* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. eacb8e79e56337f516ab02977800af187deb1060
@ 2026-08-13 14:02 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-08-13 14:02 UTC (permalink / raw)
To: ipfire-scm
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 79374 bytes --]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via eacb8e79e56337f516ab02977800af187deb1060 (commit)
via 74a300be8457313c0921c7b5de60f47c1275b81b (commit)
via b10b224858dc7a82a6b9a179cd208b5f389b665f (commit)
via e339bb17523dee3f6b64264b26faedb940eeb774 (commit)
via 0381b339dc9da6df7e47930afd91b33839914843 (commit)
via 9a60544dd47948ab0335302dcbb47500a0f2893d (commit)
via ae09a50943278dc52df8c6cf34f9305a2cd936e0 (commit)
via ff431b137504a03d3fd6d3c4e8a4929349b91b2c (commit)
via 7733229f038a5761a90b569de5d7e1135a456aea (commit)
via 0f46fd817a0e71111488961c79752f2b5ea10e4b (commit)
via cd1709e57bf04f5b3c90a6c7d8232597dd9d1e2a (commit)
via f5cb6589d5e041ccc0d23d8c2b82bc1e4bc82b0d (commit)
via 011f31bf607757575c6ed29680e9aeae90bcdbeb (commit)
via 7a95aa96473ef7ace9f54cb33770bd7daf87eae5 (commit)
via ad2b7fb553c498e3fc4e8763ab48ff09bfbb2fb2 (commit)
via 3579fa98db3741d438169a7316111a081e5a1718 (commit)
via 18fb278a8ab4af96b5348a29e33f5c083d57dc33 (commit)
from 64d303b8fd08750df3ff5b88a2bd26b446c9c9f0 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit eacb8e79e56337f516ab02977800af187deb1060
Author: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu Aug 13 13:56:34 2026 +0000
core205: Restart OpenSSH
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 74a300be8457313c0921c7b5de60f47c1275b81b
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:34 2026 +0200
core205: Ship wpa_supplicant
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit b10b224858dc7a82a6b9a179cd208b5f389b665f
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:42 2026 +0200
wpa_supplicant: Update to version 2.12
- Update from version 2.11 to 2.12
- No change in rootfile
- Changelog
2.12
* support RSN overriding (e.g., WPA3-Personal Compatibility Mode)
* improve BSS transition management support
* EHT/IEEE 802.11be/Wi-Fi 7
- more complete support
- fix message validation issues that could enable DoS attacks
* support Wi-Fi Direct R2
* support Wi-Fi Aware (add synchronized NAN; extend USD support)
* support Proximity Ranging
* support SPP A-MSDU negotiation
* support IEEE 802.11bi functionality
- changing SAE password identifiers
- EPPKE
- IEEE 802.1X/EAP in Authentication frames
- Association frame encryption
- PMKID privacy
* enable layer 2/Wi-Fi multicast filtering for all networks (not
just some Passpoint networks which enabled this before)
* wpa_gui: port to Qt6
* support OpenSSL 3.0 API changes
* EAP-TEAP: protocol changes based on RFC 9930; this is not compatible
with previous versions
* maintain configuration file permissions when writing updated
configuration
* add option to validate PKCS#11/OpenSC engine and module paths
* fix PMKSA caching to enforce network context to avoid misuse of
unexpected PMKSA cache entries
* fix a potential DoS attack in SAE processing of an unexpected element
* fix incomplete bounds checking of mesh AMPE messages that could have
resulted in DoS attacks and memory corruption
* a large number of other fixes, cleanup, and extensions
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit e339bb17523dee3f6b64264b26faedb940eeb774
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:41 2026 +0200
rsync: Update to version 3.5.0
- Update from version 3.4.4 to 3.5.0
- Update of rootfile
- 33 CVE fixes
- Changelog
3.5.0
SECURITY FIXES:
This release fixes 33 security issues found during a focused audit of rsync's
path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and
reports from external researchers -- plus several robustness hardenings. CVE
IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges
accompany each advisory, and many are much narrower than "everything before
3.5.0". Every fix ships with a regression test in the test suite that fails on
the unfixed tree. Many thanks to the external researchers credited below.
Link following (CWE-59/61) -- a local user who controls a path component plants
a symlink that a privileged rsync then follows:
- CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping via symlinked
operator-supplied input files. rsync followed attacker-planted symlinks in
`--filter` merge files (including per-directory merges and `-C` `.cvsignore`),
`--files-from` / `--include-from` / `--exclude-from`, and the client
`--password-file` / daemon secrets file -- reading an arbitrary file as filter
rules, or sending a victim file's contents as the daemon authentication
response. Operator-supplied paths are now resolved component-by-component with
`openat(O_PATH|O_NOFOLLOW)`, allowing a symlink component only when it is owned
by uid 0 or the effective uid.
- CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation via
symlinked operator-supplied output paths -- `--log-file`,
`--write-batch`/`--read-batch`, and the daemon's motd / lock / early-input /
`--config` opens. A planted symlink (or parent component) could redirect the
write, e.g. append the log to `authorized_keys`; `--read-batch` could also feed
chosen bytes to the protocol parser. Same trusted-owner path walk, plus an
`S_ISREG` check on the `--read-batch` file.
- CVE-2026-53785 (HIGH): Under `--relative`, the receiver's implied-parent
creation (`make_path()`) built the parent chain with a plain `mkdir()` on the
full path, so a planted parent symlink placed the new directories and file
outside the destination tree. `make_path()` now creates each component through
the held-directory-fd primitive. Reported by Omar Elsayed (seks99x).
- CVE-2026-53784 (HIGH): Daemon module-root chdir escape under `use chroot =
no`: a plain `chdir()` followed a planted parent-component symlink, serving
files from outside the module. The module-root chdir now goes through the
secure resolver.
- CVE-2026-53793 (HIGH): Chroot `/./` inner-module escape -- a symlinked
parent component inside the inner module reached a sibling outside it (the
generator basis stat, the receiver write/finish path, the module chdir, and the
receiver's delta-basis open). The secure resolver is now engaged for all of
those paths.
- CVE-2026-53795 (HIGH): An absolute `--temp-dir` or `--link-dest` disabled
the receiver's rename/link confinement. `do_rename_at()`/`do_link_at()` bailed
to the unconfined path-based call whenever *either* path was absolute, so an
absolute source (the temp file, or the link-dest basis) let `finish_transfer()`'s
tmp->final rename -- or a hard-link create -- follow a destination parent
component an attacker flipped to a symlink mid-transfer, writing the file outside
the tree. Each side is now confined independently. Reported by Omar Elsayed
(seks99x).
- CVE-2026-53796 (MEDIUM): A non-daemon receiver's one-time `chdir()` into the
operator-named destination was not fully confined (a relative destination took a
plain `chdir()`), so an attacker who raced the named destination from a directory
to a symlink moved the receiver's CWD -- and every file it then created --
outside the tree. The destination chdir now uses the same ownership-checked
`O_NOFOLLOW` walk as the daemon module chdir (see BEHAVIOR CHANGES). Reported by
Omar Elsayed (seks99x).
- CVE-2026-53797 (MEDIUM): A non-daemon sender opened each transferred file's
content by path (leaf `O_NOFOLLOW` only), so a source parent component an
unprivileged user raced to a symlink after the file-list scan was followed --
reading a file from outside the source tree into an attacker-readable
destination. The content open is now anchored at the transfer root with
`secure_relative_open()`; `-L` / `--copy-unsafe-links` / `-k` still follow, and
`--insecure-links` restores the legacy open.
- CVE-2026-53799 (MEDIUM): Receiver ACL/xattr metadata application followed a
symlink race -> arbitrary ACL set (local privilege escalation). When preserving
metadata (`-A`/`--acls`, `-X`/`--xattrs`, or fake-super ACL-as-xattr), the
receiver applied each entry's ACL/xattrs by path via `acl_set_file()` /
`setxattr()`. A local user who raced a just-received entry (or a parent) into a
symlink before the apply could redirect an attacker-chosen ACL -- the bytes are
carried in the source entry -- onto a victim inode outside the destination tree,
granting rwx on a root-owned file. The apply now pins each entry's inode with an
`O_RDONLY|O_NOFOLLOW` fd and sets all metadata on the held inode (Linux 6.13+
`*xattrat` syscalls, or a patched libacl's `*_at` bindings, else the
`/proc/self/fd` compat path). Where neither primitive exists (the BSDs, Solaris,
macOS, or a `/proc`-less Linux container) it falls back to the path-based apply to
keep `--acls` functional -- a documented residual, refusable via `refuse options =
acls`.
- CVE-2026-53800 (MEDIUM): Sender `--remove-source-files` unlink followed a
parent-component symlink race -> arbitrary file deletion outside the source tree.
The post-send unlink and its same-file safety re-stat resolved by path relative to
the process CWD, so an unprivileged user who raced a source parent into a symlink
after the file was sent could make a higher-authority sender (a root
`--remove-source-files` run, or a daemon module not refusing the option) delete a
file outside the served tree. The removal is now resolved through the secure
held-dirfd walk anchored at the served module root (daemon) or transfer-root CWD
(local sender), the safety re-stat is confined likewise, and the per-file dev/ino
is only computed when `--remove-source-files` is in effect.
- CVE-2026-53801 (MEDIUM): Sender/daemon directory-scan enumeration escaped the
transfer root / module -> out-of-tree disclosure. The sender enumerated each
source directory with a plain `opendir()` on the accumulated path, not through the
secure resolver (the enumeration sibling of the previous item, which confined only
the content open). A parent component raced to a symlink between the file-list
scan and the recursive `opendir()` -- or, in daemon following mode
(`-L`/`--copy-dirlinks`/`--copy-unsafe-links`), an in-module symlinked directory
pointing outside the module -- let a higher-authority sender enumerate an
out-of-tree directory and copy its entry names, metadata and symlink targets. The
directory scan is now confined through a held `opendir` fd anchored at the transfer
root / module.
`support/rrsync` (the restricted SSH wrapper):
- CVE-2026-53783 (HIGH): rrsync restricted-directory escape. It validated each
argument with `realpath()` and then exec'd rsync against the same name (a
TOCTOU window), and left dangerous options enabled in a restricted subdir.
rrsync now inode-pins the validated path and roots the argument it hands rsync
at that pinned fd, denies `--copy-unsafe-links`, forces `--no-D`, and refuses a
symlinked `--log-file`. The pin relies on Linux's `/proc/self/fd` magic links
being bound to the open inode, so it is Linux-only; on the BSDs, macOS, Solaris
and Cygwin rrsync passes the `realpath()`-validated name as it always did.
Two limits are worth stating: under `--relative` only the anchor the
transmitted name starts from is pinned, so a component below it can still be
raced, and the final component of an ordinary sender argument is not pinned
either (rsync does not follow a symlink there, and the options that would
change that are refused in a restricted dir).
- A filter rule that failed to parse was echoed back verbatim, including when
the rule came from a merge file's contents. A per-directory merge rule names
a file the peer chooses and travels over the protocol rather than in an
argument, so this let a peer read back any line of any file the server process
could open that is not valid filter syntax -- through an `rrsync` restricted
account as well as a daemon module, since neither confined a merge open that
the wrapper never sees. A syntax error in a rule read from a file now reports
the file and line rather than the text; a rule given as an argument is still
shown. The `--debug=FILTER` traces print the same file-derived text, so
`rrsync` now refuses a peer-selected `--debug` (a stock client never sends
one). An operator who turns debugging on for their own server still sees the
rule text.
- Redacting those diagnostics did not close the merge route on its own, because
the worst shape produces no diagnostic at all: an exclude-only merge (the `-`
modifier) makes every line of the file a pattern, so nothing fails to parse
and the peer reads the contents off which of its own names went missing from
the file list. Through an `rrsync` restricted account that needs no
`--delete` and no verbosity on a pull. The open is now confined rather than
the disclosure suppressed: rsync gained `--confine-root=DIR`, which refuses an
operator- or peer-supplied path that resolves outside DIR, and `rrsync` passes
its restricted directory. A merge file inside that directory keeps working.
A daemon already had this through its module root and is unaffected.
Daemon protocol / identity:
- CVE-2026-53786 (MEDIUM): A client-supplied `--filter` merge file bypassed
the module filter list (it was checked against the module-prefixed path, which
never matched a module rule). The module-dir prefix is now stripped before the
check. Reported by Mitchell Benjamin (Revamp Studio).
- CVE-2026-53798 (MEDIUM): The daemon name converter mapped an unknown name to
uid/gid 0 (an empty response was read as `atol("") == 0`); with `fake super =
yes` the stored metadata became root-owned. An empty/non-numeric response is
now treated as a lookup failure. Reported by Mitchell Benjamin (Revamp
Studio).
- CVE-2026-53788 (MEDIUM): A peer-controlled name containing a newline/CR was
written verbatim into the name-converter line protocol, allowing request
injection. Converter tokens containing control characters are now rejected.
Reported by Mitchell Benjamin (Revamp Studio).
- CVE-2026-53789 (MEDIUM): A malicious daemon-sender could widen `--delete`
scope by omitting the "no content dir" flag on an implied parent, making the
receiver run `delete_in_dir()` on it. Implied-parent directories are now
forced non-content on the receiver. Reported by Mitchell Benjamin (Revamp
Studio).
- CVE-2026-53791 (CRITICAL): With `proxy protocol = true`, a client connecting
directly (not via the trusted proxy) could send a PROXY header to spoof its
source address and bypass host-based access control. A forwarded address is
now honoured only from a configured trusted-proxy peer.
Injection and memory safety:
- CVE-2026-53790 (HIGH): Command / argument injection via unquoted peer- or
host-controlled values -- the `RSYNC_CONNECT_PROG` `%H` host substitution, the
daemon exec-hook `%RSYNC_*%` expansions, rsync-ssl hostspecs, and a missing
newline/CR in remote-shell argument quoting. Each sink is now quoted or
validated (the hook escaping is confined to the shell-executed hooks, so
ordinary daemon string parameters such as `path` are unaffected).
- CVE-2026-53792 (MEDIUM): A malicious receiver sending a checksum header with a
block count > 0 but block length == 0 drove the sender's rolling-match
arithmetic negative. A zero block length is now rejected.
- CVE-2026-53794 (MEDIUM): `--max-alloc=0` disabled the per-allocation size
cap (the defense behind CVE-2024-12084) and could be forwarded on the wire to
an unpatched daemon. A zero max-alloc is now rejected at both the client and
the daemon. Reported by Azizcan Dastan (Milenium Security).
Peer-triggerable memory corruption in the daemon protocol, found by a
daemon-protocol fuzzing pass and reported by Greg Kroah-Hartman. Each is a
WRITE reachable from the wire, which is why these were split out from the
crash-only findings in the same pass:
- CVE-2026-70461 (HIGH): a one-byte heap out-of-bounds write in
`add_implied_include()`, driven by a peer-supplied filter rule whose trailing
backslash was not counted when sizing the copy.
- CVE-2026-70458 (HIGH): an out-of-bounds write from a file entry marked
`FLAG_HLINKED` that the receiver accepted even though `-H` was not in effect,
so the hard-link extra slots it then wrote were never allocated.
- CVE-2026-70456 (HIGH): an out-of-bounds heap write in `read_args()` when the
peer's argument count lands exactly on `maxargs` -- the trailing NULL went one
past the end of the array.
- CVE-2026-70457 (MEDIUM): an attacker-chosen-offset write in
`parse_size_arg()`'s error formatting, reachable through an over-large
`--max-size` / `--min-size` / `--max-alloc` forwarded to a daemon.
- CVE-2026-70459 (MEDIUM): a wild-pointer read crashing the per-connection
daemon child, from a crafted first incremental file list whose transfer root
is "." with a non-directory mode -- `parent_ndx` stayed 0 while `dir_flist`
was still empty, so the generator dereferenced a never-written slot.
Companion to CVE-2026-43620; reproduced on released 3.2.7, 3.4.0 and 3.4.1.
Daemon availability and access control:
- CVE-2026-70464 (HIGH): an unauthenticated peer could complete the `@RSYNCD`
greeting and then stall forever -- sending a line with no terminator, or
trickling NUL-terminated arguments into `read_args()` one byte at a time --
holding a per-connection child open past the module's `max connections`
limit. The `timeout` parameter did not cover it, because `set_io_timeout()`
ran after the `read_args()` calls that needed covering. A separate deadline
now spans both, and the early-protocol argument count is bounded. Reported
independently by Chamal De Silva and by Michal Ruprich (Red Hat QE).
- CVE-2026-70455 (HIGH): a daemon client could request an arbitrary Zstandard
worker count via `--compress-threads`; 256 was measured as 257 threads in a
single connection. Now capped at 8 on a daemon, while local and
remote-shell invocations keep the operator's value. Reported, fixed and
tested by Filipe Casal of Trail of Bits, in collaboration with OpenAI.
- CVE-2026-70453 (HIGH): quadratic CPU exhaustion in `hash_search()` from a
crafted chain of equal weak checksums. The chain walk is now bounded. First
reported as a performance problem in public rsync issue #217 by heyciao
(2021); recognised as a security issue, bounded and regression-tested by
Stuart Inglis. This one was already public and was not embargoed.
- CVE-2026-70452 (HIGH): `hosts deny` failed OPEN when a configured hostname
could not be resolved -- with `forward lookup` enabled, which is the default,
an unresolvable deny token admitted the host it was meant to block. It now
fails closed. Sibling of CVE-2026-43617. Reported by Leonid Bugaev.
- CVE-2026-70463 (HIGH): `auth users` ignored its documented comma-only
parsing. With a leading comma the split should be on commas alone, so that a
group name containing a space can be written; it split on whitespace too, so
a `deny` or `:ro` rule naming such a group was broken into two meaningless
tokens and never fired. Reported by Andres Berbescu.
- CVE-2026-70460 (HIGH): a peer-supplied `--partial-dir` or `--backup-dir` was
resolved by pathname, so an in-module symlink could redirect it and place
files outside the daemon's module root. Those paths are now confined.
Reported by Omar Elsayed (seks99x).
Client-side:
- CVE-2026-70462 (MEDIUM): a peer-supplied `MSG_IO_TIMEOUT` defeated the
client's own I/O timeout -- a large value overflowed signed arithmetic, and a
non-positive value disabled the timeout outright. The value is now capped on
receipt and the arithmetic made overflow-safe. Reported by Z3R0S! (z3r0s6);
the non-positive case was reported by Leonid Bugaev.
- CVE-2026-70454 (MEDIUM): `rsync-ssl` established an unauthenticated TLS
connection. In stunnel mode it neither required CA verification nor bound
the certificate to the requested hostname, so an active network attacker
could impersonate the server; the openssl backend had a matching hostname
gap in 3.2.0 through 3.2.3 (found and fixed in 2020 by Matt McCutchen).
stunnel mode now requires certificate verification and hostname binding
unless an explicit insecure opt-out is set, and the GnuTLS backend is
refused conservatively rather than used unverified (Greg Kroah-Hartman).
Robustness hardening (no CVE assigned): the `RSYNC_PROXY` CONNECT request and
proxy response headers are length-bounded, and peer-requested xattr expansion is
capped.
A second-pass source audit (reported by Leonid Bugaev) hardened several memory-
safety and robustness paths: the hashtable and file-list size computations are
guarded against a 32-bit integer overflow that a peer's entry count could
otherwise wrap into an under-allocation, and the
`SIGUSR2` handler is now async-signal-safe (it only sets a flag, deferring the
summary/close-out work to safe poll points). Separately, the xattr/ACL metadata
copy now reads the *source* through a held no-follow fd as well as writing the
destination through one -- closing a parent-symlink race on the `--copy-dest` and
backup source -- and the cross-tree operator-path metadata apply is now fd-pinned
under `--fake-super` too (previously it fell back to a path-based set for a
`fake super = yes` daemon staging through an absolute `--temp-dir`/`--backup-dir`).
SECURITY RELATED:
- Mask a peer-supplied I/O-error value to the defined `IOERR_*` bits, both the
incoming `MSG_IO_ERROR` message (`io.c`) and the file-list trailer (`flist.c`),
so a malicious peer cannot set arbitrary (undefined) error flags that would be
stored in the local `io_error` and re-forwarded upstream. (Undefined bits
never reached the exit code, which maps only the defined bits.) Reported by
Leonid Bugaev.
- Escape control characters in filenames written to the log file (CWE-117 log
injection): a transferred name containing control bytes -- C0 (tab excepted)
and C1 `0x80`-`0x9f`, including CSI `0x9b` -- could otherwise inject terminal
escape sequences into an administrator's terminal when the log is viewed.
Reported by Leonid Bugaev.
- Stop `safe_arg()` leaking an uninitialized byte into a quoted filename. In
filename mode the writer suppresses the escaping backslash before a wildcard,
but the counter that sized the buffer reserved a slot for every backslash, so
the two disagreed and left an uninitialized heap byte in the returned string
-- which is handed to the remote shell when `--protect-args` is off. The
counter now mirrors the writer, and guarding the wildcard test with `f[1]`
also fixes a trailing backslash (previously `strchr()` matched the string
terminator, so the backslash was not doubled). Reported by Leonid Bugaev.
- Close a `--safe-links` bypass in `--backup`: when symlinks can be hard-linked,
`make_backup()`'s link/rename fast path hard-linked an unsafe (out-of-tree)
symlink into the backup area and skipped the `safe_symlinks` check the copy
path applies, silently preserving a link `--safe-links` was meant to drop. The
safe-links check now runs before the fast path, and a symlink whose target is
unreadable is failed closed rather than backed up unchecked. Reported by
Leonid Bugaev.
- Extend the operator-directory ownership walk to the backup leaf sinks:
`do_symlink_at()` (backing a symlink up into an operator `--backup-dir`) and
`do_rmdir_at()` (removing a pre-existing backup directory) now resolve their
parent through the same ownership walk, so a foreign-owned parent symlink no
longer redirects the backup symlink-create or directory-removal outside the
backup tree. `--insecure-links` (or a module's `insecure links = yes`) restores
the legacy follow. Reported by Omar Elsayed (seks99x).
- Confine an absolute operator source/destination through the ownership walk in
`robust_rename()`'s cross-filesystem (EXDEV) copy fallback, so a raced parent
symlink cannot redirect the fallback copy or its source unlink out of the tree.
Reported by Leonid Bugaev.
- Bound the number of equal-weak-checksum blocks examined per offset in
`hash_search()` (issue #217), so a crafted or degenerate checksum set with a
very long equal-checksum chain cannot drive the sender's per-offset
match-verify into a quadratic blow-up (CPU DoS). Fix by Stuart Inglis.
BUG FIXES:
- Fix an off-by-one in `clean_fname()`'s `..`-collapse path normalization.
Reported by Leonid Bugaev.
- The AVX2 rolling-checksum assembly (`--enable-roll-asm`) read up to 64 bytes
past the end of the buffer it was given. The loop is software-pipelined and
preloaded the 64 bytes after the ones it was folding in, so its last iteration
always reached beyond the data -- the remainder is by construction under 64
bytes. It normally landed in slack inside rsync's map window and went
unnoticed; where the buffer ended at a page boundary it was a SIGSEGV mid
transfer, reported on macOS x86-64 by Roland Kletzing. Reported checksums are
unchanged.
- `--link-dest` no longer fails the transfer when the destination refuses to
hard-link a symlink, device node, FIFO or socket. Whether rsync hard-links
those at all was decided at build time, on whatever filesystem the source tree
happened to sit on, and one host can hold both answers -- macOS builds on
APFS, which can, and backs up to HFS+, which returns ENOTSUP. Such an entry
is now copied, exactly as it already is in a build that cannot link them and
as a regular file in the same position already was; the run used to exit 23
even though the entry was then created correctly. The fallback covers any
refusal, since the error does not identify one on its own: link(2) documents
EPERM both for a filesystem without hard links and for a permission refusal.
Still outstanding: under `-H`, a group of such entries hard-linked to each
other also needs a link within the destination, and where the destination
cannot hard-link the type at all, the members after the first are still lost.
- `--out-format` / `--log-file-format` now emit a literal `%` for `%%` instead of
mis-parsing the following character (added by Leonid Bugaev); a follow-up bounds
`log_format_has()`'s width-digit scan to match `log_formatted()`, closing a `%C`
read past the checksum field.
- A CVS `.cvsignore` (or `-C`) file containing a `!` clear-list token no longer
aborts with a spurious "rule has trailing characters" error. Reported by
Leonid Bugaev.
- `--chmod=a+s` now sets both the setuid and setgid bits, matching `chmod(1)`
(it previously set setuid only). Reported by Leonid Bugaev.
- Case-insensitive wildcard matching (used by daemon `hosts allow`/`hosts deny`
rules) now folds characters inside a `[...]` bracket expression, not just
literal pattern characters. Reported by Leonid Bugaev.
BEHAVIOR CHANGES:
- A non-daemon receiver follows an operator-named symlinked destination directory
only when the symlink is owned by root or the running user (e.g. `rsync -a src/
/backup/` where `/backup -> /mnt/disk`); a destination symlinked by another uid
is now refused, closing a chdir TOCTOU where an attacker raced the named
destination into a symlink. `--insecure-links` restores the unconditional
follow.
- On platforms without a race-safe way to create a unix socket in a subdirectory
(the BSDs, macOS, Solaris, which lack `bindat()`), a nested socket transferred
under `--specials` is skipped with a warning instead of failing the whole
transfer. Top-level sockets are unaffected.
- `proxy protocol = true` with no `proxy protocol hosts` rejects all connections
(fail-closed); the daemon now warns about this at startup.
- `support/rrsync` in a restricted subdirectory forces `--no-D` (device/special
semantics are stripped, so a plain `rsync -a` still works) and denies
`--copy-unsafe-links`.
- The path resolver now follows in-tree directory symlinks uniformly on every
platform via a single race-free per-component `O_NOFOLLOW` walk, so `-K` /
`-L` / `-k` and `-R` through an in-tree symlinked parent behave the same
everywhere.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 0381b339dc9da6df7e47930afd91b33839914843
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:39 2026 +0200
postfix: Update to version 3.11.6
- Update from version 3.11.5 to 3.11.6
- No change in rootfile
- Changelog
3.11.6
These defects were found by Qualys assisted by Claude Mythos Preview, and by OpenAI
Security; more than half date from 20 or more years ago. When I implemented Postfix,
I knew that there were going to be mistakes. That is the reason why Postfix has its
architecture and safety nets. The number of defects may seem large, but considering
that they were found in a code base of over 150 thousand lines, the error rate is
still lower than what I designed for.
Policy bypass:
Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP server resets of
MAIL FROM and RCPT TO command state after smtpd_end_of_data_restrictions
rejected a message. This resulted in SMTP protocol state desynchronization
between the remote SMTP client and the Postfix SMTP server.
A crafted remote SMTP client could then send RCPT TO and DATA without MAIL FROM,
and deliver a second message. Then, smtpd_end_of_data_restrictions skipped
check_recipient_access constraints, because a recipient counter was > 1.
Reported by OpenAI Security. File: smtpd/smtpd.c.
As reported by OpenAI Security, the failure to reset MAIL FROM and RCPT TO state
also affected Milter support (added in Postfix 2.3). Here, after a Milter
replied with "accept this message" based on the message envelope, and
smtpd_end_of_data_restrictions rejected the message, the Postfix SMTP server
as before accepted RCPT TO and DATA without MAIL FROM, and
smtpd_end_of_data_restrictions as before skipped check_recipient_access
constraints for the second message. Under these conditions, the Postfix
Milter client remained in the "accept this message" state, skipping Milter
policy enforcement for the second message.
Denial of service:
Bug (defect introduced: Postfix 3.4, date: 20180805): SMTP server command
history memory exhaustion with a large number of very small BDAT requests.
Reported by OpenAI security. File: smtpd.c.
Bug (defect introduced: Postfix 1.1, date: 20021116): address verification cache
poisoning. A local user could use the postdrop command to submit an address
verification probe with envelope or message content that Postfix rejected
later, resulting in a negative address verification cache entry for that
address. On systems that enable address verification, the negative address
verification cache entry would force the Postfix SMTP server to reject a
message that it should accept (denial of service). Problem reported by
OpenAI Security. File: postdrop.c.
Server crashes and panic()s:
Bug (defect introduced: Postfix 3.4, date: 20180805): missing SMTP server reset
of RCPT TO state, after a BDAT command error. A crafted remote SMTP client
could then send a DATA command without MAIL FROM or RCPT TO, and crash a
Postfix SMTP daemon process with a null pointer read error. Reported by
OpenAI Security. File: smtpd/smtpd.c.
Bug (defect introduced: Postfix 2.4, date: 20051222): null pointer read crash
while parsing a malformed Dovecot AUTH server response. Reported by Qualys,
assisted by Claude Mythos Preview. File: xsasl_dovecot_server.c.
Read after free, uninitialized read, under/over read:
Bug (defect introduced: Postfix 2.8, date: 20100914): read-after-free in the
PSC_CALL_BACK_NOTIFY() macro. This had no effect on program execution,
because myfree() wiped memory, and that memory was not yet reused. Problem
reported by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
Read after free (no privilege escalation) in debug logging (defect introduced:
Postfix 2.2, date: 20050117). Reported by Qualys, assisted by Claude Mythos
Preview. File: util/inet_connect.c.
Bug (defect introduced: Postfix 2.10, date: 20120617): uninitialized memory read
in postscreen HaProxy client after remote I/O exception, causing garbage to
be logged. Reported by Qualys, assisted by Claude Mythos Preview.
File: postscreen_haproxy.c.
Latent bug (defect introduced: Postfix 2.7, date: 20090618): uninitialized memory
read after dnsblog(8) returns a string that is not an IPv4 address. Reported
by Qualys, assisted by Claude Mythos Preview. File: postscreen_dnsbl.c.
Bug (defect introduced: before Postfix alpha, date 19970424): the DNS client
could read up to two bytes past the end of an MX record, before discovering
that the record was too short. This behavior was later copied with SRV
records, potentially over-reading up to six bytes. Problem reported by
Qualys, assisted by Claude Mythos Preview. File: dns_lookup.c.
Bug (defect introduced: Postfix 1,1, date: 20010524): the postsuper command
under-read or over-read a very short queue filename. No crash, information
leak, or privilege escalation. Reported by Qualys, assisted by Claude Mythos
Preview. Files: postsuper.c, mail_queue.h.
Other code hygiene:
Bug (defect introduced: before Postfix alpha, date: 19971106): 'int' over-shift,
in the queue file record-length parser. Postfix programs do not generate such
records, but an attacker could cause postdrop to reject input or panic().
Reported by Qualys, assisted by Claude Mythos Preview. File: record.c.
Bug (defect introduced: Postfix 2.2, date: 20050117): non-transitive comparison
of IPv4 addresses. Reported by Qualys, assisted by Claude Mythos Preview.
File: sock_addr.c.
Bug (defect introduced: Postfix 1.0, date: 20000928): the fast flush server, used
by the SMTP command "ETRN", and by the commands "postqueue -s site" and
"postqueue -i queue_id" (and their sendmail(1) equivalents), used the wrong
duplicate suppression API, resulting in unnecessary queue scans by the queue
manager. Reported by Qualys, assisted by Claude Mythos Preview. File: flush.c.
Queue hygiene: the postdrop command accepted the null record type which the rest
of Postfix ignores. Reported by OpenAI Security. File: postdrop.c.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 9a60544dd47948ab0335302dcbb47500a0f2893d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:33 2026 +0200
core205: Ship procps
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit ae09a50943278dc52df8c6cf34f9305a2cd936e0
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:40 2026 +0200
procps: Update to version 4.0.7
- Update from version 4.0.6 to 4.0.7
- Update of rootfile
- Changelog
4.0.7
* library
version: inc revision to 2 now 1:2:0
internal: procps_pids_length off by one issue #412
external: fix slabinfo header extern 'C' declaration issue #415
internal: fix file descriptor leaks in <pids> api issue #421
internal: strv items are now escaped in <pids> api issue #429
internal: fix output if on seconds edge values merge !246 RHEL-60825
* pidof: Add -d aliased option issue #418
* pgrep: Don't treat empty list as 0 issue #427
* pmap: Fix testsuite for Alpha Debian #1141465
* ps: correct 'environ' output when file unavailable
* ps: minimize potential EACCES with 'environ' files issue #431
* top: avoid batch mode segfault with maximum width issue #422
* w: Correctly check for end of tty using utmp issue #430
* watch: Dont remove 2 lines when using -t option issue #413
* watch: Handle resizing better issue #417
* watch: Restore LINES and COLUMNS env variables issue #432
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit ff431b137504a03d3fd6d3c4e8a4929349b91b2c
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:38 2026 +0200
p11-kit: Update to version 0.26.5
- Update from version 0.26.4 to 0.26.5
- Update of rootfile
- 1 CVE fix
- Changelog
0.26.5
* rpc: guard against overflow when decoding nested attributes
(CVE-2026-18938) [PR#777]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 7733229f038a5761a90b569de5d7e1135a456aea
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:36 2026 +0200
libffi: Update to version 3.8.0
- Update from version 3.7.1 to 3.8.0
- Update of rootfile
- Changelog
3.8.0
New features
FFI_TYPE_VECTOR (SIMD) type support with libffi-computed layout, for aarch64 and
x86-64 (#1000, closes #773).
ffi_call_plan_size — report the total memory a reusable call plan owns, for
embedders that account for the memory held by long-lived plans.
powerpc64 ELFv2 _Complex long double support for both IBM-128 (double-double) and
IEEE-128 formats (#1003, closes #1001).
Fixes
powerpc64 big-endian ELFv2 closures returning 5-, 6-, or 7-byte structs: missing
return jump-table entries produced a wrong result and leaked a libffi code
pointer.
ia64 return-value jump-table desync after the FFI_TYPE_LAST bump, which corrupted
small-struct and HFA returns.
powerpc Darwin closure returns broken by #951 (#1002).
i386 FreeBSD/OpenBSD small structs now returned in registers (1, 2, 4, or 8 bytes),
matching the platform ABI and fixing a segfault on struct returns through
ffi_call and closures.
Performance
Cache the static trampoline "unsupported" verdict on hosts whose page size exceeds
the trampoline table mapping, avoiding redundant re-initialization on every
closure allocation (e.g. 64K-page aarch64).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 0f46fd817a0e71111488961c79752f2b5ea10e4b
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:35 2026 +0200
fontconfig: Update to version 2.18.3
- Update from version 2.18.2 to 2.18.3
- No change in rootfile
- Changelog
2.18.3
ci: Add --werror option to the build script
fc-cat: exit with non-zero if not successfully done
Workaround a longstanding use-after-free warning
Fix a null pointer dereference
Add Noto Sans as system-ui for fallback
Drop Noto Sans CJK KR from 60-nonlatin.conf
Correct sat.orth
Add an orth file for Balinese
Update orth files for jv, so, su, tl to use native scripts
Add orth files for scripts used by Noto font families
Update mni.orth to use Meetei Mayek script
Add orth files for Cuneiform languages (akk, sux, hit)
ci: Suppress abidiff false positives for all internal structs
test: Add cache format compatibility tests for orth file additions
Add orth files for ancient scripts (xna, hlu, ecy)
fc-cache: Create backward-compatible cache symlinks for cross-version discovery
ci: Update dependencies
Add implicit rule to update genericfamily property against syntactic-sugar
fc-genconf: Use alias syntactic-sugar instead of the pair of test-edit config
Allow to limit the targeted family for TTC
test: Fix test_genconf.py to avoid unexpected family name in testing conf
ci: Enable -Werror in CI
ci: drop duplicate pipelines
ci: cleanup
ci: gate distro jobs until all tests passed
ci: reduce more duplicate jobs
ci: Update base ci-templates
test: Fix compiler warnings
fc-fontations: Allow unnecessary_transmutes lint in bindgen-generated Rust code
Fix another compiler warnings
ci: Bump FreeBSD version to 14.4
Fix the compiler warnings on MinGW
Update INSTALL
Fix "FileType is deprecated"
Fix unknown type name locale_t on macOS
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit cd1709e57bf04f5b3c90a6c7d8232597dd9d1e2a
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:32 2026 +0200
core205: Ship openssh
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit f5cb6589d5e041ccc0d23d8c2b82bc1e4bc82b0d
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:37 2026 +0200
openssh: Update to version 10.5p1
- Update from version 10.4p1 to 10.5p1
- No change in rootfile
- Changelog
10.5p1
Potentially-incompatible changes
* Portable OpenSSH now requires ECC (Elliptic Curve Cryptography)
support in libcrypto, including support for the NISTP521 curve.
ECC is included in the default build configurations of all
versions of all libcrypto implementations currently supported by
OpenSSH, including LibreSSL, OpenSSL, BoringSSL and AWS LC.
The --without-openssl build configuration is not affected.
Security
* ssh-agent(1): fix an interaction between agent locking and the
session-bind@openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
Reported by sn0x-sharma
* ssh(1): avoid potential realloc use-after-free in the client if a
remote forwarding is added via the local session multiplexing
socket while a remote forwarding open request is pending with the
server. Report and fix from Brian Mingus of Cognatory
* sshd(8): make the authorized_keys "restrict" keyword apply
correctly to tunnel forwarding too (which is administratively
disabled by default). Reported by Erichen, Institute of Computing
Technology, Chinese Academy of Sciences
New features
* ssh-keygen(1): add ability to set or clear the touch-required and
verify-required flags on FIDO private keys when resetting a
private key's passphrase.
* ssh(1): tweak ordering of certificates tried during pubkey
authentication to prefer FIDO keys that do not require user
presence (touch) first, and FIDO keys that require user
verification via PIN or biometrics last. This effectively tries
low-friction authenticators before higher friction ones.
* ssh(1): add a "ssh -Z user@host" mode that prints the keys that
will be tried for public key authentication in the order that
they will be used.
* sshd(8) use setproctitle(3) to identify sshd-session when its
acting as a post-authentication monitor.
Bugfixes
* ssh-keyscan(1): make reading the server banner a non-blocking
operation to prevent a stuck server from blocking a many-host
keyscan from proceeding.
* sshd(8): use sshpkt_fatal() instead of plain fatal() for errors
in the packet code as this provides context of the failing peer
(address, port, user, etc).
* sshd(8): when signing hostkey proofs for a client UpdateHostKeys
request, allow each hostkey to perform at most one signature
operation.
* sshd(8) fix GSSAPI option names, that were broken during a
servconf.c refactoring in openssh-10.4; bz3974.
* ssh-keygen(1): pass back errors from ed25519 key generation, which
theoretically can fail. GHPR702.
* sshd(8): move check of public key type against allowed algorithms
to before parsing of the key sent by the peer. This removes at
least some key parsing and verification paths from the pre-auth
attack surface. Suggested by Christopher Paul Rohlf of Anthropic.
* ssh-keygen(1): fix double frees (impossible to reach outside of a
test harness), and also use freezero where possible. From
Christopher Paul Rohlf at Anthropic.
* sshd(8): fix ChannelTimeout and RekeyLimit not being applied in
sshd_config Match blocks.
* sshd(8): in sshd config dump mode, write all directives in mixed
case for consistency
Portability
* sshd(8): re-allow PAMServiceName inside a Match block, which
was incorrectly disabled during a refactoring in openssh-10.4.
bz3987
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 011f31bf607757575c6ed29680e9aeae90bcdbeb
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:31 2026 +0200
core205: Ship aprutil
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 7a95aa96473ef7ace9f54cb33770bd7daf87eae5
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 15:39:30 2026 +0200
aprutil: Update to version 1.6.5
- Update from version 1.6.3 to 1.6.5
- Update of rootfile
- 5 CVE fixes in 1.6.4
- Changelog
1.6.5
*) Fix oracle DBD compilation errors introduced in 1.6.4. PR 70170.
1.6.4
*) SECURITY: CVE-2026-34502: Heap buffer overflow in APR memcached
client (cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache Portable
Runtime Utility memcached client
This issue affects Apache Portable Runtime Utility: from 1.3.0
through 1.6.3.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-34501: Apache Portable Runtime Utility: Heap
buffer overflow in APR redis client (cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache Portable
Runtime Utility redis client.
This issue affects Apache Portable Runtime Utility: from 1.6.0
through 1.6.3.
Users are recommended to upgrade to version 1.6.4, which fixes
the issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-34191: Apache Portable Runtime Utility: SQL
Injection in apr_dbd_oracle (cve.mitre.org)
Improper Neutralization of Special Elements used in an SQL
Command ('SQL Injection') vulnerability in Apache Portable
Runtime Utility via apr_dbd_oracle provider.
This issue affects Apache Portable Runtime Utility: from 1.6.0
through 1.6.3.
Users are recommended to upgrade to version 1.6.4, which fixes
the issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-32327: Apache Portable Runtime Utility:
apr-util XML stack recursion crash (cve.mitre.org)
A bug in APR-util version 1.6.3 (and earlier) allows a stack
recursion attack against any library consumer which parses XML
from untrusted sources and uses the apr_xml_quote_elem()
function.
Users are recommended to upgrade to version 1.6.4, which fixes
this issue.
Credits: Younghyo Cho @ CISLab, SeoulTech
*) SECURITY: CVE-2025-49506: apr_password_validate() vulnerable to
timing attack (cve.mitre.org)
APR-util versions 1.6.3 (and earlier) function
apr_password_validate() was not constant-time with regards to
hashes or passwords comparisons, potentially leaking their
content via a side channel timing attack particularly on
platforms without crypt() such as Windows, BeOS, NetWare, or
Android.
Users are recommended to upgrade to version 1.6.4, which fixes
this issue.
Credits: Michael Rowley <michael csirt.global>
*) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
avoid producing an empty bucket. PR 64273
[Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
*) apr_brigade: Metadata buckets are now ignored in
apr_brigade_split_line, apr_brigade_flatten and
apr_brigade_to_iovec, fixing possible undefined behaviour. PR 68278
[Ben Kallus <benjamin.p.kallus.gr dartmouth.edu>, Joe Orton]
*) apr_crypto_openssl: Compatibility with OpenSSL 3. [Yann Ylavic]
*) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL
on versions 1.1+. [Graham Leggett]
*) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4.
[Lubos Uhliarik <luhliari redhat.com>]
*) configure: Fix Berkeley DB detection with compilers enforcing
strict C99 compliance. PR 66396.
[Florian Weimer <fweimer redhat.com>]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit ad2b7fb553c498e3fc4e8763ab48ff09bfbb2fb2
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Aug 13 11:53:25 2026 +0200
tshark: Update to version 4.6.8
- Update from version 4.6.7 to 4.6.8
- Update of rootfile
- Fixes for 28 vulnerabilities
- Changelog
4.6.8
Vulnerability Fixes:
wnpa-sec-2026-64 sharkd crash. Issue 21395.
wnpa-sec-2026-65 sharkd crash. Issue 21399.
wnpa-sec-2026-66 UMTS FP protocol dissector crash. Issue 21413.
wnpa-sec-2026-67 RDP protocol dissector crash. Issue 21396.
wnpa-sec-2026-68 TTX Logger file parser crash. Issue 21389.
wnpa-sec-2026-69 Dissection engine reassembly crash. Issue 21423.
wnpa-sec-2026-70 BUSMASTER file parser abnormal exit. Issue 21435.
wnpa-sec-2026-71 Tektronix K12xx file parser crash. Issue 21414.
wnpa-sec-2026-72 ERF file parser crash. Issue 21415.
wnpa-sec-2026-73 Bluetooth Attribute Protocol dissector crash. Issue 21424.
wnpa-sec-2026-74 Catapult DCT2000 file parser crash. Issue 21427.
wnpa-sec-2026-75 C12.22 protocol dissector crash. Issue 21439.
wnpa-sec-2026-76 CMS protocol dissector crash. Issue 21446.
wnpa-sec-2026-77 H.245 protocol dissector crash. Issue 21447.
wnpa-sec-2026-78 Kerberos protocol dissector crash. Issue 21449.
wnpa-sec-2026-79 Bluetooth HFP Profile protocol dissector crash. Issue 21451.
wnpa-sec-2026-80 Bluetooth BR/EDR FHS protocol dissector crash. Issue 21452.
wnpa-sec-2026-81 3gpp phone log file parser crash. Issue 21454.
wnpa-sec-2026-82 Ixia IxVeriWave and Vector Informatik BLF file parser crashes on
Windows. Issue 21455.
wnpa-sec-2026-83 CMS protocol dissector crash. Issue 21457, Issue 21458.
wnpa-sec-2026-84 Pcapng file parser crash. Issue 21460.
wnpa-sec-2026-85 SSH protocol dissector crash. Issue 21465.
wnpa-sec-2026-86 ESS protocol dissector crash. Issue 21467.
wnpa-sec-2026-87 X.509IF protocol dissector crash. Issue 21469. CVE-2026-xxx.
wnpa-sec-2026-88 RRC protocol dissector crash. Issue 21478.
wnpa-sec-2026-89 C12.22 protocol dissector crash. Issue 21480.
wnpa-sec-2026-90 Gammu DCT3 trace file parser crash. Issue 21475.
wnpa-sec-2026-91 Bluetooth AVRCP Profile protocol dissector crash. Issue 21488.
Bugs Fixes:
Fuzz job crash: randpkt-2026-05-22-14496207576.pcap. Issue 21266.
Wireshark Version 4.6.6 - File Capture Properties is excessively slow and hangs
Wireshark on Windows. Issue 21337.
TCP Preference 'Analyze TCP sequence numbers' SEGFAULTs when toggled. Issue 21380.
Wireshark misdecodes S-NSSAI location validity information IE (5G NAS) Issue 21411.
Wireshark misdecodes NSAG information IE (5G NAS) Issue 21412.
Fuzz job UTF-8 encoding issue: fuzz-2026-07-17-15393056954.pcap. Issue 21419.
Wireshark misdecodes UE security capability IE (5G NAS) Issue 21431.
Wireshark misdecodes Registration wait range IE (5G NAS) Issue 21432.
Wireshark misdecodes Extended CAG information IE (5G NAS) Issue 21433.
Stack buffer overflow in K12/RF5 writer. Issue 21436.
Security issues fixed in 4.6.8 and 4.4.18 Tracker. Issue 21437.
BLF writer out-of-bounds read on truncated VLAN-tagged Ethernet frames. Issue 21441.
DLMS/COSEM compact-array TypeDescription recursion bypass can exhaust the stack.
Issue 21442.
packet-knxip: Secure Wrapper size-offset causes NULL deref / SEGV when decrypting.
Issue 21444.
wiretap/rtpdump: swapped caplen/len on truncated samples. Issue 21445.
H.245 returnedFunction nested GenericMessage dereferences NULL packet state.
Issue 21447.
X.509 export-object tap dereferences missing certificate subject. Issue 21448.
Sniffer REC_HEADER2 error path over-reads stack buffer. Issue 21461.
Deep NetLog JSON nesting exhausts the native stack. Issue 21462.
androiddump signed btsnoop length causes global out-of-bounds read. Issue 21464.
ERF writer underflows payload length for tiny truncated packets. Issue 21466.
Wireshark misdecodes SOR transparent container IE (5G NAS) Issue 21472.
Unbounded Daintree timestamp fraction causes signed integer overflow. Issue 21473.
Wireshark misdecodes SOR-CMCI of SOR transparent container IE (5G NAS) Issue 21477.
Wireshark misdecodes Service level AA container (5GSM NAS) Issue 21479.
Updated Protocol Support
ANSI_TCAP, ASN.1 BER, ASTERIX, BT ATT, BT AVRCP, BT BR/EDR RF, BT HFP, C12.22,
CIGI, CMS, COSEM, EBHSCR, ESS, FP, GSM SIM, GTPv2, H.245, Kerberos, KNX/IP,
LBMSRS, NAS-5GS, RELOAD, Rlogin, RRC, SSH, X.509AF, and X.509IF
New and Updated Capture File Support
3gpp phone log, BLF, Busmaster, Catapult DCT2000, Daintree SNA, Endace ERF,
Gammu DCT3, pcapng, RTPDump, Sniffer, Tektronix K12xx, and TTTech
Computertechnik TTL
Plugin Development Changes
On UN*X systems (excluding macOS when running from an app bundle, as with the
official installer) extcap binaries are now searched for under the libexec
directory by default, e.g., /usr/libexec/wireshark/extcap instead of
/usr/lib64/wireshark/extcap or similar. This is the customary place for
helper binaries, which as opposed to libraries do not need multiarch support.
The location can be overridden via the environment variable
WIRESHARK_EXTCAP_DIR. The extcap binaries shipped with Wireshark are
installed in the new location, but third party extcaps may need packaging
changes. This change was effective in version 4.6.0, but was not explicitly
noted in the release notes previously. Note that some distributions do not
use a libexec directory, such as Alpine Linux, which does not have multilib
support. On such systems extcap binaries should be in the same location as
before.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 3579fa98db3741d438169a7316111a081e5a1718
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Wed Aug 12 23:06:04 2026 +0200
core205: Ship expat
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 18fb278a8ab4af96b5348a29e33f5c083d57dc33
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Wed Aug 12 23:06:05 2026 +0200
expat: Update to version 2.8.3
- Update from version 2.8.2 to 2.8.3
- Update of rootfile
- 1 CVE fix
- Changelog
2.8.3
Security fixes:
#1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
infinite loop caused by treating low surrogates (Unicode)
the same as high surrogates in functions *_toUtf16.
Needs Expat compiled with 16bit character support
(e.g. with Firefox and/or on Windows) to be affected.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote, the "AV:L" in NVD by
Mitre is mistaken.)
Original bug report from Mozilla at:
https://bugzilla.mozilla.org/show_bug.cgi?id=2053153
Bug fixes:
#1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2)
#1286 lib: Reject empty version in the XML declaration
#1305 #1306 lib: Fix printf format for AIX
Other changes:
#1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
#1295 CMake|Windows: Add a 64bit MinGW toolchain file
#1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8
#1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later
#1300 Document the current wrap-around issues with functions
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetAttributeInfo
explicitly.
#1303 Address Clang Static Analyzer 22 warning
`core.NullPointerArithm`
#1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
for what these numbers do
Infrastructure:
#1311 CI: Limit workflow runtime and package installation runtime
#1310 CI: Pin Cppcheck version for a robust CI
#1310 CI: Migrate Cppcheck CI from macOS to Linux
#1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
and WASI SDK
#1304 CI: Activate AddressSanitizer for MSVC Windows CI
#1308 CI: Introduce zizmor static analysis for GitHub Actions
#1308 CI: Start using `persist-credentials: false` with Git checkout
#1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions
#1302 #1303 CI: Bump Clang from 21 to 22
#1293 #1294 Update project status for 2026-08
#1301 #1307 Add SPDX license identifiers to the source code
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/common/aprutil | 2 +-
config/rootfiles/common/expat | 20 ++++++++++----------
config/rootfiles/common/libffi | 2 +-
config/rootfiles/common/p11-kit | 2 +-
config/rootfiles/common/procps | 3 ++-
.../{oldcore/114 => core/205}/filelists/aprutil | 0
.../{oldcore/106 => core/205}/filelists/expat | 0
.../{oldcore/100 => core/205}/filelists/openssh | 0
.../{oldcore/103 => core/205}/filelists/procps | 0
.../103 => core/205}/filelists/wpa_supplicant | 0
config/rootfiles/core/205/update.sh | 1 +
config/rootfiles/packages/tshark | 4 ++--
lfs/aprutil | 15 ++++++++++-----
lfs/expat | 4 ++--
lfs/fontconfig | 4 ++--
lfs/libffi | 4 ++--
lfs/openssh | 4 ++--
lfs/p11-kit | 4 ++--
lfs/postfix | 6 +++---
lfs/procps | 4 ++--
lfs/rsync | 6 +++---
lfs/tshark | 6 +++---
lfs/wpa_supplicant | 6 +++---
23 files changed, 52 insertions(+), 45 deletions(-)
copy config/rootfiles/{oldcore/114 => core/205}/filelists/aprutil (100%)
copy config/rootfiles/{oldcore/106 => core/205}/filelists/expat (100%)
copy config/rootfiles/{oldcore/100 => core/205}/filelists/openssh (100%)
copy config/rootfiles/{oldcore/103 => core/205}/filelists/procps (100%)
copy config/rootfiles/{oldcore/103 => core/205}/filelists/wpa_supplicant (100%)
Difference in files:
diff --git a/config/rootfiles/common/aprutil b/config/rootfiles/common/aprutil
index 489616a93..672c5a692 100644
--- a/config/rootfiles/common/aprutil
+++ b/config/rootfiles/common/aprutil
@@ -48,5 +48,5 @@ usr/lib/apr-util-1/apr_dbm_gdbm.so
#usr/lib/libaprutil-1.la
#usr/lib/libaprutil-1.so
usr/lib/libaprutil-1.so.0
-usr/lib/libaprutil-1.so.0.6.3
+usr/lib/libaprutil-1.so.0.6.5
#usr/lib/pkgconfig/apr-util-1.pc
diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat
index 0f15469d3..298882d6e 100644
--- a/config/rootfiles/common/expat
+++ b/config/rootfiles/common/expat
@@ -2,21 +2,21 @@
#usr/include/expat.h
#usr/include/expat_config.h
#usr/include/expat_external.h
-#usr/lib/cmake/expat-2.8.2
-#usr/lib/cmake/expat-2.8.2/expat-config-version.cmake
-#usr/lib/cmake/expat-2.8.2/expat-config.cmake
-#usr/lib/cmake/expat-2.8.2/expat-noconfig.cmake
-#usr/lib/cmake/expat-2.8.2/expat.cmake
+#usr/lib/cmake/expat-2.8.3
+#usr/lib/cmake/expat-2.8.3/expat-config-version.cmake
+#usr/lib/cmake/expat-2.8.3/expat-config.cmake
+#usr/lib/cmake/expat-2.8.3/expat-noconfig.cmake
+#usr/lib/cmake/expat-2.8.3/expat.cmake
#usr/lib/libexpat.la
#usr/lib/libexpat.so
usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.12.2
+usr/lib/libexpat.so.1.12.3
#usr/lib/pkgconfig/expat.pc
#usr/share/doc/expat
-#usr/share/doc/expat-2.8.2
-#usr/share/doc/expat-2.8.2/ok.min.css
-#usr/share/doc/expat-2.8.2/reference.html
-#usr/share/doc/expat-2.8.2/style.css
+#usr/share/doc/expat-2.8.3
+#usr/share/doc/expat-2.8.3/ok.min.css
+#usr/share/doc/expat-2.8.3/reference.html
+#usr/share/doc/expat-2.8.3/style.css
#usr/share/doc/expat/AUTHORS
#usr/share/doc/expat/changelog
#usr/share/man/man1/xmlwf.1
diff --git a/config/rootfiles/common/libffi b/config/rootfiles/common/libffi
index 3282b8113..41cc47b9e 100644
--- a/config/rootfiles/common/libffi
+++ b/config/rootfiles/common/libffi
@@ -4,7 +4,7 @@
#usr/lib/libffi.la
#usr/lib/libffi.so
usr/lib/libffi.so.8
-usr/lib/libffi.so.8.4.1
+usr/lib/libffi.so.8.5.0
#usr/lib/pkgconfig/libffi.pc
#usr/share/info/libffi.info
#usr/share/man/man3/ffi.3
diff --git a/config/rootfiles/common/p11-kit b/config/rootfiles/common/p11-kit
index 879983600..556d49db7 100644
--- a/config/rootfiles/common/p11-kit
+++ b/config/rootfiles/common/p11-kit
@@ -15,7 +15,7 @@ usr/bin/trust
#usr/lib/libp11-kit.la
#usr/lib/libp11-kit.so
usr/lib/libp11-kit.so.0
-usr/lib/libp11-kit.so.0.4.10
+usr/lib/libp11-kit.so.0.4.11
usr/lib/p11-kit-proxy.so
#usr/lib/pkcs11
#usr/lib/pkcs11/p11-kit-client.la
diff --git a/config/rootfiles/common/procps b/config/rootfiles/common/procps
index e19ce02f7..9974c5eb8 100644
--- a/config/rootfiles/common/procps
+++ b/config/rootfiles/common/procps
@@ -3,7 +3,7 @@ bin/ps
#lib/libproc2.la
#lib/libproc2.so
lib/libproc2.so.1
-lib/libproc2.so.1.0.1
+lib/libproc2.so.1.0.2
#lib/pkgconfig
#lib/pkgconfig/libproc2.pc
sbin/sysctl
@@ -53,6 +53,7 @@ usr/bin/watch
#usr/share/man/man1/pgrep.1
#usr/share/man/man1/pidof.1
#usr/share/man/man1/pidwait.1
+#usr/share/man/man1/pkill.1
#usr/share/man/man1/pmap.1
#usr/share/man/man1/ps.1
#usr/share/man/man1/pwdx.1
diff --git a/config/rootfiles/core/205/filelists/aprutil b/config/rootfiles/core/205/filelists/aprutil
new file mode 120000
index 000000000..999f9f84b
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/aprutil
@@ -0,0 +1 @@
+../../../common/aprutil
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/expat b/config/rootfiles/core/205/filelists/expat
new file mode 120000
index 000000000..e1923cf63
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/expat
@@ -0,0 +1 @@
+../../../common/expat
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/openssh b/config/rootfiles/core/205/filelists/openssh
new file mode 120000
index 000000000..d8c77fd8e
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/openssh
@@ -0,0 +1 @@
+../../../common/openssh
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/procps b/config/rootfiles/core/205/filelists/procps
new file mode 120000
index 000000000..e17e8ed70
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/procps
@@ -0,0 +1 @@
+../../../common/procps
\ No newline at end of file
diff --git a/config/rootfiles/core/205/filelists/wpa_supplicant b/config/rootfiles/core/205/filelists/wpa_supplicant
new file mode 120000
index 000000000..1d04c03c0
--- /dev/null
+++ b/config/rootfiles/core/205/filelists/wpa_supplicant
@@ -0,0 +1 @@
+../../../common/wpa_supplicant
\ No newline at end of file
diff --git a/config/rootfiles/core/205/update.sh b/config/rootfiles/core/205/update.sh
index bf0376020..1c4acfbb0 100644
--- a/config/rootfiles/core/205/update.sh
+++ b/config/rootfiles/core/205/update.sh
@@ -62,6 +62,7 @@ gpgconf --kill all
/etc/init.d/knot-resolver restart
/etc/init.d/openvpn-rw restart
/etc/init.d/openvpn-n2n restart
+/etc/init.d/sshd restart
# This update needs a reboot...
touch /var/run/need_reboot
diff --git a/config/rootfiles/packages/tshark b/config/rootfiles/packages/tshark
index 3ade5373d..f81a6f2c8 100644
--- a/config/rootfiles/packages/tshark
+++ b/config/rootfiles/packages/tshark
@@ -11,10 +11,10 @@ usr/bin/dumpcap
usr/bin/tshark
#usr/lib/libwireshark.so
usr/lib/libwireshark.so.19
-usr/lib/libwireshark.so.19.0.7
+usr/lib/libwireshark.so.19.1.8
#usr/lib/libwiretap.so
usr/lib/libwiretap.so.16
-usr/lib/libwiretap.so.16.0.7
+usr/lib/libwiretap.so.16.0.8
#usr/lib/libwsutil.so
usr/lib/libwsutil.so.17
usr/lib/libwsutil.so.17.0.0
diff --git a/lfs/aprutil b/lfs/aprutil
index 556f75a22..39761715c 100644
--- a/lfs/aprutil
+++ b/lfs/aprutil
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -25,7 +25,7 @@
include Config
-VER = 1.6.3
+VER = 1.6.5
THISAPP = apr-util-$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -44,7 +44,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 5eb56c45ba9d87ff3e3769439a3a9a858a1947de68b34892c729f39736fc41117a41c630c3c4cfb07b444c4ee0d5853ec5be158e8fa0b0c0ab89f0cb51cc9c6d
+$(DL_FILE)_BLAKE2 = ee11e45f0029b336c80536f0b98b48f044229d5b9d8669471a1f0641eee8aa6ddbd8f2249ce6116294dc3d3c5b8b939532c366e6208dafe325eeba1db2603300
install : $(TARGET)
@@ -75,8 +75,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
@$(PREBUILD)
@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
- cd $(DIR_APP) && ./configure --prefix=/usr \
- --with-apr=/usr --with-gdbm=/usr --with-openssl=/usr --with-crypto --with-expat=/usr
+ cd $(DIR_APP) && ./configure \
+ --prefix=/usr \
+ --with-apr=/usr \
+ --with-gdbm=/usr \
+ --with-openssl=/usr \
+ --with-crypto \
+ --with-expat=/usr
cd $(DIR_APP) && make $(MAKETUNING)
cd $(DIR_APP) && make install
diff --git a/lfs/expat b/lfs/expat
index 480d98b65..2fb5e7a72 100644
--- a/lfs/expat
+++ b/lfs/expat
@@ -24,7 +24,7 @@
include Config
-VER = 2.8.2
+VER = 2.8.3
THISAPP = expat-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f037cb75f86652fbddd3474f2b7a1293e9b77b540475fa34432a8304ddc58b3eafbab5150a5b591fc4a889d895507b0d379032cdd0c474445ac0aa9e518bef18
+$(DL_FILE)_BLAKE2 = 4dc1173f3458320278b6776aa9342aec4eec3e2e5d8806e52dec59b9a40d5fdad5b8930708bace06a5c9a33fd7451df67c5c822954fa3d7f763babab62989390
install : $(TARGET)
diff --git a/lfs/fontconfig b/lfs/fontconfig
index d4f1f672b..56a662258 100644
--- a/lfs/fontconfig
+++ b/lfs/fontconfig
@@ -24,7 +24,7 @@
include Config
-VER = 2.18.2
+VER = 2.18.3
SUMMARY = Library for configuring and customizing font access
THISAPP = fontconfig-$(VER)
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 537f0f26a13dd967899becb331e303d5ff1d635c64488ca131d0847b2f2a364735f51a0ca9f5cef3e1d7dc7ead9409b1b6d52ad0546bafaeca4a7e46ca86716c
+$(DL_FILE)_BLAKE2 = 33b7d89e7f3d4c43cbd4129e75f9ff2ddd8358aa9e7a9bd72ee72fe64beacbf0ab7e7760c91bc35a77548ffcc367acf7280ea56f002c6d9afa3f0e286831d6b6
install : $(TARGET)
diff --git a/lfs/libffi b/lfs/libffi
index 2cfdbc414..df8f5c3ac 100644
--- a/lfs/libffi
+++ b/lfs/libffi
@@ -24,7 +24,7 @@
include Config
-VER = 3.7.1
+VER = 3.8.0
THISAPP = libffi-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 642741667d55aa2921fc250adea68eafd2519e786199fd2d0463a57ab6e830b51d97a361156bc2761d8c1bfecb9156ddc3147b6f81f4379bc054b98a29675526
+$(DL_FILE)_BLAKE2 = 589f87f79ea637dbddd00db3e320090f17855da5b1669a42b154f1c61bcafd1e8a964738d25b424c95ba5e148565df4b7379800ba42f40149c74d749f4f4b096
install : $(TARGET)
diff --git a/lfs/openssh b/lfs/openssh
index e7acb2058..a792df365 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -24,7 +24,7 @@
include Config
-VER = 10.4p1
+VER = 10.5p1
THISAPP = openssh-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 3051a345fd24333708277a1de781deca9094dd07cc55e613e93715b1266d80d59043bf5cdb2282d02c797cb9446916020e70fbd4c7a2470da7ab98eb612f6b74
+$(DL_FILE)_BLAKE2 = 8e8be4e4aff6b5f16e19f85b994fcc9b7679021cf639fad4323dc15f6bc0041b45370024a5f51065e2a92d965428cf3787323957f2c41f4d27fc1146dc3690cf
install : $(TARGET)
diff --git a/lfs/p11-kit b/lfs/p11-kit
index 1bb7d6feb..91950548c 100644
--- a/lfs/p11-kit
+++ b/lfs/p11-kit
@@ -24,7 +24,7 @@
include Config
-VER = 0.26.4
+VER = 0.26.5
THISAPP = p11-kit-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 91a8ff7679e34dbc9d3143c957ec2bba211da85f74c2aa3d150f3078de9387e1f04b4bbec56040e0c12249c1866e7ca191844c1dcdd6c1de29bec04e6d72ea96
+$(DL_FILE)_BLAKE2 = 3588e4abeca13450c8228b4e104942b459c86fa5bf07fd391b895ff99694e37a20562462fd3e5290dce79a45a16cc821da4ed86d9d4446beb1305d4638421589
install : $(TARGET)
diff --git a/lfs/postfix b/lfs/postfix
index 9584412ad..4ab686707 100644
--- a/lfs/postfix
+++ b/lfs/postfix
@@ -26,7 +26,7 @@ include Config
SUMMARY = A fast, secure, and flexible mailer
-VER = 3.11.5
+VER = 3.11.6
THISAPP = postfix-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = postfix
-PAK_VER = 55
+PAK_VER = 56
DEPS =
@@ -72,7 +72,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = c677014019ce0851e45b103e5d6a88972a10cd3685d4c68b47f6b94ee318b9e81fb017f5b15f4307f3b8c6719afcbba33f4fc1c31a4fb65fe040522d6af38704
+$(DL_FILE)_BLAKE2 = e4a1194fa3f718212413bcee4f61f3c7fe3bd6b0bc6e96a714ca4093e3827350c2eda0e68c5826d865fc9c657e6bcebb0724b99c282c7a85dd877f2207de5075
install : $(TARGET)
diff --git a/lfs/procps b/lfs/procps
index 26aa757f7..abfcdb4f8 100644
--- a/lfs/procps
+++ b/lfs/procps
@@ -24,7 +24,7 @@
include Config
-VER = 4.0.6
+VER = 4.0.7
THISAPP = procps-v$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = dbcbc76f544db055a5921cbe65d917ee7cdf5dae97ee9dc418d3969f68ebfa41e6adebb1369f5b07df5580504bf6881c27e2a8db0241a099b879e15337a8cb03
+$(DL_FILE)_BLAKE2 = efb1a245a8078a12b2de7a129ac66a3b0f5777b676b2bc7682488f995c57a48e24020f337d7beb2cb7161f0bf5e0c263f9ef7acb417ad1f7c90a27c8b9ab4ecd
install : $(TARGET)
diff --git a/lfs/rsync b/lfs/rsync
index 8ba4e11a0..69a2aa469 100644
--- a/lfs/rsync
+++ b/lfs/rsync
@@ -26,7 +26,7 @@ include Config
SUMMARY = Versatile tool for fast incremental file transfer
-VER = 3.4.4
+VER = 3.5.0
THISAPP = rsync-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = rsync
-PAK_VER = 24
+PAK_VER = 25
DEPS = libxxhash
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f4eec8d1077e1cc7eec8cd39dcac4643f7608231f5aa6390cb53104efa1602873a333d9e6cba5d1bb2aeff6c3bf9bccd80370a2105a9cc982b49aae9f39f3bde
+$(DL_FILE)_BLAKE2 = 1a0aaddd9555c14e2b026f4ac9aff0c0b7760a5809fc80c7872b382a0b9b4719dcc0d382c0e43439955efd855ffa2dff101c10a86529b88fd380205cc9506179
install : $(TARGET)
diff --git a/lfs/tshark b/lfs/tshark
index 1965d445e..8cca495bd 100644
--- a/lfs/tshark
+++ b/lfs/tshark
@@ -26,7 +26,7 @@ include Config
SUMMARY = A Network Traffic Analyser
-VER = 4.6.7
+VER = 4.6.8
THISAPP = wireshark-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -35,7 +35,7 @@ DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = tshark
DEPS = c-ares libxxhash
-PAK_VER = 37
+PAK_VER = 38
SERVICES =
@@ -47,7 +47,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 6c9c9201686a80fd855e589b00efa8be0b34771305981206aa58b345c38e1a9094b701e8067fadacf81787d15ebf9839fd9921322c1ab24ac183963094282b89
+$(DL_FILE)_BLAKE2 = 6a7c2407780b7aae8d7091465ecc724e7a042eb38ee1595e0bf038a6a0426b8f072fd09cfc95f6283236ae1e7e2fdac8e77d4509a28e83a2a5e6b5bad01bb59a
install : $(TARGET)
diff --git a/lfs/wpa_supplicant b/lfs/wpa_supplicant
index 38a147619..e9a2d2c13 100644
--- a/lfs/wpa_supplicant
+++ b/lfs/wpa_supplicant
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2025 IPFire Team <info@ipfire.org> #
+# Copyright (C) 2007-2026 IPFire Team <info@ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 2.11
+VER = 2.12
THISAPP = wpa_supplicant-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -41,7 +41,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 71bd0d11cd31eb5bc6beb51caf0f1399856ea188f316d2330053a2d8c81869057811e9f500828e8981eabd0af38f30a18a3ae584d744005c78681c82fa910abf
+$(DL_FILE)_BLAKE2 = 8a0d4d3d28370fe532676c2d02ce98db3861a6895cb73c83fd33bd3707698ead0bb7b4e9ed5a2cc87ea8db61f75b3da5bf548b67bce45b09223263da01d542ec
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-13 14:02 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-13 14:02 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. eacb8e79e56337f516ab02977800af187deb1060 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox