Commit Graph

9554 Commits

Author SHA1 Message Date
Adolf Belka
d28dbdc0c0 qpdf: Update to version 11.9.0
- Update from version 11.7.0 to 11.9.0
- Update of rootfile
- Changelog
    11.9.0
	* Add ENABLE_COVERAGE cmake option to assist with generating
	  coverage reports.
	* From M. Holger: add QPDFObjectHandle::writeJSON to directly
	  write a JSON representation to a pipeline. This is much faster
	  than writing the serialized result of getJSON.
	* The previous fix to #1056 was incomplete. When setting a check
	  box value, the previous fix allowed any value other than /Off to
	  mean checked. Now we also set the actual value based on the
	  allowable non-/Off value in the normal appearance dictionary.
	  Fixes #1056.
	* Add fuzz testing for JSON.
	* Add JSON::getDictItem (from m-holger)
	* Allow --overlay and --underlay to be repeated. They may appear
	  multiple times on the command-line and will be stacked in the
	  order in which they appear. In QPDFJob JSON, the overlay and
	  underlay keys may contain arrays. For compatibility, they may also
	  contain a single dictionary.
	* Add new command-line arguments --file and --range which can be
	  used within --pages in place of positional arguments. Allow --file
	  to be used inside of --overlay and --underlay as well. These new
	  options can be freely intermixed with positional arguments. Also
	  add file(), range(), and password() to QPDFJob::PagesConfig as an
	  alternative to pageSpec.
    11.8.0
	* Bug fix: treat references to older generations of objects as
	  null.
	* When recovering a file's xref table, attempt to find xref
	  streams if a traditional trailer dictionary is not found. Fixes
	  #1103.
	* Add --set-page-labels command-line argument and supporting API.
	  Fixes #939.
		  - QPDFJob::Config::setPageLabels
		  - pdf_page_label_e enumerated type
		  - QPDFPageLabelDocumentHelper::pageLabelDict
	* Support comma-separated numeric values with --collate to select
	  different group sizes from different files. Fixes #505.
	* Support "x" before a group in a numeric range to exclude a group
	  from the previous group. Details are in the manual. Fixes #564,
	  #790.
	* When flattening annotations, preserve annotations without any
	  appearance information at all, such as types /Link, /Popup, and
	  /Projection. Fixes #1039.
	* Detect overlong UTF-8 in the UTF-8 decoder, and fix detection of
	  8-bit characters in erroneous UTF-8 strings.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-03-06 21:34:48 +00:00
Adolf Belka
91aefa33f9 pixman: Update to version 0.43.4
- Update from version 0.43.0 to 0.43.4
- Update of rootfile
- Changelog
    0.43.4
	      Revert the changes to fix the problem in big-endian architectures
	      Allow to build pixman on clang/arm32
	      pixman-arm: Fix build on clang/arm32
	      pixman-x86: Use cpuid.h header
	      pixman-x86: Move #include "cpuid.h" inside conditionals
	      Revert "Allow to build pixman on clang/arm32"
	      pixman-arm: Use unified syntax
    0.43.2
	Note, in the past pixman used a numbering scheme with odd minor number
	numbers for development versions and even minor number for stable
	versions. This is no longer the case, all releases (including this one)
	are stable production versions now.
	      Drop automatic DEBUG define
	      Drop ChangeLog
	      Drop contrib/ci.sh

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-03-06 21:34:21 +00:00
Adolf Belka
730be02c8e pciutils: Update to version 3.11.1
- Update from version 3.10.0 to 3.11.1
- Update of rootfile
- Changelog
    3.11.1
	* Fixed wrong API version in lib/pci.h.
	* Updated README.Windows.
	* Fix compilation on Windows.
    3.11.0
	* update-pciids now supports XZ compression. If libpci is configured
	  with support for compression, all downloaded files are recompressed
	  as gzip. Otherwise they are stored as plain text.
	* update-pciids now sends itself as the User-Agent.
	* Added a pcilmr utility for PCIe lane margining. Thanks to Nikita
	  Proshkin for contributing it.
	* Re-factored access to i386 ports on all relevant platforms.
	* Added i386 port access on OpenBSD.
	* Back-ends for Windows received many bug fixes and improvements.
	* ECAM back-end now scans ACPI and BIOS memory faster.
	* Linux systems without pread/pwrite are no longer supported
	  as they are hopefully long gone. This helps avoid the tricky check
	  for presence of pread which was found to fail on musl libc.
	* Improved decoding of PCIe control and status registers.
	* Decoding of CXL capabilities now supports up to CXL 3.0.
	* lspci now displays interrupt message numbers consistently across
	  different capabilities.
	* Cache of IDs resolved via DNS, which was located in ~/.pci-ids
	  by default, is now stored according to the XDG base directory
	  specification in $XDG_CACHE_HOME/pci-ids.
	* All source files now have SPDX license identifiers.
	* Internal: The "aux" fields of structs pci_access and pci_dev
	  reserved for use by back-ends were renamed to backend_data to better
	  reflect their meaning.
	* As usually, various minor bug fixes and updated pci.ids.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-03-06 21:33:49 +00:00
Adolf Belka
fc22e74b79 pango: Update to version 1.52.0
- Update from version 1.50.13 to 1.52.0
- Update of rootfile
- Changelog
    1.52.0
	- Add pango_font_map_reload_font
	- Improve formatting of font sizes
    1.51.2
	- Build improvements on Windows
	- Use single fontconfig thread
	- Fix problems with spaces at line ends
	- Allow custom fonts on Windows
	- pango-viewer: Fix hint-metrics options
	- Pangofont: Add properties
    1.51.0
	- itemize: Improve script itemization
	- build: Check for cairo DWrite dependency
	- win32: Fix various issues and crashes
	- layout: Add a missing switch case
    1.50.14
	- Fix underline thickness in scaled contexts

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-03-06 21:32:13 +00:00
Adolf Belka
60e990fe3d expat: Update to version 2.6.1
- Update from version 6.2.0 to 6.2.1
- Update of rootfile
- Changelog
    2.6.1 Thu February 29 2024
        Bug fixes:
            #817  Make tests independent of CPU speed, and thus more robust
       #828 #836  Expose billion laughs API with XML_DTD defined and
                    XML_GE undefined, regression from 2.6.0
        Other changes:
            #829  Hide test-only code behind new internal macro
            #833  Autotools: Reject expat_config.h.in defining SIZEOF_VOID_P
            #819  Address compiler warnings
       #832 #834  Version info bumped from 10:0:9 (libexpat*.so.1.9.0)
                    to 10:1:9 (libexpat*.so.1.9.1); see https://verbump.de/
                    for what these numbers do
        Infrastructure:
            #818  CI: Adapt to breaking changes in clang-format

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-03-06 21:31:44 +00:00
Adolf Belka
49ed7f6902 ethtool: Update to version 6.7
- Update from version 6.3 to 6.7
- Update of rootfile not required
- Changelog
	    6.7 - January 29, 2024
		* Feature: support for setting TCP data split
		* Fix: fix new gcc14 warning
		* Fix: fix SFF-8472 transceiver module identification (-m)
		* Misc: code cleanup
	    6.6 - November 23, 2023
		* Feature: support for more CMIS transceiver modules (-m)
		* Fix: fix build on systems with old kernel uapi headers
	    6.5 - September 12, 2023
		* Feature: register dump for hns3 driver (-d)
		* Fix: fix fallback to ioctl for sset (-s)
		* Fix: fix empty slot search in rmgr (-N)
	    6.4 - July 1, 2023
		* Feature: get/set Tx push buffer length (-G)
		* Feature: sff-8636 and cmis: report LOL / LOS / Tx Fault (-m)
		* Fix: fix duplex setting parser (-s)
		* Misc: check and require C11 language standard
		* Misc: clean up obsolete pre-build checks

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-03-06 21:31:06 +00:00
Robin Roevens
bff53f09ff zabbix_agentd: Add OpenVPN certificates items
- Adds Zabbix Agent userparameters `ipfire.ovpn.clientcert` and `ipfire.ovpn.cacert` for the agent to get details about openvpn client, server and ca certificates.
- Moves all `ipfire.ovpn.*` userparameters to a separate config file `userparameter_ovpn.conf` to enable users to selectively disable openvpn items when not needed
- Includes `ipfire_certificate_detail.sh` script in sudoers for Zabbix Agent as it needs root permission to read openvpn certificate details.
- Adapts lfs install script to install new script and configfile
- Adds new script and configfile to rootfiles
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:26:11 +00:00
Robin Roevens
5ef6f1dcae zabbix_agentd: Update to 6.0.27 (LTS)
- Update from version 6.0.22 to 6.0.27
- Update of rootfile not required

Bugs fixed:
- ZBX-23715: Fixed persistent directory path not following symlinks upon creation
- ZBX-22933: Improved vfs.file.regmatch and vfs.file.regexp items to use buffered file read

Full changelogs since 6.0.22:
- https://www.zabbix.com/rn/rn6.0.23
- https://www.zabbix.com/rn/rn6.0.24
- https://www.zabbix.com/rn/rn6.0.25
- https://www.zabbix.com/rn/rn6.0.26
- https://www.zabbix.com/rn/rn6.0.27
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:26:11 +00:00
Adolf Belka
cbc1c00ed9 shadow: Update to version 4.14.5
- Update from version 4.14.3 to 4.14.5
- Update of rootfile not required
- Changelog
    4.14.5
	Build system:
	    Fix regression introduced in 4.14.4, due to a typo. chgpasswd had
	    been deleted from a Makefile variable, but it should have been
	    chpasswd.
    4.14.4
	    Build system:
	        Link correctly with libdl.
	        Install pam configs for chpasswd(8) and newusers(8) when using
	        ./configure --with-libpam --disable-account-tools-setuid.
	    libshadow:
	        Fix build error (parameter name omitted).
	        Fix off-by-one bug.
	        Remove warning.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:24:30 +00:00
Adolf Belka
90ea6fac35 samba: Update to version 4.19.5
- Update from version 4.19.3 to 4.19.5
- Update of rootfile not required
- Changelog
    4.19.5
	   * BUG 13688: Windows 2016 fails to restore previous version of a file from a
	     shadow_copy2 snapshot.
	   * BUG 15549: Symlinks on AIX are broken in 4.19 (and a few version before
	     that).
	   * BUG 12421: Fake directory create times has no effect.
	   * BUG 15550: ctime mixed up with mtime by smbd.
	   * BUG 15548: samba-gpupdate --rsop fails if machine is not in a site.
	   * BUG 15557: gpupdate: The root cert import when NDES is not available is
	     broken.
	   * BUG 15552: samba-gpupdate should print a useful message if cepces-submit
	     can't be found.
	   * BUG 15558: samba-gpupdate logging doesn't work.
	   * BUG 15555: smbpasswd reset permissions only if not 0600.
    4.19.4
	   * BUG 13577: net changesecretpw cannot set the machine account password if
	     secrets.tdb is empty.
	   * BUG 15540: For generating doc, take, if defined, env XML_CATALOG_FILES.
	   * BUG 15541: Trivial C typo in nsswitch/winbind_nss_netbsd.c.
	   * BUG 15542: vfs_linux_xfs is incorrectly named.
	   * BUG 15377: systemd stumbled over copyright-message at smbd startup.
	   * BUG 15505: Following intermediate abolute share-local symlinks is broken.
	   * BUG 15523: ctdb RELEASE_IP causes a crash in release_ip if a connection to
	     a non-public address disconnects first.
	   * BUG 15544: shadow_copy2 broken when current fileset's directories are
	     removed.
	   * BUG 15377: systemd stumbled over copyright-message at smbd startup.
	   * BUG 15523: ctdb RELEASE_IP causes a crash in release_ip if a connection to
	     a non-public address disconnects first.
	   * BUG 15534: smbd does not detect ctdb public ipv6 addresses for multichannel
	     exclusion.
	   * BUG 15469: 'force user = localunixuser' doesn't work if 'allow trusted
	     domains = no' is set.
	   * BUG 15525: smbget debug logging doesn't work.
	   * BUG 15532: smget: username in the smburl and interactive password entry
	     doesn't work.
	   * BUG 15538: smbget auth function doesn't set values for password prompt
	     correctly.
	   * BUG 15523: ctdb RELEASE_IP causes a crash in release_ip if a connection to
	     a non-public address disconnects first.
	   * BUG 15440: Unable to copy and write files from clients to Ceph cluster via
	     SMB Linux gateway with Ceph VFS module.
	   * BUG 15547: Multichannel refresh network information.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:24:23 +00:00
Adolf Belka
272076e3c8 libpng: Update to version 1.6.42
- Update from version 1.4.61 to 1.4.62
- Update of rootfile not required
- Changelog
    1.6.42
	  Fixed the implementation of the macro function png_check_sig().
	    This was an API regression, introduced in libpng-1.6.41.
	    (Reported by Matthieu Darbois)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:23:49 +00:00
Adolf Belka
5fafff021f libgpg-error: Update to version 1.48
- Update from version 1.47 to 1.48
- Update of rootfile
- Changelog
    1.48
	 * New configure option --with-libtool-modification.  [T6619]
	 * New option parser flag to detect commands given without a double
	   dash.  There is also the new meta command "command-mode" to set
	   this flag via a config file.  [T6978]
	 * Added an es_fopen mode flag "sequential" with support on Windows.
	   [rE7a42ff0ec9]
	 * Added an es_fopen mode flag "wipe" to cleanup internal buffers at
	   close time.  [T6954]
	 * New function gpgrt_wipememory.  [T6964]
	 * Improvements to setenv on Windows.  [rE89e53ad90f]
	 * Fixed call to estream-printf string filters.  [T6737]
	 * Many improvements to the yat2m tool.
	 * Updates to the build system.
	 * Interface changes relative to the 1.47 release:
		 ARGPARSE_FLAG_COMMAND          NEW.
		 gpgrt_wipememory               NEW.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:22:57 +00:00
Adolf Belka
f5a2b26bd1 libffi: Update to version 3.4.6
- Update from version 3.4.4 to 3.4.6
- Update of rootfile
- Changelog
    3.4.6
	Fix long double regression on mips64 and alpha.
    3.4.5
	Add support for wasm32.
	Add support for aarch64 branch target identification (bti).
	Add support for ARCv3: ARC32 & ARC64.
	Add support for HPPA64, and many HPPA fixes.
	Add support for Haikuos on PowerPC.
	Fixes for AIX, loongson, MIPS, power, sparc64, and x86 Darwin.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:22:01 +00:00
Adolf Belka
68cf137999 gptfdisk: Update to version 1.0.10
- Update from version 1.0.9 to 1.0.10
- Update of rootfile not required
- Changelog
    1.0.10
	- Fixed problem that caused sgdisk to crash with errors about being unable
	  to read the disk's partition table when compiled with the latest popt
	  (commit 740, which is pre-release as I type; presumably version 1.19 and
	  later once released).
	- Updated guid.cc to deal with minor change in libuuid.
	- Fixed potential NULL derefernce bug in sgdisk. Thanks to Damian Kurek
	  for this fix.
	- The partition number of "0" can now be used to reference newly-created
	  partitions when the --largest-new=0 option to sgdisk is used. Thanks to
	  David Joaquín Shourabi Porcel for this improvement.
	- Make explicit casts in gptcurses.cc to eliminate compiler warnings about
	  mis-matched types in printw() statements.
	- Minor code cleanup based on valgrind analysis.
	- In previous versions, GPT fdisk accepted only integer values for partition
	  start points, end points, and sizes, and it interpreted decimal values
	  incorrectly. That is, if you typed "+9.5G" as the partition end point,
	  you'd end up with something just 9 sectors in size. This version now
	  truncates decimal numbers to their integral values, so you'd get a 9 GiB
	  partition instead.
	- Changes to optimize disk handling, particularly on Windows, courtesy of
	  Frediano Ziglio.
	- Added numerous new partition type codes from Discoverable Partitions
	  Specification
	  (https://uapi-group.org/specifications/specs/discoverable_partitions_specification/).
	- Added new sgdisk -k/--move-backup-table and gdisk k (on the experts' menu)
	  option to relocate the backup partition table. This is the counterpart of
	  the sgdisk -j/--move-main-table and gdisk j (on the experts' menu) option
	  to move the main partition table. This code comes from Niklas Gollenstede.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:21:54 +00:00
Adolf Belka
1087370d52 git: Update to version 2.44.0
- Update from version 2.43.0 to 2.44.0
- Update of rootfile
- Changelog is too large to include here.
   See the files 2.43.1.txt, 2.43.2.txt, 2.43.3.txt & 2.44.0.txt in the source tarball in
    directory Documentation/RelNotes

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-29 10:21:40 +00:00
Michael Tremer
bed265cc5a Merge remote-tracking branch 'ms/wsdd' into next 2024-02-28 16:44:06 +00:00
Arne Fitzenreiter
e56646a748 mpd: fix database path in initskript
i had forgotten this path after moving the database from
/var/ipfire/mpfire to /var/ipfire/mpd

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-25 09:49:10 +01:00
Arne Fitzenreiter
d29916135f mympd: remove mpfire from deps
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-25 02:05:10 +01:00
Arne Fitzenreiter
e3a8147c67 libmpdclient: update to 2.22
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-25 02:03:24 +01:00
Arne Fitzenreiter
5097f72d49 mympd: update to 14.0.3
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-25 02:03:01 +01:00
Arne Fitzenreiter
362bb68620 mpc: update to 0.35
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-25 02:02:27 +01:00
Arne Fitzenreiter
39cd2fff54 mpd: update to 0.23.15
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-24 21:08:06 +01:00
Arne Fitzenreiter
3de42257d0 mpd: move scripts and config from mpfire to mpd
this allows to use mpd without mpfire installed.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-24 16:39:59 +01:00
Peter Müller
7e79a6c92e ca-certificates: Update root CA certificates bundle
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-19 10:17:13 +00:00
Arne Fitzenreiter
7275d72be3 cpufrequtils: hide output on disabled cores.
We disable cores if the are affected by some cpu vulnerabilities
this cores report errors if you try to change the settings.
So only print the output for core0 and hide it for all cores.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-18 11:38:29 +01:00
Peter Müller
5a1b6efa00 libloc: Embed more recent database
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2024-02-17 20:48:10 +00:00
Arne Fitzenreiter
1ec11ba515 rtl8812au: fix module compression
the kernel cannot load the compressed module so fix compression
parameters.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-17 19:46:34 +01:00
Arne Fitzenreiter
d36a58ef6b cpufrequtils: fix initskript for amd-pstate
the initskript loads a test-modul for amd-pstate (which traces on intel)
and off course reports errors if firmware settings are missing.

this also fix the error at start because also amd-pstate doesn't support
ondemand mode.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-16 16:17:47 +01:00
Michael Tremer
407548690c Merge branch 'master' into next 2024-02-16 12:29:05 +00:00
Adolf Belka
c9c9580c4e freeradius: Increment PAK_VER & ship freeradius to link to the updated libssl version
- OpenSSL was updated to 3.1.4 in CU181 and to 3.2.1 in CU183 but in both cases freeradius
   was not incremented to cause it to be shipped.
- This patch increments the freeradius PAK_VER to ensure it will be shipped.

Fixes: Bug#13590
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-16 12:28:55 +00:00
Michael Tremer
c73a75cb70 Merge remote-tracking branch 'origin/next' into next 2024-02-14 19:07:30 +00:00
Michael Tremer
64300f2212 Merge branch 'master' into next 2024-02-14 19:03:52 +00:00
Matthias Fischer
4fb7b18843 unbound: Update to 1.19.1
For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-1

"Bug Fixes

    Fix CVE-2023-50387, DNSSEC verification complexity can be exploited
    to exhaust CPU resources and stall DNS resolvers.
    Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-14 19:00:36 +00:00
Matthias Fischer
de9e44e82d bind: Update to 9.16.48
For details see:
https://downloads.isc.org/isc/bind9/9.16.48/doc/arm/html/notes.html#notes-for-bind-9-16-48

Fixes several CVEs.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-14 18:59:48 +00:00
Arne Fitzenreiter
a4f29a5347 transmission: add menuentry to transmission webgui
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-11 13:33:39 +01:00
Arne Fitzenreiter
761e73230f mympd: update to 14.0.1
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-02-11 11:27:48 +01:00
Michael Tremer
900e1c5722 vim: Don't try to build with custom _FORTIFY_SOURCE
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 14:23:40 +00:00
Michael Tremer
be60a304dd mympd: Don't overwrite our own hardening flags
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 14:23:32 +00:00
Michael Tremer
691a64130f multipath-tools: Don't overwrite our hardening flags
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 14:23:23 +00:00
Arne Fitzenreiter
394405b1dd vdr: add menu entry for vdr website
we had discussed this on december telco but it is not so
easy because our menusystem only shows entry's existing cgi's.
so i add a cgi redirect to http://$ENV{SERVER_ADDR}:3000
this add the entry under pakfire and also to service page.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 12:00:18 +00:00
Michael Tremer
87a0bf6fb2 suricata: Update to 7.0.3
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 11:58:18 +00:00
Adolf Belka
e8972095c6 suricata: Update to version 7.0.2
- Update from version 6.0.15 to 7.0.2
- Update of rootfile
- suricata 7.0.2 requires libhtp >= 0.5.45
   it also requires libelf.so.1 for execution. Previous suricata versions only required
   libelf for building. libelf or elfutils are not mentioned anywhere in the changelog
- Without elfutils available during starting then suricata fails to start due to
   libelf.so.1 not being available.
- Tested out suricata7 with elfutils on my vm testbed and it successfully started.
- The suricata-5.0.8 patch has been removed as it got applied to configure.ac but this
   is not available in suricata-7.0.2. It looks like that patch was never actually used in
   suricata as all the builds I checked used the configure file from the source tarball
   and the configure was never created by running autoconf on the configure.ac
- Changelog is too large to include here. Details can be found in the ChangeLog file in
   the source tarball

Fixes: Bug#13516
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 11:56:23 +00:00
Matthias Fischer
bb25f15cf9 clamav: Update to 1.3.0
For details see:
https://blog.clamav.net/2023/11/clamav-130-122-105-released.html

Excerpts from changelog:

"Major changes

    Added support for extracting and scanning attachments found in
    Microsoft OneNote section files. OneNote parsing will be enabled by
    default, but may be optionally disabled using one of the following
    options:
    a. The clamscan command line option: --scan-onenote=no,
    b. The clamd.conf config option: ScanOneNote no,
    c. The libclamav scan option options.parse &= ~CL_SCAN_PARSE_ONENOTE;,
    d. A signature change to the daily.cfg dynamic configuration (DCONF).

Other improvements

    Fixed issue when building ClamAV on the Haiku (BeOS-like) operating
    system. Patch courtesy of Luca D'Amico

    ClamD: When starting, ClamD will now check if the directory specified
    by TemporaryDirectory in clamd.conf exists. If it doesn't, ClamD will
    print an error message and will exit with exit code 1. Patch courtesy
    of Andrew Kiggins.

    CMake: If configured to build static libraries, CMake will now also
    install the libclamav_rust, libclammspack, libclamunrar_iface, and
    libclamunrar static libraries required by libclamav.
    Note: These libraries are all linked into the clamscan, clamd, sigtool,
    and freshclam programs, which is why they did not need to be installed
    to function. However, these libraries would be required if you wish to
    build some other program that uses the libclamav static library.
    Added file type recognition for compiled Python (`.pyc`) files.

      The file type appears as a string parameter for these callback
      functions:

      - clcb_pre_cache
      - clcb_pre_scan
      - clcb_file_inspection

      When scanning a `.pyc` file, the `type` parameter will now show

      "CL_TYPE_PYTHON_COMPILED" instead of "CL_TYPE_BINARY_DATA".

    Improved support for decrypting PDFs with empty passwords.

    Assorted minor improvements and typo fixes.

Bug fixes

    Fixed a warning when scanning some HTML files.

    Fixed an issue decrypting some PDF's with an empty password.

    ClamOnAcc: Fixed an infinite loop when a watched directory does not
    exist.

    ClamOnAcc: Fixed an infinite loop when a file has been deleted before a
    scan.
    Patch courtesy of gsuehiro.

    Fixed a possible crash when processing VBA files on HP-UX/IA 64bit.
    Patch courtesy of Albert Chin-A-Young.

    ClamConf: Fixed an issue printing `MaxScanSize` introduced with the
    change to allow a `MaxScanSize` greater than 4 GB.
    Fix courtesy of teoberi.

    Fixed an issue building a ClamAV RPM in some configurations.
    The issue was caused by faulty CMake logic that intended to create an
    empty database directory during the installation."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 11:52:39 +00:00
Michael Tremer
f4b059a771 glibc: Update to 2.39
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 11:50:54 +00:00
Michael Tremer
e56ca17e9b binutils: Update to 2.42
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 11:48:19 +00:00
Michael Tremer
c4fd8911d3 ipfire-netboot: Update iPXE to version 0cc0f47
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-10 11:48:07 +00:00
Michael Tremer
fced111d30 libhtp: Update to 0.5.46
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-09 11:33:23 +00:00
Michael Tremer
ef387142af suricata: Update to 6.0.16
https://redmine.openinfosecfoundation.org/versions/201

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-09 11:30:38 +00:00
Matthias Fischer
8c2109bc21 squid: Update to 6.7
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>

For details see:
https://github.com/squid-cache/squid/commits/v6

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-09 11:25:40 +00:00
Adolf Belka
49b8893ff5 expat: Update to version 2.6.0
- Update from version 2.5.0 to 2.6.0
- Update of rootfile
- This update fixes two CVE's. Not sure if IPFire would be vulnerable or not but safer
   to update anyway.
- Changelog
    2.6.0
        Security fixes:
	      #789 #814  CVE-2023-52425 -- Fix quadratic runtime issues with big tokens
	                   that can cause denial of service, in partial where
	                   dealing with compressed XML input.  Applications
	                   that parsed a document in one go -- a single call to
	                   functions XML_Parse or XML_ParseBuffer -- were not affected.
	                   The smaller the chunks/buffers you use for parsing
	                   previously, the bigger the problem prior to the fix.
	                   Backporters should be careful to no omit parts of
	                   pull request #789 and to include earlier pull request #771,
	                   in order to not break the fix.
	           #777  CVE-2023-52426 -- Fix billion laughs attacks for users
	                   compiling *without* XML_DTD defined (which is not common).
	                   Users with XML_DTD defined have been protected since
	                   Expat >=2.4.0 (and that was CVE-2013-0340 back then).
        Bug fixes:
	            #753  Fix parse-size-dependent "invalid token" error for
	                    external entities that start with a byte order mark
	            #780  Fix NULL pointer dereference in setContext via
	                    XML_ExternalEntityParserCreate for compilation with
	                    XML_DTD undefined
	       #812 #813  Protect against closing entities out of order
        Other changes:
	            #723  Improve support for arc4random/arc4random_buf
	       #771 #788  Improve buffer growth in XML_GetBuffer and XML_Parse
	       #761 #770  xmlwf: Support --help and --version
	       #759 #770  xmlwf: Support custom buffer size for XML_GetBuffer and read
	            #744  xmlwf: Improve language and URL clickability in help output
	            #673  examples: Add new example "element_declarations.c"
	            #764  Be stricter about macro XML_CONTEXT_BYTES at build time
	            #765  Make inclusion to expat_config.h consistent
	       #726 #727  Autotools: configure.ac: Support --disable-maintainer-mode
	    #678 #705 ..
	  #706 #733 #792  Autotools: Sync CMake templates with CMake 3.26
	            #795  Autotools: Make installation of shipped man page doc/xmlwf.1
	                    independent of docbook2man availability
	            #815  Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
	                    section "Cflags.private" in order to fix compilation
	                    against static libexpat using pkg-config on Windows
	       #724 #751  Autotools|CMake: Require a C99 compiler
	                    (a de-facto requirement already since Expat 2.2.2 of 2017)
	            #793  Autotools|CMake: Fix PACKAGE_BUGREPORT variable
	       #750 #786  Autotools|CMake: Make test suite require a C++11 compiler
	            #749  CMake: Require CMake >=3.5.0
	            #672  CMake: Lowercase off_t and size_t to help a bug in Meson
	            #746  CMake: Sort xmlwf sources alphabetically
	            #785  CMake|Windows: Fix generation of DLL file version info
	            #790  CMake: Build tests/benchmark/benchmark.c as well for
	                    a build with -DEXPAT_BUILD_TESTS=ON
	       #745 #757  docs: Document the importance of isFinal + adjust tests
	                    accordingly
	            #736  docs: Improve use of "NULL" and "null"
	            #713  docs: Be specific about version of XML (XML 1.0r4)
	                    and version of C (C99); (XML 1.0r5 will need a sponsor.)
	            #762  docs: reference.html: Promote function XML_ParseBuffer more
	            #779  docs: reference.html: Add HTML anchors to XML_* macros
	            #760  docs: reference.html: Upgrade to OK.css 1.2.0
	       #763 #739  docs: Fix typos
	            #696  docs|CI: Use HTTPS URLs instead of HTTP at various places
	    #669 #670 ..
	    #692 #703 ..
	       #733 #772  Address compiler warnings
	       #798 #800  Address clang-tidy warnings
	       #775 #776  Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
	                    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
	                    for what these numbers do
        Infrastructure:
	       #700 #701  docs: Document security policy in file SECURITY.md
	            #766  docs: Improve parse buffer variables in-code documentation
	    #674 #738 ..
	    #740 #747 ..
	  #748 #781 #782  Refactor coverage and conformance tests
	       #714 #716  Refactor debug level variables to unsigned long
	            #671  Improve handling of empty environment variable value
	                    in function getDebugLevel (without visible user effect)
	    #755 #774 ..
	    #758 #783 ..
	       #784 #787  tests: Improve test coverage with regard to parse chunk size
	  #660 #797 #801  Fuzzing: Improve fuzzing coverage
	       #367 #799  Fuzzing|CI: Start running OSS-Fuzz fuzzing regression tests
	       #698 #721  CI: Resolve some Travis CI leftovers
	            #669  CI: Be robust towards absence of Git tags
	       #693 #694  CI: Set permissions to "contents: read" for security
	            #709  CI: Pin all GitHub Actions to specific commits for security
	            #739  CI: Reject spelling errors using codespell
	            #798  CI: Enforce clang-tidy clean code
	    #773 #808 ..
	       #809 #810  CI: Upgrade Clang from 15 to 18
	            #796  CI: Start using Clang's Control Flow Integrity sanitizer
	  #675 #720 #722  CI: Adapt to breaking changes in GitHub Actions Ubuntu images
	            #689  CI: Adapt to breaking changes in Clang/LLVM Debian packaging
	            #763  CI: Adapt to breaking changes in codespell
	            #803  CI: Adapt to breaking changes in Cppcheck

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-09 11:24:59 +00:00