* [PATCH] core205: Ship aprutil
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] core205: Ship openssh Adolf Belka
` (10 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/core/205/filelists/aprutil | 1 +
1 file changed, 1 insertion(+)
create mode 120000 config/rootfiles/core/205/filelists/aprutil
diff --git a/config/rootfiles/core/205/filelists/aprutil b/config/rootfiles/core/205/filelists/aprutil
new file mode 120000
index 000000000..999f9f84b
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/aprutil
@@ -0,0 +1 @@
+../../../common/aprutil
\ No newline at end of file
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] core205: Ship openssh
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
2026-08-13 13:39 ` [PATCH] core205: Ship aprutil Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] core205: Ship procps Adolf Belka
` (9 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/core/205/filelists/openssh | 1 +
1 file changed, 1 insertion(+)
create mode 120000 config/rootfiles/core/205/filelists/openssh
diff --git a/config/rootfiles/core/205/filelists/openssh b/config/rootfiles/core/205/filelists/openssh
new file mode 120000
index 000000000..d8c77fd8e
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/openssh
@@ -0,0 +1 @@
+../../../common/openssh
\ No newline at end of file
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] core205: Ship procps
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
2026-08-13 13:39 ` [PATCH] core205: Ship aprutil Adolf Belka
2026-08-13 13:39 ` [PATCH] core205: Ship openssh Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] core205: Ship wpa_supplicant Adolf Belka
` (8 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/core/205/filelists/procps | 1 +
1 file changed, 1 insertion(+)
create mode 120000 config/rootfiles/core/205/filelists/procps
diff --git a/config/rootfiles/core/205/filelists/procps b/config/rootfiles/core/205/filelists/procps
new file mode 120000
index 000000000..e17e8ed70
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/procps
@@ -0,0 +1 @@
+../../../common/procps
\ No newline at end of file
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] core205: Ship wpa_supplicant
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (2 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] core205: Ship procps Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] fontconfig: Update to version 2.18.3 Adolf Belka
` (7 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/core/205/filelists/wpa_supplicant | 1 +
1 file changed, 1 insertion(+)
create mode 120000 config/rootfiles/core/205/filelists/wpa_supplicant
diff --git a/config/rootfiles/core/205/filelists/wpa_supplicant b/config/rootfiles/core/205/filelists/wpa_supplicant
new file mode 120000
index 000000000..1d04c03c0
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/wpa_supplicant
@@ -0,0 +1 @@
+../../../common/wpa_supplicant
\ No newline at end of file
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] fontconfig: Update to version 2.18.3
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (3 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] core205: Ship wpa_supplicant Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] libffi: Update to version 3.8.0 Adolf Belka
` (6 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 2.18.2 to 2.18.3
- No change in rootfile
- Changelog
2.18.3
ci: Add --werror option to the build script
fc-cat: exit with non-zero if not successfully done
Workaround a longstanding use-after-free warning
Fix a null pointer dereference
Add Noto Sans as system-ui for fallback
Drop Noto Sans CJK KR from 60-nonlatin.conf
Correct sat.orth
Add an orth file for Balinese
Update orth files for jv, so, su, tl to use native scripts
Add orth files for scripts used by Noto font families
Update mni.orth to use Meetei Mayek script
Add orth files for Cuneiform languages (akk, sux, hit)
ci: Suppress abidiff false positives for all internal structs
test: Add cache format compatibility tests for orth file additions
Add orth files for ancient scripts (xna, hlu, ecy)
fc-cache: Create backward-compatible cache symlinks for cross-version discovery
ci: Update dependencies
Add implicit rule to update genericfamily property against syntactic-sugar
fc-genconf: Use alias syntactic-sugar instead of the pair of test-edit config
Allow to limit the targeted family for TTC
test: Fix test_genconf.py to avoid unexpected family name in testing conf
ci: Enable -Werror in CI
ci: drop duplicate pipelines
ci: cleanup
ci: gate distro jobs until all tests passed
ci: reduce more duplicate jobs
ci: Update base ci-templates
test: Fix compiler warnings
fc-fontations: Allow unnecessary_transmutes lint in bindgen-generated Rust code
Fix another compiler warnings
ci: Bump FreeBSD version to 14.4
Fix the compiler warnings on MinGW
Update INSTALL
Fix "FileType is deprecated"
Fix unknown type name locale_t on macOS
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/fontconfig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lfs/fontconfig b/lfs/fontconfig
index d4f1f672b..56a662258 100644
--- a/lfs/fontconfig
+++ b/lfs/fontconfig
@@ -24,7 +24,7 @@
include Config
-VER = 2.18.2
+VER = 2.18.3
SUMMARY = Library for configuring and customizing font access
THISAPP = fontconfig-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 537f0f26a13dd967899becb331e303d5ff1d635c64488ca131d0847b2f2a364735f51a0ca9f5cef3e1d7dc7ead9409b1b6d52ad0546bafaeca4a7e46ca86716c
+$(DL_FILE)_BLAKE2 = 33b7d89e7f3d4c43cbd4129e75f9ff2ddd8358aa9e7a9bd72ee72fe64beacbf0ab7e7760c91bc35a77548ffcc367acf7280ea56f002c6d9afa3f0e286831d6b6
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] libffi: Update to version 3.8.0
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (4 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] fontconfig: Update to version 2.18.3 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] openssh: Update to version 10.5p1 Adolf Belka
` (5 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 3.7.1 to 3.8.0
- Update of rootfile
- Changelog
3.8.0
New features
FFI_TYPE_VECTOR (SIMD) type support with libffi-computed layout, for aarch64 and
x86-64 (#1000, closes #773).
ffi_call_plan_size — report the total memory a reusable call plan owns, for
embedders that account for the memory held by long-lived plans.
powerpc64 ELFv2 _Complex long double support for both IBM-128 (double-double) and
IEEE-128 formats (#1003, closes #1001).
Fixes
powerpc64 big-endian ELFv2 closures returning 5-, 6-, or 7-byte structs: missing
return jump-table entries produced a wrong result and leaked a libffi code
pointer.
ia64 return-value jump-table desync after the FFI_TYPE_LAST bump, which corrupted
small-struct and HFA returns.
powerpc Darwin closure returns broken by #951 (#1002).
i386 FreeBSD/OpenBSD small structs now returned in registers (1, 2, 4, or 8 bytes),
matching the platform ABI and fixing a segfault on struct returns through
ffi_call and closures.
Performance
Cache the static trampoline "unsupported" verdict on hosts whose page size exceeds
the trampoline table mapping, avoiding redundant re-initialization on every
closure allocation (e.g. 64K-page aarch64).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/libffi | 2 +-
lfs/libffi | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/config/rootfiles/common/libffi b/config/rootfiles/common/libffi
index 3282b8113..41cc47b9e 100644
--- a/config/rootfiles/common/libffi
+++ b/config/rootfiles/common/libffi
@@ -4,7 +4,7 @@
#usr/lib/libffi.la
#usr/lib/libffi.so
usr/lib/libffi.so.8
-usr/lib/libffi.so.8.4.1
+usr/lib/libffi.so.8.5.0
#usr/lib/pkgconfig/libffi.pc
#usr/share/info/libffi.info
#usr/share/man/man3/ffi.3
diff --git a/lfs/libffi b/lfs/libffi
index 2cfdbc414..df8f5c3ac 100644
--- a/lfs/libffi
+++ b/lfs/libffi
@@ -24,7 +24,7 @@
include Config
-VER = 3.7.1
+VER = 3.8.0
THISAPP = libffi-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 642741667d55aa2921fc250adea68eafd2519e786199fd2d0463a57ab6e830b51d97a361156bc2761d8c1bfecb9156ddc3147b6f81f4379bc054b98a29675526
+$(DL_FILE)_BLAKE2 = 589f87f79ea637dbddd00db3e320090f17855da5b1669a42b154f1c61bcafd1e8a964738d25b424c95ba5e148565df4b7379800ba42f40149c74d749f4f4b096
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] openssh: Update to version 10.5p1
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (5 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] libffi: Update to version 3.8.0 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] p11-kit: Update to version 0.26.5 Adolf Belka
` (4 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 10.4p1 to 10.5p1
- No change in rootfile
- Changelog
10.5p1
Potentially-incompatible changes
* Portable OpenSSH now requires ECC (Elliptic Curve Cryptography)
support in libcrypto, including support for the NISTP521 curve.
ECC is included in the default build configurations of all
versions of all libcrypto implementations currently supported by
OpenSSH, including LibreSSL, OpenSSL, BoringSSL and AWS LC.
The --without-openssl build configuration is not affected.
Security
* ssh-agent(1): fix an interaction between agent locking and the
session-bind@openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
Reported by sn0x-sharma
* ssh(1): avoid potential realloc use-after-free in the client if a
remote forwarding is added via the local session multiplexing
socket while a remote forwarding open request is pending with the
server. Report and fix from Brian Mingus of Cognatory
* sshd(8): make the authorized_keys "restrict" keyword apply
correctly to tunnel forwarding too (which is administratively
disabled by default). Reported by Erichen, Institute of Computing
Technology, Chinese Academy of Sciences
New features
* ssh-keygen(1): add ability to set or clear the touch-required and
verify-required flags on FIDO private keys when resetting a
private key's passphrase.
* ssh(1): tweak ordering of certificates tried during pubkey
authentication to prefer FIDO keys that do not require user
presence (touch) first, and FIDO keys that require user
verification via PIN or biometrics last. This effectively tries
low-friction authenticators before higher friction ones.
* ssh(1): add a "ssh -Z user@host" mode that prints the keys that
will be tried for public key authentication in the order that
they will be used.
* sshd(8) use setproctitle(3) to identify sshd-session when its
acting as a post-authentication monitor.
Bugfixes
* ssh-keyscan(1): make reading the server banner a non-blocking
operation to prevent a stuck server from blocking a many-host
keyscan from proceeding.
* sshd(8): use sshpkt_fatal() instead of plain fatal() for errors
in the packet code as this provides context of the failing peer
(address, port, user, etc).
* sshd(8): when signing hostkey proofs for a client UpdateHostKeys
request, allow each hostkey to perform at most one signature
operation.
* sshd(8) fix GSSAPI option names, that were broken during a
servconf.c refactoring in openssh-10.4; bz3974.
* ssh-keygen(1): pass back errors from ed25519 key generation, which
theoretically can fail. GHPR702.
* sshd(8): move check of public key type against allowed algorithms
to before parsing of the key sent by the peer. This removes at
least some key parsing and verification paths from the pre-auth
attack surface. Suggested by Christopher Paul Rohlf of Anthropic.
* ssh-keygen(1): fix double frees (impossible to reach outside of a
test harness), and also use freezero where possible. From
Christopher Paul Rohlf at Anthropic.
* sshd(8): fix ChannelTimeout and RekeyLimit not being applied in
sshd_config Match blocks.
* sshd(8): in sshd config dump mode, write all directives in mixed
case for consistency
Portability
* sshd(8): re-allow PAMServiceName inside a Match block, which
was incorrectly disabled during a refactoring in openssh-10.4.
bz3987
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/openssh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lfs/openssh b/lfs/openssh
index e7acb2058..a792df365 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -24,7 +24,7 @@
include Config
-VER = 10.4p1
+VER = 10.5p1
THISAPP = openssh-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 3051a345fd24333708277a1de781deca9094dd07cc55e613e93715b1266d80d59043bf5cdb2282d02c797cb9446916020e70fbd4c7a2470da7ab98eb612f6b74
+$(DL_FILE)_BLAKE2 = 8e8be4e4aff6b5f16e19f85b994fcc9b7679021cf639fad4323dc15f6bc0041b45370024a5f51065e2a92d965428cf3787323957f2c41f4d27fc1146dc3690cf
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] p11-kit: Update to version 0.26.5
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (6 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] openssh: Update to version 10.5p1 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] postfix: Update to version 3.11.6 Adolf Belka
` (3 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 0.26.4 to 0.26.5
- Update of rootfile
- 1 CVE fix
- Changelog
0.26.5
* rpc: guard against overflow when decoding nested attributes
(CVE-2026-18938) [PR#777]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/p11-kit | 2 +-
lfs/p11-kit | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/config/rootfiles/common/p11-kit b/config/rootfiles/common/p11-kit
index 879983600..556d49db7 100644
--- a/config/rootfiles/common/p11-kit
+++ b/config/rootfiles/common/p11-kit
@@ -15,7 +15,7 @@ usr/bin/trust
#usr/lib/libp11-kit.la
#usr/lib/libp11-kit.so
usr/lib/libp11-kit.so.0
-usr/lib/libp11-kit.so.0.4.10
+usr/lib/libp11-kit.so.0.4.11
usr/lib/p11-kit-proxy.so
#usr/lib/pkcs11
#usr/lib/pkcs11/p11-kit-client.la
diff --git a/lfs/p11-kit b/lfs/p11-kit
index 1bb7d6feb..91950548c 100644
--- a/lfs/p11-kit
+++ b/lfs/p11-kit
@@ -24,7 +24,7 @@
include Config
-VER = 0.26.4
+VER = 0.26.5
THISAPP = p11-kit-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 91a8ff7679e34dbc9d3143c957ec2bba211da85f74c2aa3d150f3078de9387e1f04b4bbec56040e0c12249c1866e7ca191844c1dcdd6c1de29bec04e6d72ea96
+$(DL_FILE)_BLAKE2 = 3588e4abeca13450c8228b4e104942b459c86fa5bf07fd391b895ff99694e37a20562462fd3e5290dce79a45a16cc821da4ed86d9d4446beb1305d4638421589
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] postfix: Update to version 3.11.6
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (7 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] p11-kit: Update to version 0.26.5 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] procps: Update to version 4.0.7 Adolf Belka
` (2 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 3.11.5 to 3.11.6
- No change in rootfile
- Changelog
3.11.6
These defects were found by Qualys assisted by Claude Mythos Preview, and by OpenAI
Security; more than half date from 20 or more years ago. When I implemented Postfix,
I knew that there were going to be mistakes. That is the reason why Postfix has its
architecture and safety nets. The number of defects may seem large, but considering
that they were found in a code base of over 150 thousand lines, the error rate is
still lower than what I designed for.
Policy bypass:
Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP server resets of
MAIL FROM and RCPT TO command state after smtpd_end_of_data_restrictions
rejected a message. This resulted in SMTP protocol state desynchronization
between the remote SMTP client and the Postfix SMTP server.
A crafted remote SMTP client could then send RCPT TO and DATA without MAIL FROM,
and deliver a second message. Then, smtpd_end_of_data_restrictions skipped
check_recipient_access constraints, because a recipient counter was > 1.
Reported by OpenAI Security. File: smtpd/smtpd.c.
As reported by OpenAI Security, the failure to reset MAIL FROM and RCPT TO state
also affected Milter support (added in Postfix 2.3). Here, after a Milter
replied with "accept this message" based on the message envelope, and
smtpd_end_of_data_restrictions rejected the message, the Postfix SMTP server
as before accepted RCPT TO and DATA without MAIL FROM, and
smtpd_end_of_data_restrictions as before skipped check_recipient_access
constraints for the second message. Under these conditions, the Postfix
Milter client remained in the "accept this message" state, skipping Milter
policy enforcement for the second message.
Denial of service:
Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP server command
history memory exhaustion with a large number of very small BDAT requests.
Reported by OpenAI security. File: smtpd.c.
Bug (defect introduced: Postfix 1.1, date: 20021116): address verification cache
poisoning. A local user could use the postdrop command to submit an address
verification probe with envelope or message content that Postfix rejected
later, resulting in a negative address verification cache entry for that
address. On systems that enable address verification, the negative address
verification cache entry would force the Postfix SMTP server to reject a
message that it should accept (denial of service). Problem reported by
OpenAI Security. File: postdrop.c.
Server crashes and panic()s:
Bug (defect introduced: Postfix 3.4, date: 20180805): missing SMTP server reset
of RCPT TO state, after a BDAT command error. A crafted remote SMTP client
could then send a DATA command without MAIL FROM or RCPT TO, and crash a
Postfix SMTP daemon process with a null pointer read error. Reported by
OpenAI Security. File: smtpd/smtpd.c.
Bug (defect introduced: Postfix 2.4, date: 20051222): null pointer read crash
while parsing a malformed Dovecot AUTH server response. Reported by Qualys,
assisted by Claude Mythos Preview. File: xsasl_dovecot_server.c.
Read after free, uninitialized read, under/over read:
Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free in the
PSC_CALL_BACK_NOTIFY() macro. This had no effect on program execution,
because myfree() wiped memory, and that memory was not yet reused. Problem
reported by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
Read after free (no privilege escalation) in debug logging (defect introduced:
Postfix 2.2, date: 20050117). Reported by Qualys, assisted by Claude Mythos
Preview. File: util/inet_connect.c.
Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized memory read
in postscreen HaProxy client after remote I/O exception, causing garbage to
be logged. Reported by Qualys, assisted by Claude Mythos Preview.
File: postscreen_haproxy.c.
Latent bug (defect introduced: Postfix 2.7, date: 20090618): uninitialized memory
read after dnsblog(8) returns a string that is not an IPv4 address. Reported
by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
Bug (defect introduced: before Postfix alpha, date 19970424): the DNS client
could read up to two bytes past the end of an MX record, before discovering
that the record was too short. This behavior was later copied with SRV
records, potentially over-reading up to six bytes. Problem reported by
Qualys, assisted by Claude Mythos Preview. File: dns_lookup.c.
Bug (defect introduced: Postfix 1,1, date: 20010524): the postsuper command
under-read or over-read a very short queue filename. No crash, information
leak, or privilege escalation. Reported by Qualys, assisted by Claude Mythos
Preview. Files: postsuper.c, mail_queue.h.
Other code hygiene:
Bug (defect introduced: before Postfix alpha, date: 19971106): 'int' over-shift,
in the queue file record-length parser. Postfix programs do not generate such
records, but an attacker could cause postdrop to reject input or panic().
Reported by Qualys, assisted by Claude Mythos Preview. File: record.c.
Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive comparison
of IPv4 addresses. Reported by Qualys, assisted by Claude Mythos Preview.
File: sock_addr.c.
Bug (defect introduced: Postfix 1.0, date: 20000928): the fast flush server, used
by the SMTP command "ETRN", and by the commands "postqueue -s site" and
"postqueue -i queue_id" (and their sendmail(1) equivalents), used the wrong
duplicate suppression API, resulting in unnecessary queue scans by the queue
manager. Reported by Qualys, assisted by Claude Mythos Preview. File: flush.c.
Queue hygiene: the postdrop command accepted the null record type which the rest
of Postfix ignores. Reported by OpenAI Security. File: postdrop.c.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/postfix | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lfs/postfix b/lfs/postfix
index 9584412ad..4ab686707 100644
--- a/lfs/postfix
+++ b/lfs/postfix
@@ -26,7 +26,7 @@ include Config
SUMMARY = A fast, secure, and flexible mailer
-VER = 3.11.5
+VER = 3.11.6
THISAPP = postfix-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = postfix
-PAK_VER = 55
+PAK_VER = 56
DEPS =
@@ -72,7 +72,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = c677014019ce0851e45b103e5d6a88972a10cd3685d4c68b47f6b94ee318b9e81fb017f5b15f4307f3b8c6719afcbba33f4fc1c31a4fb65fe040522d6af38704
+$(DL_FILE)_BLAKE2 = e4a1194fa3f718212413bcee4f61f3c7fe3bd6b0bc6e96a714ca4093e3827350c2eda0e68c5826d865fc9c657e6bcebb0724b99c282c7a85dd877f2207de5075
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] procps: Update to version 4.0.7
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (8 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] postfix: Update to version 3.11.6 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] rsync: Update to version 3.5.0 Adolf Belka
2026-08-13 13:39 ` [PATCH] wpa_supplicant: Update to version 2.12 Adolf Belka
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 4.0.6 to 4.0.7
- Update of rootfile
- Changelog
4.0.7
* library
version: inc revision to 2 now 1:2:0
internal: procps_pids_length off by one issue #412
external: fix slabinfo header extern 'C' declaration issue #415
internal: fix file descriptor leaks in <pids> api issue #421
internal: strv items are now escaped in <pids> api issue #429
internal: fix output if on seconds edge values merge !246 RHEL-60825
* pidof: Add -d aliased option issue #418
* pgrep: Don't treat empty list as 0 issue #427
* pmap: Fix testsuite for Alpha Debian #1141465
* ps: correct 'environ' output when file unavailable
* ps: minimize potential EACCES with 'environ' files issue #431
* top: avoid batch mode segfault with maximum width issue #422
* w: Correctly check for end of tty using utmp issue #430
* watch: Dont remove 2 lines when using -t option issue #413
* watch: Handle resizing better issue #417
* watch: Restore LINES and COLUMNS env variables issue #432
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/procps | 3 ++-
lfs/procps | 4 ++--
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/config/rootfiles/common/procps b/config/rootfiles/common/procps
index e19ce02f7..9974c5eb8 100644
--- a/config/rootfiles/common/procps
+++ b/config/rootfiles/common/procps
@@ -3,7 +3,7 @@ bin/ps
#lib/libproc2.la
#lib/libproc2.so
lib/libproc2.so.1
-lib/libproc2.so.1.0.1
+lib/libproc2.so.1.0.2
#lib/pkgconfig
#lib/pkgconfig/libproc2.pc
sbin/sysctl
@@ -53,6 +53,7 @@ usr/bin/watch
#usr/share/man/man1/pgrep.1
#usr/share/man/man1/pidof.1
#usr/share/man/man1/pidwait.1
+#usr/share/man/man1/pkill.1
#usr/share/man/man1/pmap.1
#usr/share/man/man1/ps.1
#usr/share/man/man1/pwdx.1
diff --git a/lfs/procps b/lfs/procps
index 26aa757f7..abfcdb4f8 100644
--- a/lfs/procps
+++ b/lfs/procps
@@ -24,7 +24,7 @@
include Config
-VER = 4.0.6
+VER = 4.0.7
THISAPP = procps-v$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = dbcbc76f544db055a5921cbe65d917ee7cdf5dae97ee9dc418d3969f68ebfa41e6adebb1369f5b07df5580504bf6881c27e2a8db0241a099b879e15337a8cb03
+$(DL_FILE)_BLAKE2 = efb1a245a8078a12b2de7a129ac66a3b0f5777b676b2bc7682488f995c57a48e24020f337d7beb2cb7161f0bf5e0c263f9ef7acb417ad1f7c90a27c8b9ab4ecd
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] rsync: Update to version 3.5.0
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (9 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] procps: Update to version 4.0.7 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
2026-08-13 13:39 ` [PATCH] wpa_supplicant: Update to version 2.12 Adolf Belka
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 3.4.4 to 3.5.0
- Update of rootfile
- 33 CVE fixes
- Changelog
3.5.0
SECURITY FIXES:
This release fixes 33 security issues found during a focused audit of rsync's
path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and
reports from external researchers -- plus several robustness hardenings. CVE
IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges
accompany each advisory, and many are much narrower than "everything before
3.5.0". Every fix ships with a regression test in the test suite that fails on
the unfixed tree. Many thanks to the external researchers credited below.
Link following (CWE-59/61) -- a local user who controls a path component plants
a symlink that a privileged rsync then follows:
- CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping via symlinked
operator-supplied input files. rsync followed attacker-planted symlinks in
`--filter` merge files (including per-directory merges and `-C` `.cvsignore`),
`--files-from` / `--include-from` / `--exclude-from`, and the client
`--password-file` / daemon secrets file -- reading an arbitrary file as filter
rules, or sending a victim file's contents as the daemon authentication
response. Operator-supplied paths are now resolved component-by-component with
`openat(O_PATH|O_NOFOLLOW)`, allowing a symlink component only when it is owned
by uid 0 or the effective uid.
- CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation via
symlinked operator-supplied output paths -- `--log-file`,
`--write-batch`/`--read-batch`, and the daemon's motd / lock / early-input /
`--config` opens. A planted symlink (or parent component) could redirect the
write, e.g. append the log to `authorized_keys`; `--read-batch` could also feed
chosen bytes to the protocol parser. Same trusted-owner path walk, plus an
`S_ISREG` check on the `--read-batch` file.
- CVE-2026-53785 (HIGH): Under `--relative`, the receiver's implied-parent
creation (`make_path()`) built the parent chain with a plain `mkdir()` on the
full path, so a planted parent symlink placed the new directories and file
outside the destination tree. `make_path()` now creates each component through
the held-directory-fd primitive. Reported by Omar Elsayed (seks99x).
- CVE-2026-53784 (HIGH): Daemon module-root chdir escape under `use chroot =
no`: a plain `chdir()` followed a planted parent-component symlink, serving
files from outside the module. The module-root chdir now goes through the
secure resolver.
- CVE-2026-53793 (HIGH): Chroot `/./` inner-module escape -- a symlinked
parent component inside the inner module reached a sibling outside it (the
generator basis stat, the receiver write/finish path, the module chdir, and the
receiver's delta-basis open). The secure resolver is now engaged for all of
those paths.
- CVE-2026-53795 (HIGH): An absolute `--temp-dir` or `--link-dest` disabled
the receiver's rename/link confinement. `do_rename_at()`/`do_link_at()` bailed
to the unconfined path-based call whenever *either* path was absolute, so an
absolute source (the temp file, or the link-dest basis) let `finish_transfer()`'s
tmp->final rename -- or a hard-link create -- follow a destination parent
component an attacker flipped to a symlink mid-transfer, writing the file outside
the tree. Each side is now confined independently. Reported by Omar Elsayed
(seks99x).
- CVE-2026-53796 (MEDIUM): A non-daemon receiver's one-time `chdir()` into the
operator-named destination was not fully confined (a relative destination took a
plain `chdir()`), so an attacker who raced the named destination from a directory
to a symlink moved the receiver's CWD -- and every file it then created --
outside the tree. The destination chdir now uses the same ownership-checked
`O_NOFOLLOW` walk as the daemon module chdir (see BEHAVIOR CHANGES). Reported by
Omar Elsayed (seks99x).
- CVE-2026-53797 (MEDIUM): A non-daemon sender opened each transferred file's
content by path (leaf `O_NOFOLLOW` only), so a source parent component an
unprivileged user raced to a symlink after the file-list scan was followed --
reading a file from outside the source tree into an attacker-readable
destination. The content open is now anchored at the transfer root with
`secure_relative_open()`; `-L` / `--copy-unsafe-links` / `-k` still follow, and
`--insecure-links` restores the legacy open.
- CVE-2026-53799 (MEDIUM): Receiver ACL/xattr metadata application followed a
symlink race -> arbitrary ACL set (local privilege escalation). When preserving
metadata (`-A`/`--acls`, `-X`/`--xattrs`, or fake-super ACL-as-xattr), the
receiver applied each entry's ACL/xattrs by path via `acl_set_file()` /
`setxattr()`. A local user who raced a just-received entry (or a parent) into a
symlink before the apply could redirect an attacker-chosen ACL -- the bytes are
carried in the source entry -- onto a victim inode outside the destination tree,
granting rwx on a root-owned file. The apply now pins each entry's inode with an
`O_RDONLY|O_NOFOLLOW` fd and sets all metadata on the held inode (Linux 6.13+
`*xattrat` syscalls, or a patched libacl's `*_at` bindings, else the
`/proc/self/fd` compat path). Where neither primitive exists (the BSDs, Solaris,
macOS, or a `/proc`-less Linux container) it falls back to the path-based apply to
keep `--acls` functional -- a documented residual, refusable via `refuse options =
acls`.
- CVE-2026-53800 (MEDIUM): Sender `--remove-source-files` unlink followed a
parent-component symlink race -> arbitrary file deletion outside the source tree.
The post-send unlink and its same-file safety re-stat resolved by path relative to
the process CWD, so an unprivileged user who raced a source parent into a symlink
after the file was sent could make a higher-authority sender (a root
`--remove-source-files` run, or a daemon module not refusing the option) delete a
file outside the served tree. The removal is now resolved through the secure
held-dirfd walk anchored at the served module root (daemon) or transfer-root CWD
(local sender), the safety re-stat is confined likewise, and the per-file dev/ino
is only computed when `--remove-source-files` is in effect.
- CVE-2026-53801 (MEDIUM): Sender/daemon directory-scan enumeration escaped the
transfer root / module -> out-of-tree disclosure. The sender enumerated each
source directory with a plain `opendir()` on the accumulated path, not through the
secure resolver (the enumeration sibling of the previous item, which confined only
the content open). A parent component raced to a symlink between the file-list
scan and the recursive `opendir()` -- or, in daemon following mode
(`-L`/`--copy-dirlinks`/`--copy-unsafe-links`), an in-module symlinked directory
pointing outside the module -- let a higher-authority sender enumerate an
out-of-tree directory and copy its entry names, metadata and symlink targets. The
directory scan is now confined through a held `opendir` fd anchored at the transfer
root / module.
`support/rrsync` (the restricted SSH wrapper):
- CVE-2026-53783 (HIGH): rrsync restricted-directory escape. It validated each
argument with `realpath()` and then exec'd rsync against the same name (a
TOCTOU window), and left dangerous options enabled in a restricted subdir.
rrsync now inode-pins the validated path and roots the argument it hands rsync
at that pinned fd, denies `--copy-unsafe-links`, forces `--no-D`, and refuses a
symlinked `--log-file`. The pin relies on Linux's `/proc/self/fd` magic links
being bound to the open inode, so it is Linux-only; on the BSDs, macOS, Solaris
and Cygwin rrsync passes the `realpath()`-validated name as it always did.
Two limits are worth stating: under `--relative` only the anchor the
transmitted name starts from is pinned, so a component below it can still be
raced, and the final component of an ordinary sender argument is not pinned
either (rsync does not follow a symlink there, and the options that would
change that are refused in a restricted dir).
- A filter rule that failed to parse was echoed back verbatim, including when
the rule came from a merge file's contents. A per-directory merge rule names
a file the peer chooses and travels over the protocol rather than in an
argument, so this let a peer read back any line of any file the server process
could open that is not valid filter syntax -- through an `rrsync` restricted
account as well as a daemon module, since neither confined a merge open that
the wrapper never sees. A syntax error in a rule read from a file now reports
the file and line rather than the text; a rule given as an argument is still
shown. The `--debug=FILTER` traces print the same file-derived text, so
`rrsync` now refuses a peer-selected `--debug` (a stock client never sends
one). An operator who turns debugging on for their own server still sees the
rule text.
- Redacting those diagnostics did not close the merge route on its own, because
the worst shape produces no diagnostic at all: an exclude-only merge (the `-`
modifier) makes every line of the file a pattern, so nothing fails to parse
and the peer reads the contents off which of its own names went missing from
the file list. Through an `rrsync` restricted account that needs no
`--delete` and no verbosity on a pull. The open is now confined rather than
the disclosure suppressed: rsync gained `--confine-root=DIR`, which refuses an
operator- or peer-supplied path that resolves outside DIR, and `rrsync` passes
its restricted directory. A merge file inside that directory keeps working.
A daemon already had this through its module root and is unaffected.
Daemon protocol / identity:
- CVE-2026-53786 (MEDIUM): A client-supplied `--filter` merge file bypassed
the module filter list (it was checked against the module-prefixed path, which
never matched a module rule). The module-dir prefix is now stripped before the
check. Reported by Mitchell Benjamin (Revamp Studio).
- CVE-2026-53798 (MEDIUM): The daemon name converter mapped an unknown name to
uid/gid 0 (an empty response was read as `atol("") == 0`); with `fake super =
yes` the stored metadata became root-owned. An empty/non-numeric response is
now treated as a lookup failure. Reported by Mitchell Benjamin (Revamp
Studio).
- CVE-2026-53788 (MEDIUM): A peer-controlled name containing a newline/CR was
written verbatim into the name-converter line protocol, allowing request
injection. Converter tokens containing control characters are now rejected.
Reported by Mitchell Benjamin (Revamp Studio).
- CVE-2026-53789 (MEDIUM): A malicious daemon-sender could widen `--delete`
scope by omitting the "no content dir" flag on an implied parent, making the
receiver run `delete_in_dir()` on it. Implied-parent directories are now
forced non-content on the receiver. Reported by Mitchell Benjamin (Revamp
Studio).
- CVE-2026-53791 (CRITICAL): With `proxy protocol = true`, a client connecting
directly (not via the trusted proxy) could send a PROXY header to spoof its
source address and bypass host-based access control. A forwarded address is
now honoured only from a configured trusted-proxy peer.
Injection and memory safety:
- CVE-2026-53790 (HIGH): Command / argument injection via unquoted peer- or
host-controlled values -- the `RSYNC_CONNECT_PROG` `%H` host substitution, the
daemon exec-hook `%RSYNC_*%` expansions, rsync-ssl hostspecs, and a missing
newline/CR in remote-shell argument quoting. Each sink is now quoted or
validated (the hook escaping is confined to the shell-executed hooks, so
ordinary daemon string parameters such as `path` are unaffected).
- CVE-2026-53792 (MEDIUM): A malicious receiver sending a checksum header with a
block count > 0 but block length == 0 drove the sender's rolling-match
arithmetic negative. A zero block length is now rejected.
- CVE-2026-53794 (MEDIUM): `--max-alloc=0` disabled the per-allocation size
cap (the defense behind CVE-2024-12084) and could be forwarded on the wire to
an unpatched daemon. A zero max-alloc is now rejected at both the client and
the daemon. Reported by Azizcan Dastan (Milenium Security).
Peer-triggerable memory corruption in the daemon protocol, found by a
daemon-protocol fuzzing pass and reported by Greg Kroah-Hartman. Each is a
WRITE reachable from the wire, which is why these were split out from the
crash-only findings in the same pass:
- CVE-2026-70461 (HIGH): a one-byte heap out-of-bounds write in
`add_implied_include()`, driven by a peer-supplied filter rule whose trailing
backslash was not counted when sizing the copy.
- CVE-2026-70458 (HIGH): an out-of-bounds write from a file entry marked
`FLAG_HLINKED` that the receiver accepted even though `-H` was not in effect,
so the hard-link extra slots it then wrote were never allocated.
- CVE-2026-70456 (HIGH): an out-of-bounds heap write in `read_args()` when the
peer's argument count lands exactly on `maxargs` -- the trailing NULL went one
past the end of the array.
- CVE-2026-70457 (MEDIUM): an attacker-chosen-offset write in
`parse_size_arg()`'s error formatting, reachable through an over-large
`--max-size` / `--min-size` / `--max-alloc` forwarded to a daemon.
- CVE-2026-70459 (MEDIUM): a wild-pointer read crashing the per-connection
daemon child, from a crafted first incremental file list whose transfer root
is "." with a non-directory mode -- `parent_ndx` stayed 0 while `dir_flist`
was still empty, so the generator dereferenced a never-written slot.
Companion to CVE-2026-43620; reproduced on released 3.2.7, 3.4.0 and 3.4.1.
Daemon availability and access control:
- CVE-2026-70464 (HIGH): an unauthenticated peer could complete the `@RSYNCD`
greeting and then stall forever -- sending a line with no terminator, or
trickling NUL-terminated arguments into `read_args()` one byte at a time --
holding a per-connection child open past the module's `max connections`
limit. The `timeout` parameter did not cover it, because `set_io_timeout()`
ran after the `read_args()` calls that needed covering. A separate deadline
now spans both, and the early-protocol argument count is bounded. Reported
independently by Chamal De Silva and by Michal Ruprich (Red Hat QE).
- CVE-2026-70455 (HIGH): a daemon client could request an arbitrary Zstandard
worker count via `--compress-threads`; 256 was measured as 257 threads in a
single connection. Now capped at 8 on a daemon, while local and
remote-shell invocations keep the operator's value. Reported, fixed and
tested by Filipe Casal of Trail of Bits, in collaboration with OpenAI.
- CVE-2026-70453 (HIGH): quadratic CPU exhaustion in `hash_search()` from a
crafted chain of equal weak checksums. The chain walk is now bounded. First
reported as a performance problem in public rsync issue #217 by heyciao
(2021); recognised as a security issue, bounded and regression-tested by
Stuart Inglis. This one was already public and was not embargoed.
- CVE-2026-70452 (HIGH): `hosts deny` failed OPEN when a configured hostname
could not be resolved -- with `forward lookup` enabled, which is the default,
an unresolvable deny token admitted the host it was meant to block. It now
fails closed. Sibling of CVE-2026-43617. Reported by Leonid Bugaev.
- CVE-2026-70463 (HIGH): `auth users` ignored its documented comma-only
parsing. With a leading comma the split should be on commas alone, so that a
group name containing a space can be written; it split on whitespace too, so
a `deny` or `:ro` rule naming such a group was broken into two meaningless
tokens and never fired. Reported by Andres Berbescu.
- CVE-2026-70460 (HIGH): a peer-supplied `--partial-dir` or `--backup-dir` was
resolved by pathname, so an in-module symlink could redirect it and place
files outside the daemon's module root. Those paths are now confined.
Reported by Omar Elsayed (seks99x).
Client-side:
- CVE-2026-70462 (MEDIUM): a peer-supplied `MSG_IO_TIMEOUT` defeated the
client's own I/O timeout -- a large value overflowed signed arithmetic, and a
non-positive value disabled the timeout outright. The value is now capped on
receipt and the arithmetic made overflow-safe. Reported by Z3R0S! (z3r0s6);
the non-positive case was reported by Leonid Bugaev.
- CVE-2026-70454 (MEDIUM): `rsync-ssl` established an unauthenticated TLS
connection. In stunnel mode it neither required CA verification nor bound
the certificate to the requested hostname, so an active network attacker
could impersonate the server; the openssl backend had a matching hostname
gap in 3.2.0 through 3.2.3 (found and fixed in 2020 by Matt McCutchen).
stunnel mode now requires certificate verification and hostname binding
unless an explicit insecure opt-out is set, and the GnuTLS backend is
refused conservatively rather than used unverified (Greg Kroah-Hartman).
Robustness hardening (no CVE assigned): the `RSYNC_PROXY` CONNECT request and
proxy response headers are length-bounded, and peer-requested xattr expansion is
capped.
A second-pass source audit (reported by Leonid Bugaev) hardened several memory-
safety and robustness paths: the hashtable and file-list size computations are
guarded against a 32-bit integer overflow that a peer's entry count could
otherwise wrap into an under-allocation, and the
`SIGUSR2` handler is now async-signal-safe (it only sets a flag, deferring the
summary/close-out work to safe poll points). Separately, the xattr/ACL metadata
copy now reads the *source* through a held no-follow fd as well as writing the
destination through one -- closing a parent-symlink race on the `--copy-dest` and
backup source -- and the cross-tree operator-path metadata apply is now fd-pinned
under `--fake-super` too (previously it fell back to a path-based set for a
`fake super = yes` daemon staging through an absolute `--temp-dir`/`--backup-dir`).
SECURITY RELATED:
- Mask a peer-supplied I/O-error value to the defined `IOERR_*` bits, both the
incoming `MSG_IO_ERROR` message (`io.c`) and the file-list trailer (`flist.c`),
so a malicious peer cannot set arbitrary (undefined) error flags that would be
stored in the local `io_error` and re-forwarded upstream. (Undefined bits
never reached the exit code, which maps only the defined bits.) Reported by
Leonid Bugaev.
- Escape control characters in filenames written to the log file (CWE-117 log
injection): a transferred name containing control bytes -- C0 (tab excepted)
and C1 `0x80`-`0x9f`, including CSI `0x9b` -- could otherwise inject terminal
escape sequences into an administrator's terminal when the log is viewed.
Reported by Leonid Bugaev.
- Stop `safe_arg()` leaking an uninitialized byte into a quoted filename. In
filename mode the writer suppresses the escaping backslash before a wildcard,
but the counter that sized the buffer reserved a slot for every backslash, so
the two disagreed and left an uninitialized heap byte in the returned string
-- which is handed to the remote shell when `--protect-args` is off. The
counter now mirrors the writer, and guarding the wildcard test with `f[1]`
also fixes a trailing backslash (previously `strchr()` matched the string
terminator, so the backslash was not doubled). Reported by Leonid Bugaev.
- Close a `--safe-links` bypass in `--backup`: when symlinks can be hard-linked,
`make_backup()`'s link/rename fast path hard-linked an unsafe (out-of-tree)
symlink into the backup area and skipped the `safe_symlinks` check the copy
path applies, silently preserving a link `--safe-links` was meant to drop. The
safe-links check now runs before the fast path, and a symlink whose target is
unreadable is failed closed rather than backed up unchecked. Reported by
Leonid Bugaev.
- Extend the operator-directory ownership walk to the backup leaf sinks:
`do_symlink_at()` (backing a symlink up into an operator `--backup-dir`) and
`do_rmdir_at()` (removing a pre-existing backup directory) now resolve their
parent through the same ownership walk, so a foreign-owned parent symlink no
longer redirects the backup symlink-create or directory-removal outside the
backup tree. `--insecure-links` (or a module's `insecure links = yes`) restores
the legacy follow. Reported by Omar Elsayed (seks99x).
- Confine an absolute operator source/destination through the ownership walk in
`robust_rename()`'s cross-filesystem (EXDEV) copy fallback, so a raced parent
symlink cannot redirect the fallback copy or its source unlink out of the tree.
Reported by Leonid Bugaev.
- Bound the number of equal-weak-checksum blocks examined per offset in
`hash_search()` (issue #217), so a crafted or degenerate checksum set with a
very long equal-checksum chain cannot drive the sender's per-offset
match-verify into a quadratic blow-up (CPU DoS). Fix by Stuart Inglis.
BUG FIXES:
- Fix an off-by-one in `clean_fname()`'s `..`-collapse path normalization.
Reported by Leonid Bugaev.
- The AVX2 rolling-checksum assembly (`--enable-roll-asm`) read up to 64 bytes
past the end of the buffer it was given. The loop is software-pipelined and
preloaded the 64 bytes after the ones it was folding in, so its last iteration
always reached beyond the data -- the remainder is by construction under 64
bytes. It normally landed in slack inside rsync's map window and went
unnoticed; where the buffer ended at a page boundary it was a SIGSEGV mid
transfer, reported on macOS x86-64 by Roland Kletzing. Reported checksums are
unchanged.
- `--link-dest` no longer fails the transfer when the destination refuses to
hard-link a symlink, device node, FIFO or socket. Whether rsync hard-links
those at all was decided at build time, on whatever filesystem the source tree
happened to sit on, and one host can hold both answers -- macOS builds on
APFS, which can, and backs up to HFS+, which returns ENOTSUP. Such an entry
is now copied, exactly as it already is in a build that cannot link them and
as a regular file in the same position already was; the run used to exit 23
even though the entry was then created correctly. The fallback covers any
refusal, since the error does not identify one on its own: link(2) documents
EPERM both for a filesystem without hard links and for a permission refusal.
Still outstanding: under `-H`, a group of such entries hard-linked to each
other also needs a link within the destination, and where the destination
cannot hard-link the type at all, the members after the first are still lost.
- `--out-format` / `--log-file-format` now emit a literal `%` for `%%` instead of
mis-parsing the following character (added by Leonid Bugaev); a follow-up bounds
`log_format_has()`'s width-digit scan to match `log_formatted()`, closing a `%C`
read past the checksum field.
- A CVS `.cvsignore` (or `-C`) file containing a `!` clear-list token no longer
aborts with a spurious "rule has trailing characters" error. Reported by
Leonid Bugaev.
- `--chmod=a+s` now sets both the setuid and setgid bits, matching `chmod(1)`
(it previously set setuid only). Reported by Leonid Bugaev.
- Case-insensitive wildcard matching (used by daemon `hosts allow`/`hosts deny`
rules) now folds characters inside a `[...]` bracket expression, not just
literal pattern characters. Reported by Leonid Bugaev.
BEHAVIOR CHANGES:
- A non-daemon receiver follows an operator-named symlinked destination directory
only when the symlink is owned by root or the running user (e.g. `rsync -a src/
/backup/` where `/backup -> /mnt/disk`); a destination symlinked by another uid
is now refused, closing a chdir TOCTOU where an attacker raced the named
destination into a symlink. `--insecure-links` restores the unconditional
follow.
- On platforms without a race-safe way to create a unix socket in a subdirectory
(the BSDs, macOS, Solaris, which lack `bindat()`), a nested socket transferred
under `--specials` is skipped with a warning instead of failing the whole
transfer. Top-level sockets are unaffected.
- `proxy protocol = true` with no `proxy protocol hosts` rejects all connections
(fail-closed); the daemon now warns about this at startup.
- `support/rrsync` in a restricted subdirectory forces `--no-D` (device/special
semantics are stripped, so a plain `rsync -a` still works) and denies
`--copy-unsafe-links`.
- The path resolver now follows in-tree directory symlinks uniformly on every
platform via a single race-free per-component `O_NOFOLLOW` walk, so `-K` /
`-L` / `-k` and `-R` through an in-tree symlinked parent behave the same
everywhere.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/rsync | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lfs/rsync b/lfs/rsync
index 8ba4e11a0..69a2aa469 100644
--- a/lfs/rsync
+++ b/lfs/rsync
@@ -26,7 +26,7 @@ include Config
SUMMARY = Versatile tool for fast incremental file transfer
-VER = 3.4.4
+VER = 3.5.0
THISAPP = rsync-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = rsync
-PAK_VER = 24
+PAK_VER = 25
DEPS = libxxhash
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f4eec8d1077e1cc7eec8cd39dcac4643f7608231f5aa6390cb53104efa1602873a333d9e6cba5d1bb2aeff6c3bf9bccd80370a2105a9cc982b49aae9f39f3bde
+$(DL_FILE)_BLAKE2 = 1a0aaddd9555c14e2b026f4ac9aff0c0b7760a5809fc80c7872b382a0b9b4719dcc0d382c0e43439955efd855ffa2dff101c10a86529b88fd380205cc9506179
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH] wpa_supplicant: Update to version 2.12
2026-08-13 13:39 [PATCH] aprutil: Update to version 1.6.5 Adolf Belka
` (10 preceding siblings ...)
2026-08-13 13:39 ` [PATCH] rsync: Update to version 3.5.0 Adolf Belka
@ 2026-08-13 13:39 ` Adolf Belka
11 siblings, 0 replies; 13+ messages in thread
From: Adolf Belka @ 2026-08-13 13:39 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 2.11 to 2.12
- No change in rootfile
- Changelog
2.12
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* enable layer 2/Wi-Fi multicast filtering for all networks (not
just some Passpoint networks which enabled this before)
* wpa_gui: port to Qt6
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* maintain configuration file permissions when writing updated
configuration
* add option to validate PKCS#11/OpenSC engine and module paths
* fix PMKSA caching to enforce network context to avoid misuse of
unexpected PMKSA cache entries
* fix a potential DoS attack in SAE processing of an unexpected element
* fix incomplete bounds checking of mesh AMPE messages that could have
resulted in DoS attacks and memory corruption
* a large number of other fixes, cleanup, and extensions
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/wpa_supplicant | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant
index 38a147619..e9a2d2c13 100644
--- a/lfs/wpa_supplicant
+++ b/lfs/wpa_supplicant
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.11
+VER = 2.12
THISAPP = wpa_supplicant-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 71bd0d11cd31eb5bc6beb51caf0f1399856ea188f316d2330053a2d8c81869057811e9f500828e8981eabd0af38f30a18a3ae584d744005c78681c82fa910abf
+$(DL_FILE)_BLAKE2 = 8a0d4d3d28370fe532676c2d02ce98db3861a6895cb73c83fd33bd3707698ead0bb7b4e9ed5a2cc87ea8db61f75b3da5bf548b67bce45b09223263da01d542ec
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 13+ messages in thread