use setproctitle(3) to identify sshd-session when its
   acting as a post-authentication monitor.
Bugfixes
 * ssh-keyscan(1): make reading the server banner a non-blocking
   operation to prevent a stuck server from blocking a many-host
   keyscan from proceeding.
 * sshd(8): use sshpkt_fatal() instead of plain fatal() for errors
   in the packet code as this provides context of the failing peer
   (address, port, user, etc).
 * sshd(8): when signing hostkey proofs for a client UpdateHostKeys
   request, allow each hostkey to perform at most one signature
   operation.
 * sshd(8) fix GSSAPI option names, that were broken during a
   servconf.c refactoring in openssh-10.4; bz3974.
 * ssh-keygen(1): pass back errors from ed25519 key generation, which
   theoretically can fail. GHPR702.
 * sshd(8): move check of public key type against allowed algorithms
   to before parsing of the key sent by the peer. This removes at
   least some key parsing and verification paths from the pre-auth
   attack surface. Suggested by Christopher Paul Rohlf of Anthropic.
 * ssh-keygen(1): fix double frees (impossible to reach outside of a
   test harness), and also use freezero where possible. From
   Christopher Paul Rohlf at Anthropic.
 * sshd(8): fix ChannelTimeout and RekeyLimit not being applied in
   sshd_config Match blocks.
 * sshd(8): in sshd config dump mode, write all directives in mixed
   case for consistency
Portability
 * sshd(8): re-allow PAMServiceName inside a Match block, which
   was incorrectly disabled during a refactoring in openssh-10.4.
   bz3987

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/openssh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lfs/openssh b/lfs/openssh
index e7acb2058..a792df365 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 10.4p1
+VER        = 10.5p1
 
 THISAPP    = openssh-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 3051a345fd24333708277a1de781deca9094dd07cc55e613e93715b1266d80d59043bf5cdb2282d02c797cb9446916020e70fbd4c7a2470da7ab98eb612f6b74
+$(DL_FILE)_BLAKE2 = 8e8be4e4aff6b5f16e19f85b994fcc9b7679021cf639fad4323dc15f6bc0041b45370024a5f51065e2a92d965428cf3787323957f2c41f4d27fc1146dc3690cf
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] p11-kit: Update to version 0.26.5

[Adolf Belka]

- Update from version 0.26.4 to 0.26.5
- Update of rootfile
- 1 CVE fix
- Changelog
0.26.5
	* rpc: guard against overflow when decoding nested attributes
	  (CVE-2026-18938) [PR#777]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/p11-kit | 2 +-
 lfs/p11-kit                     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/common/p11-kit b/config/rootfiles/common/p11-kit
index 879983600..556d49db7 100644
--- a/config/rootfiles/common/p11-kit
+++ b/config/rootfiles/common/p11-kit
@@ -15,7 +15,7 @@ usr/bin/trust
 #usr/lib/libp11-kit.la
 #usr/lib/libp11-kit.so
 usr/lib/libp11-kit.so.0
-usr/lib/libp11-kit.so.0.4.10
+usr/lib/libp11-kit.so.0.4.11
 usr/lib/p11-kit-proxy.so
 #usr/lib/pkcs11
 #usr/lib/pkcs11/p11-kit-client.la
diff --git a/lfs/p11-kit b/lfs/p11-kit
index 1bb7d6feb..91950548c 100644
--- a/lfs/p11-kit
+++ b/lfs/p11-kit
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 0.26.4
+VER        = 0.26.5
 
 THISAPP    = p11-kit-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 91a8ff7679e34dbc9d3143c957ec2bba211da85f74c2aa3d150f3078de9387e1f04b4bbec56040e0c12249c1866e7ca191844c1dcdd6c1de29bec04e6d72ea96
+$(DL_FILE)_BLAKE2 = 3588e4abeca13450c8228b4e104942b459c86fa5bf07fd391b895ff99694e37a20562462fd3e5290dce79a45a16cc821da4ed86d9d4446beb1305d4638421589
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] postfix: Update to version 3.11.6

[Adolf Belka]

- Update from version 3.11.5 to 3.11.6
- No change in rootfile
- Changelog
3.11.6
These defects were found by Qualys assisted by Claude Mythos Preview, and by OpenAI
 Security; more than half date from 20 or more years ago. When I implemented Postfix,
 I knew that there were going to be mistakes. That is the reason why Postfix has its
 architecture and safety nets. The number of defects may seem large, but considering
 that they were found in a code base of over 150 thousand lines, the error rate is
 still lower than what I designed for.
Policy bypass:
    Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP server resets of
	MAIL FROM and RCPT TO command state after smtpd_end_of_data_restrictions
	rejected a message. This resulted in SMTP protocol state desynchronization
	between the remote SMTP client and the Postfix SMTP server.
    A crafted remote SMTP client could then send RCPT TO and DATA without MAIL FROM,
	and deliver a second message. Then, smtpd_end_of_data_restrictions skipped
	check_recipient_access constraints, because a recipient counter was > 1.
	Reported by OpenAI Security. File: smtpd/smtpd.c.
    As reported by OpenAI Security, the failure to reset MAIL FROM and RCPT TO state
	also affected Milter support (added in Postfix 2.3). Here, after a Milter
	replied with "accept this message" based on the message envelope, and
	smtpd_end_of_data_restrictions rejected the message, the Postfix SMTP server
	as before accepted RCPT TO and DATA without MAIL FROM, and
	smtpd_end_of_data_restrictions as before skipped check_recipient_access
	constraints for the second message. Under these conditions, the Postfix
	Milter client remained in the "accept this message" state, skipping Milter
	policy enforcement for the second message.
Denial of service:
    Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP server command
	history memory exhaustion with a large number of very small BDAT requests.
	Reported by OpenAI security. File: smtpd.c.
    Bug (defect introduced: Postfix 1.1, date: 20021116): address verification cache
	poisoning. A local user could use the postdrop command to submit an address
	verification probe with envelope or message content that Postfix rejected
	later, resulting in a negative address verification cache entry for that
	address. On systems that enable address verification, the negative address
	verification cache entry would force the Postfix SMTP server to reject a
	message that it should accept (denial of service). Problem reported by
	OpenAI Security. File: postdrop.c.
Server crashes and panic()s:
    Bug (defect introduced: Postfix 3.4, date: 20180805): missing SMTP server reset
	of RCPT TO state, after a BDAT command error. A crafted remote SMTP client
	could then send a DATA command without MAIL FROM or RCPT TO, and crash a
	Postfix SMTP daemon process with a null pointer read error. Reported by
	OpenAI Security. File: smtpd/smtpd.c.
    Bug (defect introduced: Postfix 2.4, date: 20051222): null pointer read crash
	while parsing a malformed Dovecot AUTH server response. Reported by Qualys,
	assisted by Claude Mythos Preview. File: xsasl_dovecot_server.c.
Read after free, uninitialized read, under/over read:
    Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free in the
	PSC_CALL_BACK_NOTIFY() macro. This had no effect on program execution,
	because myfree() wiped memory, and that memory was not yet reused. Problem
	reported by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
    Read after free (no privilege escalation) in debug logging (defect introduced:
	Postfix 2.2, date: 20050117). Reported by Qualys, assisted by Claude Mythos
	Preview. File: util/inet_connect.c.
    Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized memory read
	in postscreen HaProxy client after remote I/O exception, causing garbage to
	be logged. Reported by Qualys, assisted by Claude Mythos Preview.
	File: postscreen_haproxy.c.
    Latent bug (defect introduced: Postfix 2.7, date: 20090618): uninitialized memory
	read after dnsblog(8) returns a string that is not an IPv4 address. Reported
	by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
    Bug (defect introduced: before Postfix alpha, date 19970424): the DNS client
	could read up to two bytes past the end of an MX record, before discovering
	that the record was too short. This behavior was later copied with SRV
	records, potentially over-reading up to six bytes. Problem reported by
	Qualys, assisted by Claude Mythos Preview. File: dns_lookup.c.
    Bug (defect introduced: Postfix 1,1, date: 20010524): the postsuper command
	under-read or over-read a very short queue filename. No crash, information
	leak, or privilege escalation. Reported by Qualys, assisted by Claude Mythos
	Preview. Files: postsuper.c, mail_queue.h.
Other code hygiene:
    Bug (defect introduced: before Postfix alpha, date: 19971106): 'int' over-shift,
	in the queue file record-length parser. Postfix programs do not generate such
	records, but an attacker could cause postdrop to reject input or panic().
	Reported by Qualys, assisted by Claude Mythos Preview. File: record.c.
    Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive comparison
	of IPv4 addresses. Reported by Qualys, assisted by Claude Mythos Preview.
	File: sock_addr.c.
    Bug (defect introduced: Postfix 1.0, date: 20000928): the fast flush server, used
	by the SMTP command "ETRN", and by the commands "postqueue -s site" and
	"postqueue -i queue_id" (and their sendmail(1) equivalents), used the wrong
	duplicate suppression API, resulting in unnecessary queue scans by the queue
	manager. Reported by Qualys, assisted by Claude Mythos Preview. File: flush.c.
    Queue hygiene: the postdrop command accepted the null record type which the rest
	of Postfix ignores. Reported by OpenAI Security. File: postdrop.c.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/postfix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/postfix b/lfs/postfix
index 9584412ad..4ab686707 100644
--- a/lfs/postfix
+++ b/lfs/postfix
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = A fast, secure, and flexible mailer
 
-VER        = 3.11.5
+VER        = 3.11.6
 
 THISAPP    = postfix-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = postfix
-PAK_VER    = 55
+PAK_VER    = 56
 
 DEPS       =
 
@@ -72,7 +72,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = c677014019ce0851e45b103e5d6a88972a10cd3685d4c68b47f6b94ee318b9e81fb017f5b15f4307f3b8c6719afcbba33f4fc1c31a4fb65fe040522d6af38704
+$(DL_FILE)_BLAKE2 = e4a1194fa3f718212413bcee4f61f3c7fe3bd6b0bc6e96a714ca4093e3827350c2eda0e68c5826d865fc9c657e6bcebb0724b99c282c7a85dd877f2207de5075
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] procps: Update to version 4.0.7

[Adolf Belka]

- Update from version 4.0.6 to 4.0.7
- Update of rootfile
- Changelog
4.0.7
  * library
    version: inc revision to 2 now 1:2:0
    internal: procps_pids_length off by one                issue #412
    external: fix slabinfo header extern 'C' declaration   issue #415
    internal: fix file descriptor leaks in <pids> api      issue #421
    internal: strv items are now escaped in <pids> api     issue #429
    internal: fix output if on seconds edge values         merge !246 RHEL-60825
  * pidof: Add -d aliased option                           issue #418
  * pgrep: Don't treat empty list as 0                     issue #427
  * pmap: Fix testsuite for Alpha                          Debian #1141465
  * ps: correct 'environ' output when file unavailable
  * ps: minimize potential EACCES with 'environ' files     issue #431
  * top: avoid batch mode segfault with maximum width      issue #422
  * w: Correctly check for end of tty using utmp           issue #430
  * watch: Dont remove 2 lines when using -t option        issue #413
  * watch: Handle resizing better                          issue #417
  * watch: Restore LINES and COLUMNS env variables         issue #432

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/procps | 3 ++-
 lfs/procps                     | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/common/procps b/config/rootfiles/common/procps
index e19ce02f7..9974c5eb8 100644
--- a/config/rootfiles/common/procps
+++ b/config/rootfiles/common/procps
@@ -3,7 +3,7 @@ bin/ps
 #lib/libproc2.la
 #lib/libproc2.so
 lib/libproc2.so.1
-lib/libproc2.so.1.0.1
+lib/libproc2.so.1.0.2
 #lib/pkgconfig
 #lib/pkgconfig/libproc2.pc
 sbin/sysctl
@@ -53,6 +53,7 @@ usr/bin/watch
 #usr/share/man/man1/pgrep.1
 #usr/share/man/man1/pidof.1
 #usr/share/man/man1/pidwait.1
+#usr/share/man/man1/pkill.1
 #usr/share/man/man1/pmap.1
 #usr/share/man/man1/ps.1
 #usr/share/man/man1/pwdx.1
diff --git a/lfs/procps b/lfs/procps
index 26aa757f7..abfcdb4f8 100644
--- a/lfs/procps
+++ b/lfs/procps
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 4.0.6
+VER        = 4.0.7
 
 THISAPP    = procps-v$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = dbcbc76f544db055a5921cbe65d917ee7cdf5dae97ee9dc418d3969f68ebfa41e6adebb1369f5b07df5580504bf6881c27e2a8db0241a099b879e15337a8cb03
+$(DL_FILE)_BLAKE2 = efb1a245a8078a12b2de7a129ac66a3b0f5777b676b2bc7682488f995c57a48e24020f337d7beb2cb7161f0bf5e0c263f9ef7acb417ad1f7c90a27c8b9ab4ecd
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] rsync: Update to version 3.5.0

[Adolf Belka]

- Update from version 3.4.4 to 3.5.0
- Update of rootfile
- 33 CVE fixes
- Changelog
3.5.0
SECURITY FIXES:
This release fixes 33 security issues found during a focused audit of rsync's
 path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and
 reports from external researchers -- plus several robustness hardenings.  CVE
 IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges
 accompany each advisory, and many are much narrower than "everything before
 3.5.0".  Every fix ships with a regression test in the test suite that fails on
 the unfixed tree.  Many thanks to the external researchers credited below.
Link following (CWE-59/61) -- a local user who controls a path component plants
 a symlink that a privileged rsync then follows:
- CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping via symlinked
  operator-supplied input files.  rsync followed attacker-planted symlinks in
  `--filter` merge files (including per-directory merges and `-C` `.cvsignore`),
  `--files-from` / `--include-from` / `--exclude-from`, and the client
  `--password-file` / daemon secrets file -- reading an arbitrary file as filter
  rules, or sending a victim file's contents as the daemon authentication
  response.  Operator-supplied paths are now resolved component-by-component with
  `openat(O_PATH|O_NOFOLLOW)`, allowing a symlink component only when it is owned
  by uid 0 or the effective uid.
- CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation via
  symlinked operator-supplied output paths -- `--log-file`,
  `--write-batch`/`--read-batch`, and the daemon's motd / lock / early-input /
  `--config` opens.  A planted symlink (or parent component) could redirect the
  write, e.g. append the log to `authorized_keys`; `--read-batch` could also feed
  chosen bytes to the protocol parser.  Same trusted-owner path walk, plus an
  `S_ISREG` check on the `--read-batch` file.
- CVE-2026-53785 (HIGH): Under `--relative`, the receiver's implied-parent
  creation (`make_path()`) built the parent chain with a plain `mkdir()` on the
  full path, so a planted parent symlink placed the new directories and file
  outside the destination tree.  `make_path()` now creates each component through
  the held-directory-fd primitive.  Reported by Omar Elsayed (seks99x).
- CVE-2026-53784 (HIGH): Daemon module-root chdir escape under `use chroot =
  no`: a plain `chdir()` followed a planted parent-component symlink, serving
  files from outside the module.  The module-root chdir now goes through the
  secure resolver.
- CVE-2026-53793 (HIGH): Chroot `/./` inner-module escape -- a symlinked
  parent component inside the inner module reached a sibling outside it (the
  generator basis stat, the receiver write/finish path, the module chdir, and the
  receiver's delta-basis open).  The secure resolver is now engaged for all of
  those paths.
- CVE-2026-53795 (HIGH): An absolute `--temp-dir` or `--link-dest` disabled
  the receiver's rename/link confinement.  `do_rename_at()`/`do_link_at()` bailed
  to the unconfined path-based call whenever *either* path was absolute, so an
  absolute source (the temp file, or the link-dest basis) let `finish_transfer()`'s
  tmp->final rename -- or a hard-link create -- follow a destination parent
  component an attacker flipped to a symlink mid-transfer, writing the file outside
  the tree.  Each side is now confined independently.  Reported by Omar Elsayed
  (seks99x).
- CVE-2026-53796 (MEDIUM): A non-daemon receiver's one-time `chdir()` into the
  operator-named destination was not fully confined (a relative destination took a
  plain `chdir()`), so an attacker who raced the named destination from a directory
  to a symlink moved the receiver's CWD -- and every file it then created --
  outside the tree.  The destination chdir now uses the same ownership-checked
  `O_NOFOLLOW` walk as the daemon module chdir (see BEHAVIOR CHANGES).  Reported by
  Omar Elsayed (seks99x).
- CVE-2026-53797 (MEDIUM): A non-daemon sender opened each transferred file's
  content by path (leaf `O_NOFOLLOW` only), so a source parent component an
  unprivileged user raced to a symlink after the file-list scan was followed --
  reading a file from outside the source tree into an attacker-readable
  destination.  The content open is now anchored at the transfer root with
  `secure_relative_open()`; `-L` / `--copy-unsafe-links` / `-k` still follow, and
  `--insecure-links` restores the legacy open.
- CVE-2026-53799 (MEDIUM): Receiver ACL/xattr metadata application followed a
  symlink race -> arbitrary ACL set (local privilege escalation).  When preserving
  metadata (`-A`/`--acls`, `-X`/`--xattrs`, or fake-super ACL-as-xattr), the
  receiver applied each entry's ACL/xattrs by path via `acl_set_file()` /
  `setxattr()`.  A local user who raced a just-received entry (or a parent) into a
  symlink before the apply could redirect an attacker-chosen ACL -- the bytes are
  carried in the source entry -- onto a victim inode outside the destination tree,
  granting rwx on a root-owned file.  The apply now pins each entry's inode with an
  `O_RDONLY|O_NOFOLLOW` fd and sets all metadata on the held inode (Linux 6.13+
  `*xattrat` syscalls, or a patched libacl's `*_at` bindings, else the
  `/proc/self/fd` compat path).  Where neither primitive exists (the BSDs, Solaris,
  macOS, or a `/proc`-less Linux container) it falls back to the path-based apply to
  keep `--acls` functional -- a documented residual, refusable via `refuse options =
  acls`.
- CVE-2026-53800 (MEDIUM): Sender `--remove-source-files` unlink followed a
  parent-component symlink race -> arbitrary file deletion outside the source tree.
  The post-send unlink and its same-file safety re-stat resolved by path relative to
  the process CWD, so an unprivileged user who raced a source parent into a symlink
  after the file was sent could make a higher-authority sender (a root
  `--remove-source-files` run, or a daemon module not refusing the option) delete a
  file outside the served tree.  The removal is now resolved through the secure
  held-dirfd walk anchored at the served module root (daemon) or transfer-root CWD
  (local sender), the safety re-stat is confined likewise, and the per-file dev/ino
  is only computed when `--remove-source-files` is in effect.
- CVE-2026-53801 (MEDIUM): Sender/daemon directory-scan enumeration escaped the
  transfer root / module -> out-of-tree disclosure.  The sender enumerated each
  source directory with a plain `opendir()` on the accumulated path, not through the
  secure resolver (the enumeration sibling of the previous item, which confined only
  the content open).  A parent component raced to a symlink between the file-list
  scan and the recursive `opendir()` -- or, in daemon following mode
  (`-L`/`--copy-dirlinks`/`--copy-unsafe-links`), an in-module symlinked directory
  pointing outside the module -- let a higher-authority sender enumerate an
  out-of-tree directory and copy its entry names, metadata and symlink targets.  The
  directory scan is now confined through a held `opendir` fd anchored at the transfer
  root / module.
`support/rrsync` (the restricted SSH wrapper):
- CVE-2026-53783 (HIGH): rrsync restricted-directory escape.  It validated each
  argument with `realpath()` and then exec'd rsync against the same name (a
  TOCTOU window), and left dangerous options enabled in a restricted subdir.
  rrsync now inode-pins the validated path and roots the argument it hands rsync
  at that pinned fd, denies `--copy-unsafe-links`, forces `--no-D`, and refuses a
  symlinked `--log-file`.  The pin relies on Linux's `/proc/self/fd` magic links
  being bound to the open inode, so it is Linux-only; on the BSDs, macOS, Solaris
  and Cygwin rrsync passes the `realpath()`-validated name as it always did.
  Two limits are worth stating: under `--relative` only the anchor the
  transmitted name starts from is pinned, so a component below it can still be
  raced, and the final component of an ordinary sender argument is not pinned
  either (rsync does not follow a symlink there, and the options that would
  change that are refused in a restricted dir).
- A filter rule that failed to parse was echoed back verbatim, including when
  the rule came from a merge file's contents.  A per-directory merge rule names
  a file the peer chooses and travels over the protocol rather than in an
  argument, so this let a peer read back any line of any file the server process
  could open that is not valid filter syntax -- through an `rrsync` restricted
  account as well as a daemon module, since neither confined a merge open that
  the wrapper never sees.  A syntax error in a rule read from a file now reports
  the file and line rather than the text; a rule given as an argument is still
  shown.  The `--debug=FILTER` traces print the same file-derived text, so
  `rrsync` now refuses a peer-selected `--debug` (a stock client never sends
  one).  An operator who turns debugging on for their own server still sees the
  rule text.
- Redacting those diagnostics did not close the merge route on its own, because
  the worst shape produces no diagnostic at all: an exclude-only merge (the `-`
  modifier) makes every line of the file a pattern, so nothing fails to parse
  and the peer reads the contents off which of its own names went missing from
  the file list.  Through an `rrsync` restricted account that needs no
  `--delete` and no verbosity on a pull.  The open is now confined rather than
  the disclosure suppressed: rsync gained `--confine-root=DIR`, which refuses an
  operator- or peer-supplied path that resolves outside DIR, and `rrsync` passes
  its restricted directory.  A merge file inside that directory keeps working.
  A daemon already had this through its module root and is unaffected.
Daemon protocol / identity:
- CVE-2026-53786 (MEDIUM): A client-supplied `--filter` merge file bypassed
  the module filter list (it was checked against the module-prefixed path, which
  never matched a module rule).  The module-dir prefix is now stripped before the
  check.  Reported by Mitchell Benjamin (Revamp Studio).
- CVE-2026-53798 (MEDIUM): The daemon name converter mapped an unknown name to
  uid/gid 0 (an empty response was read as `atol("") == 0`); with `fake super =
  yes` the stored metadata became root-owned.  An empty/non-numeric response is
  now treated as a lookup failure.  Reported by Mitchell Benjamin (Revamp
  Studio).
- CVE-2026-53788 (MEDIUM): A peer-controlled name containing a newline/CR was
  written verbatim into the name-converter line protocol, allowing request
  injection.  Converter tokens containing control characters are now rejected.
  Reported by Mitchell Benjamin (Revamp Studio).
- CVE-2026-53789 (MEDIUM): A malicious daemon-sender could widen `--delete`
  scope by omitting the "no content dir" flag on an implied parent, making the
  receiver run `delete_in_dir()` on it.  Implied-parent directories are now
  forced non-content on the receiver.  Reported by Mitchell Benjamin (Revamp
  Studio).
- CVE-2026-53791 (CRITICAL): With `proxy protocol = true`, a client connecting
  directly (not via the trusted proxy) could send a PROXY header to spoof its
  source address and bypass host-based access control.  A forwarded address is
  now honoured only from a configured trusted-proxy peer.
Injection and memory safety:
- CVE-2026-53790 (HIGH): Command / argument injection via unquoted peer- or
  host-controlled values -- the `RSYNC_CONNECT_PROG` `%H` host substitution, the
  daemon exec-hook `%RSYNC_*%` expansions, rsync-ssl hostspecs, and a missing
  newline/CR in remote-shell argument quoting.  Each sink is now quoted or
  validated (the hook escaping is confined to the shell-executed hooks, so
  ordinary daemon string parameters such as `path` are unaffected).
- CVE-2026-53792 (MEDIUM): A malicious receiver sending a checksum header with a
  block count > 0 but block length == 0 drove the sender's rolling-match
  arithmetic negative.  A zero block length is now rejected.
- CVE-2026-53794 (MEDIUM): `--max-alloc=0` disabled the per-allocation size
  cap (the defense behind CVE-2024-12084) and could be forwarded on the wire to
  an unpatched daemon.  A zero max-alloc is now rejected at both the client and
  the daemon.  Reported by Azizcan Dastan (Milenium Security).
Peer-triggerable memory corruption in the daemon protocol, found by a
 daemon-protocol fuzzing pass and reported by Greg Kroah-Hartman.  Each is a
 WRITE reachable from the wire, which is why these were split out from the
 crash-only findings in the same pass:
- CVE-2026-70461 (HIGH): a one-byte heap out-of-bounds write in
  `add_implied_include()`, driven by a peer-supplied filter rule whose trailing
  backslash was not counted when sizing the copy.
- CVE-2026-70458 (HIGH): an out-of-bounds write from a file entry marked
  `FLAG_HLINKED` that the receiver accepted even though `-H` was not in effect,
  so the hard-link extra slots it then wrote were never allocated.
- CVE-2026-70456 (HIGH): an out-of-bounds heap write in `read_args()` when the
  peer's argument count lands exactly on `maxargs` -- the trailing NULL went one
  past the end of the array.
- CVE-2026-70457 (MEDIUM): an attacker-chosen-offset write in
  `parse_size_arg()`'s error formatting, reachable through an over-large
  `--max-size` / `--min-size` / `--max-alloc` forwarded to a daemon.
- CVE-2026-70459 (MEDIUM): a wild-pointer read crashing the per-connection
  daemon child, from a crafted first incremental file list whose transfer root
  is "." with a non-directory mode -- `parent_ndx` stayed 0 while `dir_flist`
  was still empty, so the generator dereferenced a never-written slot.
  Companion to CVE-2026-43620; reproduced on released 3.2.7, 3.4.0 and 3.4.1.
Daemon availability and access control:
- CVE-2026-70464 (HIGH): an unauthenticated peer could complete the `@RSYNCD`
  greeting and then stall forever -- sending a line with no terminator, or
  trickling NUL-terminated arguments into `read_args()` one byte at a time --
  holding a per-connection child open past the module's `max connections`
  limit.  The `timeout` parameter did not cover it, because `set_io_timeout()`
  ran after the `read_args()` calls that needed covering.  A separate deadline
  now spans both, and the early-protocol argument count is bounded.  Reported
  independently by Chamal De Silva and by Michal Ruprich (Red Hat QE).
- CVE-2026-70455 (HIGH): a daemon client could request an arbitrary Zstandard
  worker count via `--compress-threads`; 256 was measured as 257 threads in a
  single connection.  Now capped at 8 on a daemon, while local and
  remote-shell invocations keep the operator's value.  Reported, fixed and
  tested by Filipe Casal of Trail of Bits, in collaboration with OpenAI.
- CVE-2026-70453 (HIGH): quadratic CPU exhaustion in `hash_search()` from a
  crafted chain of equal weak checksums.  The chain walk is now bounded.  First
  reported as a performance problem in public rsync issue #217 by heyciao
  (2021); recognised as a security issue, bounded and regression-tested by
  Stuart Inglis.  This one was already public and was not embargoed.
- CVE-2026-70452 (HIGH): `hosts deny` failed OPEN when a configured hostname
  could not be resolved -- with `forward lookup` enabled, which is the default,
  an unresolvable deny token admitted the host it was meant to block.  It now
  fails closed.  Sibling of CVE-2026-43617.  Reported by Leonid Bugaev.
- CVE-2026-70463 (HIGH): `auth users` ignored its documented comma-only
  parsing.  With a leading comma the split should be on commas alone, so that a
  group name containing a space can be written; it split on whitespace too, so
  a `deny` or `:ro` rule naming such a group was broken into two meaningless
  tokens and never fired.  Reported by Andres Berbescu.
- CVE-2026-70460 (HIGH): a peer-supplied `--partial-dir` or `--backup-dir` was
  resolved by pathname, so an in-module symlink could redirect it and place
  files outside the daemon's module root.  Those paths are now confined.
  Reported by Omar Elsayed (seks99x).
Client-side:
- CVE-2026-70462 (MEDIUM): a peer-supplied `MSG_IO_TIMEOUT` defeated the
  client's own I/O timeout -- a large value overflowed signed arithmetic, and a
  non-positive value disabled the timeout outright.  The value is now capped on
  receipt and the arithmetic made overflow-safe.  Reported by Z3R0S! (z3r0s6);
  the non-positive case was reported by Leonid Bugaev.
- CVE-2026-70454 (MEDIUM): `rsync-ssl` established an unauthenticated TLS
  connection.  In stunnel mode it neither required CA verification nor bound
  the certificate to the requested hostname, so an active network attacker
  could impersonate the server; the openssl backend had a matching hostname
  gap in 3.2.0 through 3.2.3 (found and fixed in 2020 by Matt McCutchen).
  stunnel mode now requires certificate verification and hostname binding
  unless an explicit insecure opt-out is set, and the GnuTLS backend is
  refused conservatively rather than used unverified (Greg Kroah-Hartman).
Robustness hardening (no CVE assigned): the `RSYNC_PROXY` CONNECT request and
 proxy response headers are length-bounded, and peer-requested xattr expansion is
 capped.
A second-pass source audit (reported by Leonid Bugaev) hardened several memory-
 safety and robustness paths: the hashtable and file-list size computations are
 guarded against a 32-bit integer overflow that a peer's entry count could
 otherwise wrap into an under-allocation, and the
 `SIGUSR2` handler is now async-signal-safe (it only sets a flag, deferring the
 summary/close-out work to safe poll points).  Separately, the xattr/ACL metadata
 copy now reads the *source* through a held no-follow fd as well as writing the
 destination through one -- closing a parent-symlink race on the `--copy-dest` and
 backup source -- and the cross-tree operator-path metadata apply is now fd-pinned
 under `--fake-super` too (previously it fell back to a path-based set for a
 `fake super = yes` daemon staging through an absolute `--temp-dir`/`--backup-dir`).
SECURITY RELATED:
- Mask a peer-supplied I/O-error value to the defined `IOERR_*` bits, both the
  incoming `MSG_IO_ERROR` message (`io.c`) and the file-list trailer (`flist.c`),
  so a malicious peer cannot set arbitrary (undefined) error flags that would be
  stored in the local `io_error` and re-forwarded upstream.  (Undefined bits
  never reached the exit code, which maps only the defined bits.)  Reported by
  Leonid Bugaev.
- Escape control characters in filenames written to the log file (CWE-117 log
  injection): a transferred name containing control bytes -- C0 (tab excepted)
  and C1 `0x80`-`0x9f`, including CSI `0x9b` -- could otherwise inject terminal
  escape sequences into an administrator's terminal when the log is viewed.
  Reported by Leonid Bugaev.
- Stop `safe_arg()` leaking an uninitialized byte into a quoted filename.  In
  filename mode the writer suppresses the escaping backslash before a wildcard,
  but the counter that sized the buffer reserved a slot for every backslash, so
  the two disagreed and left an uninitialized heap byte in the returned string
  -- which is handed to the remote shell when `--protect-args` is off.  The
  counter now mirrors the writer, and guarding the wildcard test with `f[1]`
  also fixes a trailing backslash (previously `strchr()` matched the string
  terminator, so the backslash was not doubled).  Reported by Leonid Bugaev.
- Close a `--safe-links` bypass in `--backup`: when symlinks can be hard-linked,
  `make_backup()`'s link/rename fast path hard-linked an unsafe (out-of-tree)
  symlink into the backup area and skipped the `safe_symlinks` check the copy
  path applies, silently preserving a link `--safe-links` was meant to drop.  The
  safe-links check now runs before the fast path, and a symlink whose target is
  unreadable is failed closed rather than backed up unchecked.  Reported by
  Leonid Bugaev.
- Extend the operator-directory ownership walk to the backup leaf sinks:
  `do_symlink_at()` (backing a symlink up into an operator `--backup-dir`) and
  `do_rmdir_at()` (removing a pre-existing backup directory) now resolve their
  parent through the same ownership walk, so a foreign-owned parent symlink no
  longer redirects the backup symlink-create or directory-removal outside the
  backup tree.  `--insecure-links` (or a module's `insecure links = yes`) restores
  the legacy follow.  Reported by Omar Elsayed (seks99x).
- Confine an absolute operator source/destination through the ownership walk in
  `robust_rename()`'s cross-filesystem (EXDEV) copy fallback, so a raced parent
  symlink cannot redirect the fallback copy or its source unlink out of the tree.
  Reported by Leonid Bugaev.
- Bound the number of equal-weak-checksum blocks examined per offset in
  `hash_search()` (issue #217), so a crafted or degenerate checksum set with a
  very long equal-checksum chain cannot drive the sender's per-offset
  match-verify into a quadratic blow-up (CPU DoS).  Fix by Stuart Inglis.
BUG FIXES:
- Fix an off-by-one in `clean_fname()`'s `..`-collapse path normalization.
  Reported by Leonid Bugaev.
- The AVX2 rolling-checksum assembly (`--enable-roll-asm`) read up to 64 bytes
  past the end of the buffer it was given.  The loop is software-pipelined and
  preloaded the 64 bytes after the ones it was folding in, so its last iteration
  always reached beyond the data -- the remainder is by construction under 64
  bytes.  It normally landed in slack inside rsync's map window and went
  unnoticed; where the buffer ended at a page boundary it was a SIGSEGV mid
  transfer, reported on macOS x86-64 by Roland Kletzing.  Reported checksums are
  unchanged.
- `--link-dest` no longer fails the transfer when the destination refuses to
  hard-link a symlink, device node, FIFO or socket.  Whether rsync hard-links
  those at all was decided at build time, on whatever filesystem the source tree
  happened to sit on, and one host can hold both answers -- macOS builds on
  APFS, which can, and backs up to HFS+, which returns ENOTSUP.  Such an entry
  is now copied, exactly as it already is in a build that cannot link them and
  as a regular file in the same position already was; the run used to exit 23
  even though the entry was then created correctly.  The fallback covers any
  refusal, since the error does not identify one on its own: link(2) documents
  EPERM both for a filesystem without hard links and for a permission refusal.
  Still outstanding: under `-H`, a group of such entries hard-linked to each
  other also needs a link within the destination, and where the destination
  cannot hard-link the type at all, the members after the first are still lost.
- `--out-format` / `--log-file-format` now emit a literal `%` for `%%` instead of
  mis-parsing the following character (added by Leonid Bugaev); a follow-up bounds
  `log_format_has()`'s width-digit scan to match `log_formatted()`, closing a `%C`
  read past the checksum field.
- A CVS `.cvsignore` (or `-C`) file containing a `!` clear-list token no longer
  aborts with a spurious "rule has trailing characters" error.  Reported by
  Leonid Bugaev.
- `--chmod=a+s` now sets both the setuid and setgid bits, matching `chmod(1)`
  (it previously set setuid only).  Reported by Leonid Bugaev.
- Case-insensitive wildcard matching (used by daemon `hosts allow`/`hosts deny`
  rules) now folds characters inside a `[...]` bracket expression, not just
  literal pattern characters.  Reported by Leonid Bugaev.
BEHAVIOR CHANGES:
- A non-daemon receiver follows an operator-named symlinked destination directory
  only when the symlink is owned by root or the running user (e.g. `rsync -a src/
  /backup/` where `/backup -> /mnt/disk`); a destination symlinked by another uid
  is now refused, closing a chdir TOCTOU where an attacker raced the named
  destination into a symlink.  `--insecure-links` restores the unconditional
  follow.
- On platforms without a race-safe way to create a unix socket in a subdirectory
  (the BSDs, macOS, Solaris, which lack `bindat()`), a nested socket transferred
  under `--specials` is skipped with a warning instead of failing the whole
  transfer.  Top-level sockets are unaffected.
- `proxy protocol = true` with no `proxy protocol hosts` rejects all connections
  (fail-closed); the daemon now warns about this at startup.
- `support/rrsync` in a restricted subdirectory forces `--no-D` (device/special
  semantics are stripped, so a plain `rsync -a` still works) and denies
  `--copy-unsafe-links`.
- The path resolver now follows in-tree directory symlinks uniformly on every
  platform via a single race-free per-component `O_NOFOLLOW` walk, so `-K` /
  `-L` / `-k` and `-R` through an in-tree symlinked parent behave the same
  everywhere.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/rsync | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/rsync b/lfs/rsync
index 8ba4e11a0..69a2aa469 100644
--- a/lfs/rsync
+++ b/lfs/rsync
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY    = Versatile tool for fast incremental file transfer
 
-VER        = 3.4.4
+VER        = 3.5.0
 
 THISAPP    = rsync-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM    = $(URL_IPFIRE)
 DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 PROG       = rsync
-PAK_VER    = 24
+PAK_VER    = 25
 
 DEPS       = libxxhash
 
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = f4eec8d1077e1cc7eec8cd39dcac4643f7608231f5aa6390cb53104efa1602873a333d9e6cba5d1bb2aeff6c3bf9bccd80370a2105a9cc982b49aae9f39f3bde
+$(DL_FILE)_BLAKE2 = 1a0aaddd9555c14e2b026f4ac9aff0c0b7760a5809fc80c7872b382a0b9b4719dcc0d382c0e43439955efd855ffa2dff101c10a86529b88fd380205cc9506179
 
 install : $(TARGET)
 
-- 
2.55.0

[PATCH] wpa_supplicant: Update to version 2.12

[Adolf Belka]

- Update from version 2.11 to 2.12
- No change in rootfile
- Changelog
2.12
	* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
	* improve BSS transition management support
	* EHT/IEEE 802.11be/Wi-Fi 7
	  - more complete support
	  - fix message validation issues that could enable DoS attacks
	* support Wi-Fi Direct R2
	* support Wi-Fi Aware (add synchronized NAN; extend USD support)
	* support Proximity Ranging
	* support SPP A-MSDU negotiation
	* support IEEE 802.11bi functionality
	  - changing SAE password identifiers
	  - EPPKE
	  - IEEE 802.1X/EAP in Authentication frames
	  - Association frame encryption
	  - PMKID privacy
	* enable layer 2/Wi-Fi multicast filtering for all networks (not
	  just some Passpoint networks which enabled this before)
	* wpa_gui: port to Qt6
	* support OpenSSL 3.0 API changes
	* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
	  with previous versions
	* maintain configuration file permissions when writing updated
	  configuration
	* add option to validate PKCS#11/OpenSC engine and module paths
	* fix PMKSA caching to enforce network context to avoid misuse of
	  unexpected PMKSA cache entries
	* fix a potential DoS attack in SAE processing of an unexpected element
	* fix incomplete bounds checking of mesh AMPE messages that could have
	  resulted in DoS attacks and memory corruption
	* a large number of other fixes, cleanup, and extensions

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/wpa_supplicant | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant
index 38a147619..e9a2d2c13 100644
--- a/lfs/wpa_supplicant
+++ b/lfs/wpa_supplicant
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.11
+VER        = 2.12
 
 THISAPP    = wpa_supplicant-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 71bd0d11cd31eb5bc6beb51caf0f1399856ea188f316d2330053a2d8c81869057811e9f500828e8981eabd0af38f30a18a3ae584d744005c78681c82fa910abf
+$(DL_FILE)_BLAKE2 = 8a0d4d3d28370fe532676c2d02ce98db3861a6895cb73c83fd33bd3707698ead0bb7b4e9ed5a2cc87ea8db61f75b3da5bf548b67bce45b09223263da01d542ec
 
 install : $(TARGET)
 
-- 
2.55.0