Description for quiz

Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
Add python3
2026-04-02 15:44:42 +08:00 · 2026-04-01 13:52:31 +08:00 · 2026-04-01 13:50:14 +08:00 · 2026-04-01 13:47:32 +08:00 · 2026-04-01 13:45:53 +08:00 · 2026-04-01 13:42:46 +08:00
35 changed files with 1485 additions and 102 deletions
@@ -1,3 +1,10 @@
+2026.02, released March 4th, 2026
+
+	Various fixes.
+
+	Updated/fixed packages: freerdp, graphicsmagick, ruby, nsquid,
+	vim
+
 2026.02-rc3, released March 2nd, 2026

 	Fixes all over the tree.
@@ -92,9 +92,9 @@ all:
 .PHONY: all

 # Set and export the version string
-export BR2_VERSION := 2026.02-rc3
+export BR2_VERSION := 2026.02
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1772450000
+BR2_VERSION_EPOCH = 1772611600

 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -0,0 +1,272 @@
+学习完 [《从零开始为 RISC-V 构建一个 Linux 系统》][1] 后的小测试
+----
+
+FIXME：这个 buildroot 仓库（包括本文件）目前放在 openruyi.cn 上，后继是否也放到 https://github.com/openRuyi-Tutorials 下去？
+
+<!-- TOC -->
+
+- [1. 测试任务概述](#1-测试任务概述)
+- [2. 任务提交方式](#2-任务提交方式)
+- [3. 测试任务描述](#3-测试任务描述)
+	- [3.1. 任务 1](#31-任务-1)
+	- [3.2. 任务 2](#32-任务-2)
+	- [3.3. 任务 3](#33-任务-3)
+	- [3.4. 任务 4](#34-任务-4)
+	- [3.5. 任务 5](#35-任务-5)
+- [4. 联系方式](#4-联系方式)
+
+<!-- /TOC -->
+
+# 1. 测试任务概述
+
+慕课 《从零开始为 RISC-V 构建一个 Linux 系统》（下文简称 MOOC）为课程提供了配套的构建脚本，代码仓库在：<https://github.com/openRuyi-Tutorials/build-linux-system-from-scratch>。这套构建脚本参考了 [Buildroot][2]，具体对应的是 tag 版本为 2025.08.1 的代码。（FIXME: 用 github 的考虑是方便学生 fork，openruyi 的仓库我不知道是否合适面向所有学生建账号。）
+
+设计测验如下，供评估学习效果参考。
+
+测验总分 100 分，分为五个任务，参与考评的同学可任意选择其中的一个或者多个任务。所谓前置任务是指在完成本任务前必须要完成的任务项。
+
+| 任务号 | 满分 | 前置任务 |
+|--------|------|----------|
+| 任务 1 | 60   | 无       |
+| 任务 2 | 10   | 任务 1   |
+| 任务 3 | 15   | 任务 1   |
+| 任务 4 | 10   | 任务 1   |
+| 任务 5 | 5    | 无       |
+
+# 2. 任务提交方式
+
+  为了避免同时申请测试的实习生之间互相参考，请 **不要通过 PR（Pull Request） 方式提交你的改动**，而是采用邮件方式提交你的改动。具体提交方式如下：
+
+  - 在 Github 上 fork MOOC 仓库 <https://github.com/openRuyi-Tutorials/build-linux-system-from-scratch> 到自己的私有仓库。
+  - 在自己的私有仓库上 checkout 开发分支
+  - 将自己的改动提交到自己的开发分支上。假设您的 github userid 是 AAA，开发分支是 BBB，那么应该会得到一个对应开发分支的 URL：<https://github.com/AAA/build-linux-system-from-scratch/tree/BBB>。
+  - 提交人员通过邮件将该开发分支的 URL 发送给 “我”（联系方式见文末）。
+  - 每个任务单独一封邮件，请在邮件标题中加上 “[MOOC QUIZ TASK X]” 的前缀，X 为具体的任务号（“1”，“2” ...）。
+  - 每个任务单独对应一个开发分支，具体要求见各个任务的描述。开发分支的取名建议加上类似 “taskX-” (X 为具体的任务号 “1”，“2” ...) 的前缀以示区分。
+
+# 3. 测试任务描述
+
+## 3.1. 任务 1
+  
+- 任务描述：仔细阅读 MOOC 仓库 <https://github.com/openRuyi-Tutorials/build-linux-system-from-scratch> 的构建脚本，基于该仓库的代码将 MOOC 的构建脚本中涉及的软件包的版本升级到和 Buildroot 的 tag 版本 2026.02 使用的软件包版本对齐。
+
+  关于 Buildroot 的构建，可以参考我们这里自己 mirror 的一个 Buildroot 仓库以及测验专用分支 <https://git.openruyi.cn/openRuyi-tutorials/buildroot/src/branch/quiz-mooc/>。构建方法如下，注意确保本地已经安装了 qemu-system-riscv64，版本建议至少 8.2.2 以上。构建配置采用修改过的 `qemu_riscv64_virt_defconfig`，具体的配置修改内容可以参阅 quiz-mooc 分支的 commit 历史。
+
+  ```shell
+  $ git clone https://git.openruyi.cn/openRuyi-tutorials/buildroot.git
+  $ cd buildroot
+  $ git checkout quiz-mooc
+  $ make qemu_riscv64_virt_defconfig
+  $ ./output/images/start-qemu.sh --use-system-qemu
+  ```
+
+  大致需要升级如下软件包：
+
+  - 升级 coreutils 到 9.10
+  - 升级 e2fsprogs 到 1.47.3
+  - 升级 expat 到 2.7.4
+  - 升级 fakeroot 到 1.37.1.2
+  - 升级 libzlib 到  1.3.2
+  - 升级 libxcrypt 到 4.5.2
+  - 升级 linux 到 6.19.5
+  - 升级 m4 到 1.4.21
+  - 升级 ncurses 到 6.6-20251231
+  - 升级 python3 到 3.14.3
+  - 升级 util-linux 到 2.41.3
+  - 升级 vim 到 9.1.2148
+  - 新增 libopenssl 3.6.1
+
+  为简化任务要求，升级过程中针对原 MOOC 构建做如下简化工作：
+  
+  - 取消从源码自己构建交叉工具链，直接使用 Buildroot 预先制作的交叉工具链，具体下载的交叉工具链版本可以参考 Buildroot 的代码。
+  - 和 MOOC 类似，不从源码构建 QEMU，而是使用本地自己安装的 QEMU（建议版本在 8.2.2 及以上）
+
+- 任务检验标准：
+
+  对于提交的构建代码内容的具体要求如下：
+  
+  - 提交时请基于 main 分支拉出自己的开发分支并进行 commit，不要在 main 分支上直接提交 commit。
+  - 改动请基于 MOOC 仓库的 main 分支开发，尽量复用原有逻辑和框架而不要完全自己从头写一套，同时也不是将 Buildroot 的构建框架和脚本直接拿来使用。正常情况如果只是软件包升级应该不会涉及大的框架性改动，但如果的确发现现有代码框架无法支持新代码升级的请及时和 “我” 联系（联系方式见文末）。如果是发现原有代码有 bug 或者有需要做优化的请移步 “任务 5”。其他的额外改动需说明的请在邮件中解释。
+  - 为了方便 review，如果修改涉及独立的功能，以及不同模块或者不同软件包的，建议每个修改一个 commit，不要将所有改动作为一个 commit 整体提交。
+  - 在 commit 的描述中给出简单的修改说明，中英文皆可。简单的话一句话即可，不用重复代码的修改细节，所有的修改说明的出发点是侧重于阐述修改的原因，思路以及除了代码外需要额外说明的部分。
+  - 注意代码风格，特别是代码缩进等。代码整洁，不要合入临时代码、临时测试用代码以及无效的注释等垃圾代码。
+
+  除了代码提交外，对于结果的检验要求如下：和 MOOC 课程代码类似，执行代码仓库中的 `make` 命令后可以完整地从零开始构建一个系统，上述需要升级和新增的软件包都构建无误。同样执行 `start-qemu.sh` 脚本可以在 QEMU 中启动系统。登录进入系统后验证软件工作正常，包括：
+  
+  - 检查 SysV 是否正常工作，检查方法：
+
+    查看 SysV 版本:
+    ```shell
+    # init --version
+    SysV init version: 3.14
+    ```
+
+    尝试关机：
+    ```shell
+    # init 0
+    ```
+
+    尝试重启：
+    ```shell
+    # init 6
+    ```
+
+  - 检查当前 Shell 是否是 bash，检查方法：
+
+    ```shell
+    # echo $SHELL
+    /bin/bash
+    ```
+
+    执行 `bash --version` 能够输出 bash 的版本信息和版权信息如下：
+
+    ```shell
+    # bash --version
+    GNU bash, version 5.2.37(1)-release (riscv64-buildroot-linux-gnu)
+    Copyright (C) 2022 Free Software Foundation, Inc.
+    License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
+    
+    This is free software; you are free to change and redistribute it.
+    There is NO WARRANTY, to the extent permitted by law.
+    ```
+
+  - 检查 coreutils 工作正常，检查方法：
+
+    ```shell
+    # ls --help
+    Usage: ls [OPTION]... [FILE]...
+    [...... 省略]
+    Report bugs to: bug-coreutils@gnu.org
+    GNU coreutils home page: <https://www.gnu.org/software/coreutils/>
+    General help using GNU software: <https://www.gnu.org/gethelp/>
+    Report any translation bugs to <https://translationproject.org/team/>
+    Full documentation <https://www.gnu.org/software/coreutils/ls>
+    or available locally via: info '(coreutils) ls invocation'
+    ```
+    
+    应该会看到输出中最后会出现 "GNU coreutils" 字样。
+
+  - 检查 vi/vim 工作正常。检查方法：
+
+    ```shell
+    # vi
+    ```
+
+    或者
+
+    ```shell
+    # vim
+    ```
+
+    应该进入 vim 欢迎界面，并看到 "VIM - Vi IMproved" 字样。并能正常使用 vi 编辑和退出。
+
+  - 检查 Python3 工作正常。检查方法：
+
+    ```shell
+    # python3
+    Python 3.14.3 (main, Apr  1 2026, 14:14:37) [GCC 15.1.0] on linux
+    Type "help", "copyright", "credits" or "license" for more information.
+    >>>
+    ```
+
+    可以进入 Python 控制台，输入 `quit()` 可以退出 Python 控制台。
+
+    可以运行 snake 游戏。
+
+    ```shell
+    # python3 /usr/games/snake.py
+    ```
+
+## 3.2. 任务 2
+
+- 任务描述：在 “任务 1” 完成的基础上为 MOOC 的文件系统添加一个软件包，软件包的范围局限于 Buildroot 已支持的软件包（menuconfig 中 “Target packages” 中所列出的软件包，注意新添加的软件包不要包括 “Package managers” 和 systemd）。另外注意按照 Buildroot 的风格以及 MOOC 的风格，该软件包的构建依赖和运行依赖尽量不要对 host 的原有 native 环境有依赖，也就是说除了少部分 native 环境中的 pre-installed 软件外，所有的该软件包的构建依赖和运行依赖都需要我们自己从源码开始构建和安装到 host 和 target 中。
+
+- 任务检验标准：
+
+  对于提交的构建代码内容的具体要求
+
+  - 改动请基于您提交的 “任务 1” 的开发分支再拉一个针对 “任务 2” 的开发分支并在这个新的开发分支上 commit。
+  - 请在邮件中给出新增软件包的简单说明。
+  - 请在邮件中给出新增软件包的运行和测试说明。
+  - 其他要求和 “任务 1” 类似。
+  
+  对于结果的检验要求：
+  - 不影响 “任务 1” 的构建，以及运行和测试结果。
+  - 满足邮件中所列出的新增软件包的运行和测试说明。
+
+## 3.3. 任务 3
+
+- 任务描述：在 “任务 1” 完成的基础上为 MOOC 的文件系统添加 systemd 软件包。systemd 的版本以及其构建依赖和运行依赖的软件包的版本需要和 Buildroot 的 tag 版本 2026.02 使用的软件包版本对齐。注意按照 Buildroot 的风格以及 MOOC 的风格，该软件包的构建依赖和运行依赖尽量不要对 host 的原有 native 环境有依赖，也就是说除了少部分 native 环境中的 pre-installed 软件外，所有的该软件包的构建依赖和运行依赖都需要我们自己从源码开始构建和安装到 host 和 target 中。（注：可以参考 Buildroot 的做法）。
+
+- 任务检验标准：
+
+  对于提交的构建代码内容的具体要求：
+
+  - 改动请基于您提交的 “任务 1” 的开发分支再拉一个针对 “任务 3” 的开发分支并在这个新的开发分支上 commit。
+  - 其他要求和 “任务 1” 类似。
+  
+  对于结果的检验要求：
+  
+  - 不影响 “任务 1” 的构建，以及运行和测试结果。
+  - 启动系统，其中过程中应该看到 systemd 的正常输出。
+  - 登录进入系统后验证 systemd 软件工作正常，方法如下：
+
+    ```shell
+    systemctl status
+    ```
+
+    应显示 "State: running" 并返回了系统状态摘要，说明 systemd 基本可用。
+
+    尝试 stop 然后再 start 一个服务，stop 后查看服务状态应该为 inactive；start 后查看服务状态应该为 running。以 udevd 服务为例：
+
+    ```shell
+    systemctl status systemd-udevd
+    systemctl stop systemd-udevd
+    systemctl status systemd-udevd
+    systemctl start systemd-udevd
+    systemctl status systemd-udevd
+    ```
+
+## 3.4. 任务 4
+
+- 任务描述：在 “任务 3” 完成的基础上为 MOOC 的文件系统添加 简介：microdnf 软件包。注意按照 Buildroot 的风格以及 MOOC 的风格，该软件包的构建依赖和运行依赖尽量不要对 host 的原有 native 环境有依赖，也就是说除了少部分 native 环境中的 pre-installed 软件外，所有的该软件包的构建依赖和运行依赖都需要我们自己从源码开始构建和安装到 host 和 target 中。
+
+  microdnf 简介：microdnf 是一个用 C 语言编写的轻量级包管理器，可以看作是 dnf 的精简版实现。它专为容器和最小化环境设计，旨在以极小的开销完成基本的软件包管理任务。microdnf 的官方网站和源码托管在 GitHub 上，具体地址是：<https://github.com/rpm-software-management/microdnf>。
+
+- 任务检验标准
+
+  对于提交的构建代码内容的具体要求：
+
+  - 改动请基于您提交的 “任务 1” 的开发分支再拉一个针对 “任务 4” 的开发分支并在这个新的开发分支上 commit。
+  - 其他要求和 “任务 1” 类似。
+  
+  对于结果的检验要求：
+  
+  - 不影响 “任务 1” 的构建，以及运行和测试结果。
+  - 登录进入系统后验证软件 microdnf 工作正常，并且可以用它从 openRuyi 的软件源（FIXME：这个我建议放在开发用的源上，并且为了避免安装过程中发生冲突，可以指定一个简单的软件包，譬如就安装一个 hello world 的可执行程序，尽可能无依赖，确保安装成功即可）下载并安装软件包 。
+
+## 3.5. 任务 5
+
+- 任务描述：为原 MOOC 代码仓库找 bug 或者提出改进建议。
+
+- 任务检验标准
+  
+  对于提交的构建代码内容的具体要求：
+
+  - 改动请基于 MOOC 仓库的 main 分支拉出新的开发分支并在上面 commit。
+  - 如果涉及多个 bug fix 或者多个改进点，请每个 bugfix 和每个改进点单独一个 commit。不要混在一起，方便 review。
+  - 在 commit 消息中或者在邮件中对修改进行正确的说明。
+    - Bug fix 要说清楚可复现的 bug 现象以及解决思路。
+    - 改进建议要说清楚改进的理由和改进方案。
+  
+  对于结果的检验要求：Bug fix 和改进建议只要被上游接受均可视为完成 “任务 5”。注意对于 “改进建议”，不要提出超过目前课程范围内的改进建议，譬如新增软件包或者提升软件包版本这种，因为 MOOC 的课程内容目前暂时告一段落。“任务 5” 中的改进建议更多的指的是针对现有 MOOC 构建脚本的一些优化措施。
+
+# 4. 联系方式
+
+测试过程中有任何问题可以联系 “我”：
+
+- 联系人：汪辰
+- 联系方式（邮件）：wangchen20@iscas.ac.cn
+
+[1]: https://github.com/openRuyi-Tutorials/build-linux-system-from-scratch/blob/main/README.md
+[2]: https://buildroot.org/
@@ -1,2 +1,5 @@
 # Locally calculated
 sha256  ea59fbfb702857a24f96ee8e9cf04f997942db1de98f8406b7daf9dcc8f4e9ea  xlnx_rebase_v2.12_2025.2.tar.gz
+
+# Locally calculated
+sha256  b2c79635797bafcde84c6edadadde290b9d5e05deb3ea16a847210fd2ca83669  docs/license.rst
@@ -1,2 +1,7 @@
 # Locally calculated
 sha256  444f573cd4438af1f5062fd69fcc82965a56068e6a25cd43c062a68398f90b03  xlnx_rebase_v6.12_LTS_merge_6.12.60.tar.gz
+
+# Locally calculated
+sha256  fb5a425bd3b3cd6071a3a9aff9909a859e7c1158d54d32e07658398cd67eb6a0  COPYING
+sha256  f6b78c087c3ebdf0f3c13415070dd480a3f35d8fc76f3d02180a407c1c812f79  LICENSES/preferred/GPL-2.0
+sha256  8e378ab93586eb55135d3bc119cce787f7324f48394777d00c34fa3d0be3303f  LICENSES/exceptions/Linux-syscall-note
@@ -1,18 +1,26 @@
 BR2_riscv=y
-BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_6_18=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_KERNEL_MIRROR="http://mirrors.ustc.edu.cn/kernel.org"
+BR2_GNU_MIRROR="http://mirrors.ustc.edu.cn/gnu"
+BR2_LUAROCKS_MIRROR="https://luarocks.cn"
+BR2_CPAN_MIRROR="http://mirrors.ustc.edu.cn/CPAN"
 BR2_GLOBAL_PATCH_DIR="board/qemu/patches"
 BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_INIT_SYSV=y
+BR2_SYSTEM_BIN_SH_BASH=y
 BR2_SYSTEM_DHCP="eth0"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="board/qemu/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_DEFCONFIG)"
 BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
 BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
+BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON3_CURSES=y
+BR2_PACKAGE_COREUTILS=y
+BR2_PACKAGE_COREUTILS_INDIVIDUAL_BINARIES=y
+BR2_PACKAGE_VIM=y
 BR2_TARGET_ROOTFS_EXT2=y
+BR2_TARGET_ROOTFS_EXT2_SIZE="128M"
 BR2_TARGET_OPENSBI=y
 BR2_TARGET_OPENSBI_CUSTOM_VERSION=y
 BR2_TARGET_OPENSBI_CUSTOM_VERSION_VALUE="1.6"
 BR2_TARGET_OPENSBI_PLAT="generic"
-BR2_PACKAGE_HOST_QEMU=y
-BR2_PACKAGE_HOST_QEMU_SYSTEM_MODE=y
@@ -16,6 +16,7 @@
          <th>Latest release date</th>
          <th colspan="2">Downloads</td>
        </tr>
+<!--
        <tr>
          <th>Candidate</th>
          <th>2026.02.x</th>
@@ -42,30 +43,31 @@
            <a href="/downloads/buildroot-2026.02-rc3.tar.xz.sign">[PGP sig]</a>
          </td>
        </tr>
+-->
        <tr>
          <th>Stable</th>
-          <th>2025.11.x</th>
-          <td>March 2026</td>
+          <th>2026.02.x</th>
+          <td>June 2026</td>
          <td>
-            2025.11.2<br/>
-            <a href="https://gitlab.com/buildroot.org/buildroot/-/blob/2025.11.2/CHANGES">
+            2026.02<br/>
+            <a href="https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/CHANGES">
              Changelog
            </a>
          </td>
-          <td>2026-02-20</td>
+          <td>2026-03-04</td>
          <td>
-            <a href="/downloads/buildroot-2025.11.2.tar.gz">
+            <a href="/downloads/buildroot-2026.02.tar.gz">
              <img src="images/zip.png" width="24" alt="">
              .tar.gz
            </a><br/>
-            <a href="/downloads/buildroot-2025.11.2.tar.gz.sign">[PGP sig]</a>
+            <a href="/downloads/buildroot-2026.02.tar.gz.sign">[PGP sig]</a>
          </td>
          <td>
-            <a href="/downloads/buildroot-2025.11.2.tar.xz">
+            <a href="/downloads/buildroot-2026.02.tar.xz">
              <img src="images/package.png" width="24" alt="">
              .tar.xz
            </a><br/>
-            <a href="/downloads/buildroot-2025.11.2.tar.xz.sign">[PGP sig]</a>
+            <a href="/downloads/buildroot-2026.02.tar.xz.sign">[PGP sig]</a>
          </td>
        <tr>
          <th>Long-term support</th>
@@ -9,6 +9,24 @@
 <h2>News</h2>
 <ul class="timeline">

+  <li>
+    <div class="timeline-badge"><i class="glyphicon glyphicon-thumbs-up"></i></div>
+    <div class="timeline-panel">
+      <div class="timeline-heading">
+	<h4 class="timeline-title">2026.02 released</h4>
+	<p><small class="text-muted"><i class="glyphicon glyphicon-time"></i>4 March 2026</small></p>
+      </div>
+      <div class="timeline-body">
+	<p>The stable 2026.02 release is out - Thanks to everyone
+	  contributing and testing the release candidates. See the
+	  <a href="https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/CHANGES">CHANGES</a>
+	  file for more details
+	  and go to the <a href="/downloads/">downloads page</a> to pick up the
+	  <a href="/downloads/buildroot-2026.02.tar.xz">2026.02 release</a>.</p>
+      </div>
+    </div>
+  </li>
+
  <li class="timeline-inverted">
    <div class="timeline-badge"><i class="glyphicon glyphicon-thumbs-up"></i></div>
    <div class="timeline-panel">
@@ -0,0 +1,29 @@
+From 71e463e31b4d69f4022d36bfc814592f56600793 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Sun, 21 Apr 2024 13:56:13 +0200
+Subject: [PATCH] [core,info] fix missing check in rdp_write_logon_info_v1
+
+CVE: CVE-2024-32661
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/71e463e31b4d69f4022d36bfc814592f56600793
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/core/info.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c
+index 7d6eec13782d..3395e4d2e04c 100644
+--- a/libfreerdp/core/info.c
+++ b/libfreerdp/core/info.c
+@@ -1327,6 +1327,10 @@ static BOOL rdp_write_logon_info_v1(wStream* s, logon_info* info)
+ 		return FALSE;
+ 
+ 	/* domain */
+	WINPR_ASSERT(info);
+	if (!info->domain || !info->username)
+		return FALSE;
+
+ 	ilen = ConvertToUnicode(CP_UTF8, 0, info->domain, -1, &wString, 0);
+
+ 	if (ilen < 0)
+
@@ -0,0 +1,29 @@
+From 1bab198a2edd0d0e6e1627d21a433151ea190500 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Thu, 15 Jan 2026 12:02:02 +0100
+Subject: [PATCH] [codec,planar] fix decoder length checks
+
+CVE: CVE-2026-23530
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/1bab198a2edd0d0e6e1627d21a433151ea190500
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/codec/planar.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
+index 1a06e36edb0c..94a640a551d1 100644
+--- a/libfreerdp/codec/planar.c
+++ b/libfreerdp/codec/planar.c
+@@ -616,6 +616,11 @@ BOOL freerdp_bitmap_decompress_planar(BITMAP_PLANAR_CONTEXT* WINPR_RESTRICT plan
+ 	WINPR_ASSERT(planar);
+ 	WINPR_ASSERT(prims);
+ 
+	if (planar->maxWidth < nSrcWidth)
+		return FALSE;
+	if (planar->maxHeight < nSrcHeight)
+		return FALSE;
+
+ 	if (nDstStep <= 0)
+ 		nDstStep = nDstWidth * GetBytesPerPixel(DstFormat);
+ 
@@ -0,0 +1,31 @@
+From 25102b432fb37916a1a553d7ef8fd940c6e52c3f Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Thu, 15 Jan 2026 12:17:33 +0100
+Subject: [PATCH] [codec,clear] fix missing length checks
+
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/25102b432fb37916a1a553d7ef8fd940c6e52c3f.patch
+CVE: CVE-2026-23531
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/codec/clear.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
+index aa36baa9b305..4a67a8ed692b 100644
+--- a/libfreerdp/codec/clear.c
+++ b/libfreerdp/codec/clear.c
+@@ -1141,8 +1141,11 @@ INT32 clear_decompress(CLEAR_CONTEXT* cl
+ 
+ 	if (glyphData)
+ 	{
+-		if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, nWidth, nHeight, pDstData,
+-		                        DstFormat, nDstStep, nXDst, nYDst, palette, FREERDP_FLIP_NONE))
+		const uint32_t w = MIN(nWidth, nDstWidth);
+		const uint32_t h = MIN(nHeight, nDstHeight);
+		if (!freerdp_image_copy_no_overlap(glyphData, clear->format, 0, 0, 0, w, h, pDstData,
+		                                   DstFormat, nDstStep, nXDst, nYDst, palette,
+		                                   FREERDP_FLIP_NONE))
+ 			goto fail;
+ 	}
+ 
@@ -0,0 +1,79 @@
+From 243ecf804bb122e8e643a5c142ad5a49d7aa19ee Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Fri, 16 Jan 2026 12:22:46 +0100
+Subject: [PATCH] [codec,clear] check clear_decomress glyphData
+
+Check destination coordinates and lengths against the actual sizes. Log
+every truncation accordingly
+
+CVE: CVE-2026-23531
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/243ecf804bb122e8e643a5c142ad5a49d7aa19ee
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/codec/clear.c | 50 ++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
+index 0efa89f8d06c..f9aa4f0000c1 100644
+--- a/libfreerdp/codec/clear.c
+++ b/libfreerdp/codec/clear.c
+@@ -1141,9 +1141,55 @@ INT32 clear_decompress(CLEAR_CONTEXT* cl
+ 
+ 	if (glyphData)
+ 	{
+-		const uint32_t w = MIN(nWidth, nDstWidth);
+-		const uint32_t h = MIN(nHeight, nDstHeight);
+-		if (!freerdp_image_copy_no_overlap(glyphData, clear->format, 0, 0, 0, w, h, pDstData,
+		uint32_t w = MIN(nWidth, nDstWidth);
+		if (nXDst > nDstWidth)
+		{
+			WLog_WARN(TAG, "glyphData copy area x exceeds destination: x=%" PRIu32 " > %" PRIu32,
+			          nXDst, nDstWidth);
+			w = 0;
+		}
+		else if (nXDst + w > nDstWidth)
+		{
+			WLog_WARN(TAG,
+			          "glyphData copy area x + width exceeds destination: x=%" PRIu32 " + %" PRIu32
+			          " > %" PRIu32,
+			          nXDst, w, nDstWidth);
+			w = nDstWidth - nXDst;
+		}
+
+		if (w != nWidth)
+		{
+			WLog_WARN(TAG,
+			          "glyphData copy area width truncated: requested=%" PRIu32
+			          ", truncated to %" PRIu32,
+			          nWidth, w);
+		}
+
+		uint32_t h = MIN(nHeight, nDstHeight);
+		if (nYDst > nDstHeight)
+		{
+			WLog_WARN(TAG, "glyphData copy area y exceeds destination: y=%" PRIu32 " > %" PRIu32,
+			          nYDst, nDstHeight);
+			h = 0;
+		}
+		else if (nYDst + h > nDstHeight)
+		{
+			WLog_WARN(TAG,
+			          "glyphData copy area y + height exceeds destination: x=%" PRIu32 " + %" PRIu32
+			          " > %" PRIu32,
+			          nYDst, h, nDstHeight);
+			h = nDstHeight - nYDst;
+		}
+
+		if (h != nHeight)
+		{
+			WLog_WARN(TAG,
+			          "glyphData copy area height truncated: requested=%" PRIu32
+			          ", truncated to %" PRIu32,
+			          nHeight, h);
+		}
+
+		if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, w, h, pDstData,
+ 		                                   DstFormat, nDstStep, nXDst, nYDst, palette,
+ 		                                   FREERDP_FLIP_NONE))
+ 			goto fail;
@@ -0,0 +1,48 @@
+From c4a7c371342edf0d307cea728f56d3302f0ab38c Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Thu, 15 Jan 2026 12:04:36 +0100
+Subject: [PATCH] [gdi,gfx] properly clamp SurfaceToSurface
+
+CVE: CVE-2026-23532
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/c4a7c371342edf0d307cea728f56d3302f0ab38c
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/gdi/gfx.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/libfreerdp/gdi/gfx.c b/libfreerdp/gdi/gfx.c
+index 56e6ff9ed50b..96ce1007025c 100644
+--- a/libfreerdp/gdi/gfx.c
+++ b/libfreerdp/gdi/gfx.c
+@@ -1175,7 +1175,6 @@ static UINT gdi_SurfaceToSurface(RdpgfxC
+ 	UINT status = ERROR_INTERNAL_ERROR;
+ 	UINT16 index;
+ 	BOOL sameSurface;
+-	UINT32 nWidth, nHeight;
+ 	const RECTANGLE_16* rectSrc;
+ 	RECTANGLE_16 invalidRect;
+ 	gdiGfxSurface* surfaceSrc;
+@@ -1199,8 +1198,8 @@ static UINT gdi_SurfaceToSurface(RdpgfxC
+ 	if (!is_rect_valid(rectSrc, surfaceSrc->width, surfaceSrc->height))
+ 		goto fail;
+ 
+-	nWidth = rectSrc->right - rectSrc->left;
+-	nHeight = rectSrc->bottom - rectSrc->top;
+	const UINT32 nWidth = rectSrc->right - rectSrc->left;
+	const UINT32 nHeight = rectSrc->bottom - rectSrc->top;
+ 
+ 	for (index = 0; index < surfaceToSurface->destPtsCount; index++)
+ 	{
+@@ -1209,8 +1208,10 @@ static UINT gdi_SurfaceToSurface(RdpgfxC
+ 		if (!is_rect_valid(&rect, surfaceDst->width, surfaceDst->height))
+ 			goto fail;
+ 
+		const UINT32 rwidth = rect.right - rect.left;
+		const UINT32 rheight = rect.bottom - rect.top;
+ 		if (!freerdp_image_copy(surfaceDst->data, surfaceDst->format, surfaceDst->scanline,
+-		                        destPt->x, destPt->y, nWidth, nHeight, surfaceSrc->data,
+		                        destPt->x, destPt->y, rwidth, rheight, surfaceSrc->data,
+ 		                        surfaceSrc->format, surfaceSrc->scanline, rectSrc->left,
+ 		                        rectSrc->top, NULL, FREERDP_FLIP_NONE))
+ 			goto fail;
@@ -0,0 +1,58 @@
+From c4391827d7facfc874ca7f61a92afb82232a5748 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Thu, 15 Jan 2026 12:11:57 +0100
+Subject: [PATCH] [codec,clear] fix clear_resize_buffer checks
+
+CVE: CVE-2026-23533
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/c4391827d7facfc874ca7f61a92afb82232a5748
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/codec/clear.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
+index ad57529093e3..aa36baa9b305 100644
+--- a/libfreerdp/codec/clear.c
+++ b/libfreerdp/codec/clear.c
+@@ -62,7 +62,7 @@ struct S_CLEAR_CONTEXT
+ 	NSC_CONTEXT* nsc;
+ 	UINT32 seqNumber;
+ 	BYTE* TempBuffer;
+-	UINT32 TempSize;
+	size_t TempSize;
+ 	UINT32 nTempStep;
+ 	UINT32 TempFormat;
+ 	UINT32 format;
+@@ -313,16 +313,17 @@ static BOOL clear_decompress_subcode_rlex(wStream* WINPR_RESTRICT s, UINT32 bitm
+ 
+ static BOOL clear_resize_buffer(CLEAR_CONTEXT* clear, UINT32 width, UINT32 height)
+ {
+-	UINT32 size;
+-
+ 	if (!clear)
+ 		return FALSE;
+ 
+-	size = ((width + 16) * (height + 16) * GetBytesPerPixel(clear->format));
+	const UINT64 size = 1ull * (width + 16ull) * (height + 16ull);
+	const size_t bpp = GetBytesPerPixel(clear->format);
+	if (size > UINT32_MAX / bpp)
+		return FALSE;
+ 
+-	if (size > clear->TempSize)
+	if (size > clear->TempSize / bpp)
+ 	{
+-		BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size);
+		BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size * bpp);
+ 
+ 		if (!tmp)
+ 		{
+@@ -330,7 +331,7 @@ static BOOL clear_resize_buffer(CLEAR_CONTEXT* WINPR_RESTRICT clear, UINT32 widt
+ 			return FALSE;
+ 		}
+ 
+-		clear->TempSize = size;
+		clear->TempSize = size * bpp;
+ 		clear->TempBuffer = tmp;
+ 	}
+ 
@@ -0,0 +1,33 @@
+From f8688b57f6cfad9a0b05475a6afbde355ffab720 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Thu, 15 Jan 2026 12:19:53 +0100
+Subject: [PATCH] [codec,clear] fix off by one length check
+
+CVE: CVE-2026-23534
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/f8688b57f6cfad9a0b05475a6afbde355ffab720
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/codec/clear.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
+index 4a67a8ed692b..0efa89f8d06c 100644
+--- a/libfreerdp/codec/clear.c
+++ b/libfreerdp/codec/clear.c
+@@ -881,11 +881,14 @@ static BOOL clear_decompress_bands_data(
+ 				if (count > nHeight)
+ 					count = nHeight;
+ 
+-				if (nXDstRel + i > nDstWidth)
+				if (nXDstRel + i >= nDstWidth)
+ 					return FALSE;
+ 
+ 				for (UINT32 y = 0; y < count; y++)
+ 				{
+					if (nYDstRel + y >= nDstHeight)
+						return FALSE;
+
+ 					BYTE* pDstPixel8 = &pDstData[((nYDstRel + y) * nDstStep) +
+ 					                             ((nXDstRel + i) * GetBytesPerPixel(DstFormat))];
+ 					UINT32 color = ReadColor(cpSrcPixel, clear->format);
@@ -0,0 +1,55 @@
+From 4d44e3c097656a8b9ec696353647b0888ca45860 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 19 Jan 2026 20:11:24 +0100
+Subject: [PATCH] [core,info] fix missing NULL check
+
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/4d44e3c097656a8b9ec696353647b0888ca45860
+CVE: CVE-2026-23948
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ libfreerdp/core/info.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c
+index 0b17b75d9f64..cc54aee7baef 100644
+--- a/libfreerdp/core/info.c
+++ b/libfreerdp/core/info.c
+@@ -1372,7 +1372,7 @@ static BOOL rdp_write_logon_info_v1(wStr
+ 	return TRUE;
+ }
+ 
+-static BOOL rdp_write_logon_info_v2(wStream* s, logon_info* info)
+static BOOL rdp_write_logon_info_v2(wStream* s, const logon_info* info)
+ {
+ 	UINT32 Size = 2 + 4 + 4 + 4 + 4 + 558;
+ 	size_t domainLen, usernameLen;
+@@ -1385,11 +1385,13 @@ static BOOL rdp_write_logon_info_v2(wStr
+ 	Stream_Write_UINT16(s, SAVE_SESSION_PDU_VERSION_ONE);
+ 	Stream_Write_UINT32(s, Size);
+ 	Stream_Write_UINT32(s, info->sessionId);
+-	domainLen = strlen(info->domain);
+	if (info->domain)
+		domainLen = strlen(info->domain);
+ 	if (domainLen > UINT32_MAX)
+ 		return FALSE;
+ 	Stream_Write_UINT32(s, (UINT32)(domainLen + 1) * 2);
+-	usernameLen = strlen(info->username);
+	if (info->username)
+		usernameLen = strlen(info->username);
+ 	if (usernameLen > UINT32_MAX)
+ 		return FALSE;
+ 	Stream_Write_UINT32(s, (UINT32)(usernameLen + 1) * 2);
+@@ -1466,10 +1468,10 @@ static BOOL rdp_write_logon_info_ex(wStr
+ 
+ BOOL rdp_send_save_session_info(rdpContext* context, UINT32 type, void* data)
+ {
+-	wStream* s;
+ 	BOOL status;
+	WINPR_ASSERT(context);
+ 	rdpRdp* rdp = context->rdp;
+-	s = rdp_data_pdu_init(rdp);
+	wStream* s = rdp_data_pdu_init(rdp);
+ 
+ 	if (!s)
+ 		return FALSE;
@@ -0,0 +1,31 @@
+From d676518809c319eec15911c705c13536036af2ae Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 26 Jan 2026 11:54:56 +0100
+Subject: [PATCH] [channels,urbdrc] do not free MsConfig on failure
+
+let the channel handle it later.
+
+CVE: CVE-2026-24675
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/d676518809c319eec15911c705c13536036af2ae
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/urbdrc/client/data_transfer.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c
+index af4b9fb5f641..c4042107d4ee 100644
+--- a/channels/urbdrc/client/data_transfer.c
+++ b/channels/urbdrc/client/data_transfer.c
+@@ -570,10 +570,8 @@ static UINT urb_select_interface(IUDEVICE* pdev, GENERIC_CHANNEL_CALLBACK* callb
+ 	MsConfig = pdev->get_MsConfig(pdev);
+ 	InterfaceNumber = MsInterface->InterfaceNumber;
+ 	if (!msusb_msinterface_replace(MsConfig, InterfaceNumber, MsInterface))
+-	{
+-		msusb_msconfig_free(MsConfig);
+ 		return ERROR_BAD_CONFIGURATION;
+-	}
+
+ 	/* complete configuration setup */
+ 	if (!pdev->complete_msconfig_setup(pdev, MsConfig))
+ 	{
@@ -0,0 +1,35 @@
+From 026b81ae5831ac1598d8f7371e0d0996fac7db00 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 26 Jan 2026 10:20:23 +0100
+Subject: [PATCH] [channels,audin] reset audin->format
+
+Whenever the underlying structure changes reset the pointer to NULL
+
+CVE: CVE-2026-24676
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/026b81ae5831ac1598d8f7371e0d0996fac7db00
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/audin/client/audin_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
+index c57c65a62d4e..76d87bb9c1ed 100644
+--- a/channels/audin/client/audin_main.c
+++ b/channels/audin/client/audin_main.c
+@@ -219,6 +219,7 @@ static UINT audin_process_formats(AUDIN_
+ 	}
+ 
+ 	Stream_Seek_UINT32(s); /* cbSizeFormatsPacket */
+	audin->format = NULL;
+ 	callback->formats = audio_formats_new(NumFormats);
+ 
+ 	if (!callback->formats)
+@@ -293,6 +294,7 @@ out:
+ 
+ 	if (error != CHANNEL_RC_OK)
+ 	{
+		audin->format = NULL;
+ 		audio_formats_free(callback->formats, NumFormats);
+ 		callback->formats = NULL;
+ 	}
@@ -0,0 +1,43 @@
+From 2d563a50be17c1b407ca448b1321378c0726dd31 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 26 Jan 2026 10:59:39 +0100
+Subject: [PATCH] [channels,urbdrc] ensure InterfaceNumber is within range
+
+CVE: CVE-2026-24679
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/2d563a50be17c1b407ca448b1321378c0726dd31
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/urbdrc/client/libusb/libusb_udevice.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
+index 6c2376f74fd6..5341248ec64f 100644
+--- a/channels/urbdrc/client/libusb/libusb_udevice.c
+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
+@@ -528,19 +528,19 @@ static int libusb_udev_select_interface(
+ {
+ 	int error = 0, diff = 0;
+ 	UDEVICE* pdev = (UDEVICE*)idev;
+-	URBDRC_PLUGIN* urbdrc;
+-	MSUSB_CONFIG_DESCRIPTOR* MsConfig;
+-	MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces;
+ 
+ 	if (!pdev || !pdev->urbdrc)
+ 		return -1;
+ 
+-	urbdrc = pdev->urbdrc;
+-	MsConfig = pdev->MsConfig;
+	URBDRC_PLUGIN* urbdrc = pdev->urbdrc;
+	MSUSB_CONFIG_DESCRIPTOR* MsConfig = pdev->MsConfig;
+ 
+ 	if (MsConfig)
+ 	{
+-		MsInterfaces = MsConfig->MsInterfaces;
+		if (InterfaceNumber >= MsConfig->NumInterfaces)
+			return -2;
+
+		MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces = MsConfig->MsInterfaces;
+ 		if (MsInterfaces)
+ 		{
+ 			WLog_Print(urbdrc->log, WLOG_INFO,
@@ -0,0 +1,24 @@
+From 414f701464929c217f2509bcbd6d2c1f00f7ed73 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 26 Jan 2026 11:07:25 +0100
+Subject: [PATCH] [channels,urbdrc] cancel all usb transfers on channel close
+
+CVE: CVE-2026-24681
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/414f701464929c217f2509bcbd6d2c1f00f7ed73
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/urbdrc/client/libusb/libusb_udevice.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
+index 5341248ec64f..9e2d3ec5a193 100644
+--- a/channels/urbdrc/client/libusb/libusb_udevice.c
+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
+@@ -1116,6 +1116,7 @@ static void libusb_udev_mark_channel_closed(IUDEVICE* idev)
+ 		const uint8_t devNr = idev->get_dev_number(idev);
+ 
+ 		pdev->status |= URBDRC_DEVICE_CHANNEL_CLOSED;
+		pdev->iface.cancel_all_transfer_request(&pdev->iface);
+ 		urbdrc->udevman->unregister_udevice(urbdrc->udevman, busNr, devNr);
+ 	}
+ }
@@ -0,0 +1,26 @@
+From 1c5c74223179d425a1ce6dbbb6a3dd2a958b7aee Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 26 Jan 2026 10:14:08 +0100
+Subject: [PATCH] [channels,audin] fix audin_server_recv_formats cleanup
+
+CVE: CVE-2026-24682
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/1c5c74223179d425a1ce6dbbb6a3dd2a958b7aee
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/audin/server/audin.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/channels/audin/server/audin.c b/channels/audin/server/audin.c
+index 5046a7d6f27c..17077efa6652 100644
+--- a/channels/audin/server/audin.c
+++ b/channels/audin/server/audin.c
+@@ -215,7 +215,7 @@ static UINT audin_server_recv_formats(au
+ 
+ 		if (!audio_format_read(s, format))
+ 		{
+-			audio_formats_free(audin->context.client_formats, i);
+			audio_formats_free(audin->context.client_formats, audin->context.num_client_formats);
+ 			audin->context.client_formats = NULL;
+ 			WLog_ERR(TAG, "expected length at least 18, but got %" PRIu32 "", length);
+ 			return ERROR_INVALID_DATA;
@@ -0,0 +1,109 @@
+From d9ca272dce7a776ab475e9b1a8e8c3d2968c8486 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 26 Jan 2026 12:08:48 +0100
+Subject: [PATCH] [channels,ainput] lock context when updating listener
+
+CVE: CVE-2026-24683
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/d9ca272dce7a776ab475e9b1a8e8c3d2968c8486
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/ainput/client/ainput_main.c | 36 ++++++++++++++++++++--------
+ 1 file changed, 26 insertions(+), 10 deletions(-)
+
+diff --git a/channels/ainput/client/ainput_main.c b/channels/ainput/client/ainput_main.c
+index c291bd727285..5545753600a1 100644
+--- a/channels/ainput/client/ainput_main.c
+++ b/channels/ainput/client/ainput_main.c
+@@ -69,6 +69,7 @@ struct AINPUT_PLUGIN_
+ 	UINT32 MajorVersion;
+ 	UINT32 MinorVersion;
+ 	BOOL initialized;
+	CRITICAL_SECTION lock;
+ };
+ 
+ /**
+@@ -109,10 +110,7 @@ static UINT ainput_on_data_received(IWTS
+ 
+ static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags, INT32 x, INT32 y)
+ {
+-	AINPUT_PLUGIN* ainput;
+-	AINPUT_CHANNEL_CALLBACK* callback;
+ 	BYTE buffer[32] = { 0 };
+-	UINT64 time;
+ 	wStream sbuffer = { 0 };
+ 	wStream* s = &sbuffer;
+ 
+@@ -121,8 +119,8 @@ static UINT ainput_send_input_event(AInp
+ 	WINPR_ASSERT(s);
+ 	WINPR_ASSERT(context);
+ 
+-	time = GetTickCount64();
+-	ainput = (AINPUT_PLUGIN*)context->handle;
+	const UINT64 time = GetTickCount64();
+	AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)context->handle;
+ 	WINPR_ASSERT(ainput);
+ 	WINPR_ASSERT(ainput->listener_callback);
+ 
+@@ -132,8 +130,6 @@ static UINT ainput_send_input_event(AInp
+ 		          ainput->MajorVersion, ainput->MinorVersion);
+ 		return CHANNEL_RC_UNSUPPORTED_VERSION;
+ 	}
+-	callback = ainput->listener_callback->channel_callback;
+-	WINPR_ASSERT(callback);
+ 
+ 	{
+ 		char buffer[128] = { 0 };
+@@ -152,10 +148,15 @@ static UINT ainput_send_input_event(AInp
+ 	Stream_SealLength(s);
+ 
+ 	/* ainput back what we have received. AINPUT does not have any message IDs. */
+	EnterCriticalSection(&ainput->lock);
+	AINPUT_CHANNEL_CALLBACK* callback = ainput->listener_callback->channel_callback;
+	WINPR_ASSERT(callback);
+ 	WINPR_ASSERT(callback->channel);
+ 	WINPR_ASSERT(callback->channel->Write);
+-	return callback->channel->Write(callback->channel, (ULONG)Stream_Length(s), Stream_Buffer(s),
+	const UINT rc = callback->channel->Write(callback->channel, (ULONG)Stream_Length(s), Stream_Buffer(s),
+ 	                                NULL);
+	LeaveCriticalSection(&ainput->lock);
+	return rc;
+ }
+ 
+ /**
+@@ -167,7 +168,14 @@ static UINT ainput_on_close(IWTSVirtualC
+ {
+ 	AINPUT_CHANNEL_CALLBACK* callback = (AINPUT_CHANNEL_CALLBACK*)pChannelCallback;
+ 
+-	free(callback);
+	if (callback)
+	{
+		AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)callback->plugin;
+		WINPR_ASSERT(ainput);
+		EnterCriticalSection(&ainput->lock);
+		free(callback);
+		LeaveCriticalSection(&ainput->lock);
+	}
+ 
+ 	return CHANNEL_RC_OK;
+ }
+@@ -242,7 +250,10 @@ static UINT ainput_plugin_initialize(IWT
+ 	status = pChannelMgr->CreateListener(pChannelMgr, AINPUT_DVC_CHANNEL_NAME, 0,
+ 	                                     &ainput->listener_callback->iface, &ainput->listener);
+ 
+	InitializeCriticalSection(&ainput->lock);
+	EnterCriticalSection(&ainput->lock);
+ 	ainput->listener->pInterface = ainput->iface.pInterface;
+	LeaveCriticalSection(&ainput->lock);
+ 	ainput->initialized = status == CHANNEL_RC_OK;
+ 	return status;
+ }
+@@ -255,6 +266,8 @@ static UINT ainput_plugin_initialize(IWT
+ static UINT ainput_plugin_terminated(IWTSPlugin* pPlugin)
+ {
+ 	AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)pPlugin;
+	WINPR_ASSERT(ainput);
+	DeleteCriticalSection(&ainput->lock);
+ 	if (ainput && ainput->listener_callback)
+ 	{
+ 		IWTSVirtualChannelManager* mgr = ainput->listener_callback->channel_mgr;
@@ -0,0 +1,64 @@
+From 622bb7b4402491ca003f47472d0e478132673696 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 26 Jan 2026 10:48:14 +0100
+Subject: [PATCH] [channels,rdpsnd] terminate thread before free
+
+Ensure that the optional rdpsnd thread is terminated and the message
+queue freed up before releasing the channel context memory
+
+CVE: CVE-2026-24684
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/622bb7b4402491ca003f47472d0e478132673696
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/rdpsnd/client/rdpsnd_main.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/channels/rdpsnd/client/rdpsnd_main.c b/channels/rdpsnd/client/rdpsnd_main.c
+index 49c763a87e9b..61a29ec40aa8 100644
+--- a/channels/rdpsnd/client/rdpsnd_main.c
+++ b/channels/rdpsnd/client/rdpsnd_main.c
+@@ -1244,11 +1244,27 @@ fail:
+ 	return CHANNEL_RC_NO_MEMORY;
+ }
+ 
+static void rdpsnd_terminate_thread(rdpsndPlugin* rdpsnd)
+{
+	WINPR_ASSERT(rdpsnd);
+	if (rdpsnd->queue)
+		MessageQueue_PostQuit(rdpsnd->queue, 0);
+	if (rdpsnd->thread)
+	{
+		WaitForSingleObject(rdpsnd->thread, INFINITE);
+		CloseHandle(rdpsnd->thread);
+	}
+	MessageQueue_Free(rdpsnd->queue);
+	rdpsnd->thread = NULL;
+	rdpsnd->queue = NULL;
+}
+
+ static void cleanup_internals(rdpsndPlugin* rdpsnd)
+ {
+ 	if (!rdpsnd)
+ 		return;
+ 
+	rdpsnd_terminate_thread(rdpsnd);
+ 	if (rdpsnd->pool)
+ 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
+ 
+@@ -1396,14 +1412,7 @@ void rdpsnd_virtual_channel_event_termin
+ {
+ 	if (rdpsnd)
+ 	{
+-		if (rdpsnd->queue)
+-			MessageQueue_PostQuit(rdpsnd->queue, 0);
+-		if (rdpsnd->thread)
+-		{
+-			WaitForSingleObject(rdpsnd->thread, INFINITE);
+-			CloseHandle(rdpsnd->thread);
+-		}
+-		MessageQueue_Free(rdpsnd->queue);
+		rdpsnd_terminate_thread(rdpsnd);
+ 
+ 		free_internals(rdpsnd);
+ 		audio_formats_free(rdpsnd->fixed_format, 1);
@@ -0,0 +1,116 @@
+From afa6851dc80835d3101e40fcef51b6c5c0f43ea5 Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Wed, 28 Jan 2026 09:31:06 +0100
+Subject: [PATCH] [channel,rdpsnd] only clean up thread before free
+
+rdpsnd channel usually has multiple instances (static, dynamic, ...) so
+ensure only to terminate the handler thread when the channel is actually
+closed for good.
+
+CVE: CVE-2026-24684
+Upstream: https://github.com/FreeRDP/FreeRDP/commit/afa6851dc80835d3101e40fcef51b6c5c0f43ea5
+[thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ channels/rdpsnd/client/rdpsnd_main.c | 43 ++++++++++++++++------------
+ 1 file changed, 25 insertions(+), 18 deletions(-)
+
+diff --git a/channels/rdpsnd/client/rdpsnd_main.c b/channels/rdpsnd/client/rdpsnd_main.c
+index 61a29ec40aa8..5a1edaea62c6 100644
+--- a/channels/rdpsnd/client/rdpsnd_main.c
+++ b/channels/rdpsnd/client/rdpsnd_main.c
+@@ -132,6 +132,8 @@ struct rdpsnd_plugin
+ 	BOOL applyVolume;
+ };
+ 
+static DWORD WINAPI play_thread(LPVOID arg);
+
+ static const char* rdpsnd_is_dyn_str(BOOL dynamic)
+ {
+ 	if (dynamic)
+@@ -1264,7 +1266,6 @@ static void cleanup_internals(rdpsndPlug
+ 	if (!rdpsnd)
+ 		return;
+ 
+-	rdpsnd_terminate_thread(rdpsnd);
+ 	if (rdpsnd->pool)
+ 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
+ 
+@@ -1328,6 +1329,7 @@ static void free_internals(rdpsndPlugin*
+ 	if (!rdpsnd)
+ 		return;
+ 
+	rdpsnd_terminate_thread(rdpsnd);
+ 	freerdp_dsp_context_free(rdpsnd->dsp_context);
+ 	StreamPool_Free(rdpsnd->pool);
+ 	rdpsnd->pool = NULL;
+@@ -1349,6 +1351,21 @@ static BOOL allocate_internals(rdpsndPlu
+ 		if (!rdpsnd->dsp_context)
+ 			return FALSE;
+ 	}
+	if (!rdpsnd->queue)
+	{
+		wObject obj = { 0 };
+
+		obj.fnObjectFree = _queue_free;
+		rdpsnd->queue = MessageQueue_New(&obj);
+		if (!rdpsnd->queue)
+			return CHANNEL_RC_NO_MEMORY;
+	}
+	if (!rdpsnd->thread)
+	{
+		rdpsnd->thread = CreateThread(NULL, 0, play_thread, rdpsnd, 0, NULL);
+		if (!rdpsnd->thread)
+			return CHANNEL_RC_INITIALIZATION_ERROR;
+	}
+ 
+ 	return TRUE;
+ }
+@@ -1388,23 +1405,12 @@ static DWORD WINAPI play_thread(LPVOID a
+ 
+ static UINT rdpsnd_virtual_channel_event_initialized(rdpsndPlugin* rdpsnd)
+ {
+-	wObject obj = { 0 };
+-
+ 	if (!rdpsnd)
+ 		return ERROR_INVALID_PARAMETER;
+ 
+-	obj.fnObjectFree = _queue_free;
+-	rdpsnd->queue = MessageQueue_New(&obj);
+-	if (!rdpsnd->queue)
+-		return CHANNEL_RC_NO_MEMORY;
+-
+ 	if (!allocate_internals(rdpsnd))
+ 		return CHANNEL_RC_NO_MEMORY;
+ 
+-	rdpsnd->thread = CreateThread(NULL, 0, play_thread, rdpsnd, 0, NULL);
+-	if (!rdpsnd->thread)
+-		return CHANNEL_RC_INITIALIZATION_ERROR;
+-
+ 	return CHANNEL_RC_OK;
+ }
+ 
+@@ -1412,8 +1418,6 @@ void rdpsnd_virtual_channel_event_termin
+ {
+ 	if (rdpsnd)
+ 	{
+-		rdpsnd_terminate_thread(rdpsnd);
+-
+ 		free_internals(rdpsnd);
+ 		audio_formats_free(rdpsnd->fixed_format, 1);
+ 		free(rdpsnd->subsystem);
+@@ -1602,13 +1606,13 @@ static UINT rdpsnd_on_close(IWTSVirtualC
+ 
+ 	cleanup_internals(rdpsnd);
+ 
+	free_internals(rdpsnd);
+ 	if (rdpsnd->device)
+ 	{
+ 		IFCALL(rdpsnd->device->Free, rdpsnd->device);
+ 		rdpsnd->device = NULL;
+ 	}
+ 
+-	free_internals(rdpsnd);
+ 	free(pChannelCallback);
+ 	return CHANNEL_RC_OK;
+ }
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  f7cc2bf43b9778e9079cd229ea8e37fc1843eb1c11a8e4e003034af71858ce6a  freerdp-2.11.7-18-g0ee17e2f8e49d56ab5b90d5160fa8f87ffc445e0-git4.tar.gz
+sha256  8a7c953ece217aa4fa22c4a21ab2bc4c9093fc79aa67d3e1273c140d140203f7  freerdp-2.11.8-git4.tar.gz
 sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE
@@ -4,8 +4,8 @@
 #
 ################################################################################

-# Latest, and probably last, commit on the stable-2.0 branch
-FREERDP_VERSION = 2.11.7-18-g0ee17e2f8e49d56ab5b90d5160fa8f87ffc445e0
+# Latest, and probably last, release on the stable-2.0 branch
+FREERDP_VERSION = 2.11.8
 FREERDP_SITE = https://github.com/FreeRDP/FreeRDP
 FREERDP_SITE_METHOD = git
 FREERDP_DEPENDENCIES = libglib2 openssl zlib
@@ -13,6 +13,58 @@ FREERDP_LICENSE = Apache-2.0
 FREERDP_LICENSE_FILES = LICENSE
 FREERDP_CPE_ID_VENDOR = freerdp

+# Introduced in v3.0.0-beta1
+# https://security-tracker.debian.org/tracker/CVE-2024-32662
+FREERDP_IGNORE_CVES += CVE-2024-32662
+
+# Windows only
+# https://security-tracker.debian.org/tracker/CVE-2025-68118
+FREERDP_IGNORE_CVES += CVE-2025-68118
+
+# 0009-fix-missing-check-in-rdp-write-logon-info-v1.patch
+FREERDP_IGNORE_CVES += CVE-2024-32661
+
+# 0010-fix-decoder-length-checks.patch
+FREERDP_IGNORE_CVES += CVE-2026-23530
+
+# 0011-fix-missing-length-checks.patch
+# 0012-check-clear-decomress-glyphData.patch
+FREERDP_IGNORE_CVES += CVE-2026-23531
+
+# 0013-properly-clamp-SurfaceToSurface.patch
+FREERDP_IGNORE_CVES += CVE-2026-23532
+
+# 0014-fix-clear-resize-buffer-checks.patch
+FREERDP_IGNORE_CVES += CVE-2026-23533
+
+# 0015-fix-off-by-one-length-check.patch
+FREERDP_IGNORE_CVES += CVE-2026-23534
+
+# 0016-fix-missing-NULL-check.patch
+FREERDP_IGNORE_CVES += CVE-2026-23948
+
+# 0017-do-not-free-MsConfig-on-failure.patch
+FREERDP_IGNORE_CVES += CVE-2026-24675
+
+# 0018-reset-audin-format.patch
+FREERDP_IGNORE_CVES += CVE-2026-24676
+
+# 0019-ensure-InterfaceNumber-is-within-range.patch
+FREERDP_IGNORE_CVES += CVE-2026-24679
+
+# 0020-cancel-all-usb-transfers-on-channel-close.patch
+FREERDP_IGNORE_CVES += CVE-2026-24681
+
+# 0021-fix-audin-server-recv-formats-cleanup.patch
+FREERDP_IGNORE_CVES += CVE-2026-24682
+
+# 0022-lock-context-when-updating-listener.patch
+FREERDP_IGNORE_CVES += CVE-2026-24683
+
+# 0023-terminate-thread-before-free.patch
+# 0024-only-clean-up-thread-before-free.patch
+FREERDP_IGNORE_CVES += CVE-2026-24684
+
 FREERDP_INSTALL_STAGING = YES

 FREERDP_CONF_OPTS = \
@@ -0,0 +1,55 @@
+# HG changeset patch
+# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
+# Date 1734634653 21600
+#      Thu Dec 19 12:57:33 2024 -0600
+# Node ID 883ebf8cae6dfa5873d975fe3476b1a188ef3f9f
+# Parent  cf7cd5ebabb0ca40204de7539f4fb9ae02121958
+ReadWPGImage(): Assure that palette buffer is allocated and the current size.
+
+CVE: CVE-2025-27796
+Upstream: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3f9f
+[thomas: remove changelog and binary]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+
+diff --git a/coders/wpg.c b/coders/wpg.c
+--- a/coders/wpg.c
+++ b/coders/wpg.c
+@@ -1704,28 +1704,23 @@
+                 ThrowReaderException(CorruptImageError,InvalidColormapIndex,image);
+               }
+ 
+-              if(pPalette!=NULL &&
+-                 PaletteAllocBytes < 4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries))
+-              {
+-                MagickFreeResourceLimitedMemory(pPalette);
+-                PaletteAllocBytes = 0;
+-              }
+              /* Assure that buffer is allocated and the current size */
+              if (PaletteAllocBytes != Max(4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries),4*256))
+                {
+                  PaletteAllocBytes = Max(4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries),4*256);
+                  MagickReallocateResourceLimitedMemory(unsigned char *,pPalette,PaletteAllocBytes);
+                }
+               if(pPalette==NULL)
+-              {
+-                PaletteItems = WPG_Palette.NumOfEntries;
+-                PaletteAllocBytes = 4*(WPG_Palette.StartIndex+WPG_Palette.NumOfEntries);
+-                if(PaletteAllocBytes < 4*256) PaletteAllocBytes = 4*256;
+-                pPalette = MagickAllocateResourceLimitedMemory(unsigned char *,(size_t)PaletteAllocBytes);
+-                if(pPalette==NULL)
+-                    ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+-                for(i=0; i<=255; i++)
+                ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+
+              PaletteItems = WPG_Palette.NumOfEntries;
+              for(i=0; i<=255; i++)
+                 {
+                   pPalette[4*i] = WPG1_Palette[i].Red;
+                   pPalette[4*i+1] = WPG1_Palette[i].Green;
+                   pPalette[4*i+2] = WPG1_Palette[i].Blue;
+                   pPalette[4*i+3] = OpaqueOpacity;
+                 }
+-              }
+               if(ReadBlob(image,(size_t) PaletteItems*4,pPalette+((size_t)4*WPG_Palette.StartIndex)) != (size_t) PaletteItems*4)
+               {
+                 MagickFreeResourceLimitedMemory(pPalette);
@@ -11,12 +11,24 @@ GRAPHICSMAGICK_LICENSE = MIT
 GRAPHICSMAGICK_LICENSE_FILES = Copyright.txt
 GRAPHICSMAGICK_CPE_ID_VENDOR = graphicsmagick

+# Wrong NVD annotations
+# Fixed in version 1.2.3
+GRAPHICSMAGICK_IGNORE_CVES += CVE-2008-6621
+
+# Wrong NVD annotations englobbing all versions
+# Wrong patch for CVE-2006-5456 later updated
+# https://bugzilla.redhat.com/show_bug.cgi?id=210921#c5
+GRAPHICSMAGICK_IGNORE_CVES += CVE-2007-0770
+
 # 0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch
 GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-27795

 # 0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch
 GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-32460

+# 0003-Assure-that-palette-buffer-is-allocated-and-the-current-size.patch
+GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-27796
+
 GRAPHICSMAGICK_INSTALL_STAGING = YES
 GRAPHICSMAGICK_CONFIG_SCRIPTS = GraphicsMagick-config GraphicsMagickWand-config

@@ -6,7 +6,7 @@

 RUBY_VERSION_MAJOR = 4.0
 RUBY_VERSION = $(RUBY_VERSION_MAJOR).1
-RUBY_VERSION_EXT = 4.0.1
+RUBY_VERSION_EXT = 4.0.0
 RUBY_SITE = http://cache.ruby-lang.org/pub/ruby/$(RUBY_VERSION_MAJOR)
 RUBY_SOURCE = ruby-$(RUBY_VERSION).tar.xz

@@ -26,10 +26,12 @@ RUBY_CONF_OPTS = \
 	--disable-install-doc \
 	--disable-rpath \
 	--disable-rubygems \
-	--disable-yjit
+	--disable-yjit \
+	--disable-zjit
 HOST_RUBY_CONF_OPTS = \
 	--disable-install-doc \
 	--disable-yjit \
+	--disable-zjit \
 	--with-out-ext=curses,readline \
 	--without-gmp

@@ -0,0 +1,212 @@
+From 0951a0681011dfca3d78c84fd7f1e19c78a4443f Mon Sep 17 00:00:00 2001
+From: Amos Jeffries <yadij@users.noreply.github.com>
+Date: Sat, 11 Oct 2025 16:33:02 +1300
+Subject: [PATCH] Bug 3390: Proxy auth data visible to scripts (#2249)
+
+Original changes to redact credentials from error page %R code
+expansion output was incomplete. It missed the parse failure
+case where ErrorState::request_hdrs raw buffer contained
+sensitive information.
+
+Also missed was the %W case where full request message headers
+were generated in a mailto link. This case is especially
+problematic as it may be delivered over insecure SMTP even if
+the error was secured with HTTPS.
+
+After this change:
+* The HttpRequest message packing code for error pages is de-duplicated
+  and elides authentication headers for both %R and %W code outputs.
+* The %R code output includes the CRLF request message terminator.
+* The email_err_data directive causing advanced details to be added to
+  %W mailto links is disabled by default.
+
+Also redact credentials from generated TRACE responses.
+
+---------
+
+Co-authored-by: Alex Rousskov <rousskov@measurement-factory.com>
+
+CVE: CVE-2025-62168
+Upstream: https://github.com/squid-cache/squid/commit/0951a0681011dfca3d78c84fd7f1e19c78a4443f
+[thomas: remove release note, backport errorpage.cc]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/HttpRequest.cc                  |  6 +++---
+ src/HttpRequest.h                   |  2 +-
+ src/cf.data.pre                     |  8 +++++++-
+ src/client_side_reply.cc            | 14 +++++++-------
+ src/errorpage.cc                    | 17 ++++-------------
+ src/errorpage.h                     |  1 -
+ src/tests/stub_HttpRequest.cc       |  2 +-
+ 8 files changed, 26 insertions(+), 27 deletions(-)
+
+diff --git a/src/HttpRequest.cc b/src/HttpRequest.cc
+index cd7ee71d4af..c6ed5bee45d 100644
+--- a/src/HttpRequest.cc
+++ b/src/HttpRequest.cc
+@@ -341,7 +341,7 @@ HttpRequest::swapOut(StoreEntry * e)
+ 
+ /* packs request-line and headers, appends <crlf> terminator */
+ void
+-HttpRequest::pack(Packable * p) const
+HttpRequest::pack(Packable * const p, const bool maskSensitiveInfo) const
+ {
+     assert(p);
+     /* pack request-line */
+@@ -349,8 +349,8 @@ HttpRequest::pack(Packable * p) const
+                SQUIDSBUFPRINT(method.image()), SQUIDSBUFPRINT(url.path()),
+                http_ver.major, http_ver.minor);
+     /* headers */
+-    header.packInto(p);
+-    /* trailer */
+    header.packInto(p, maskSensitiveInfo);
+    /* indicate the end of the header section */
+     p->append("\r\n", 2);
+ }
+ 
+diff --git a/src/HttpRequest.h b/src/HttpRequest.h
+index 6d369029322..28dc4daf99d 100644
+--- a/src/HttpRequest.h
+++ b/src/HttpRequest.h
+@@ -206,7 +206,7 @@ class HttpRequest: public Http::Message
+ 
+     void swapOut(StoreEntry * e);
+ 
+-    void pack(Packable * p) const;
+    void pack(Packable * p, bool maskSensitiveInfo = false) const;
+ 
+     static void httpRequestPack(void *obj, Packable *p);
+ 
+diff --git a/src/cf.data.pre b/src/cf.data.pre
+index 0a73020e111..2dce65a4d0a 100644
+--- a/src/cf.data.pre
+++ b/src/cf.data.pre
+@@ -8941,12 +8941,18 @@ NAME: email_err_data
+ COMMENT: on|off
+ TYPE: onoff
+ LOC: Config.onoff.emailErrData
+-DEFAULT: on
+DEFAULT: off
+ DOC_START
+ 	If enabled, information about the occurred error will be
+ 	included in the mailto links of the ERR pages (if %W is set)
+ 	so that the email body contains the data.
+ 	Syntax is <A HREF="mailto:%w%W">%w</A>
+
+	SECURITY WARNING:
+		Request headers and other included facts may contain
+		sensitive information about transaction history, the
+		Squid instance, and its environment which would be
+		unavailable to error recipients otherwise.
+ DOC_END
+ 
+ NAME: deny_info
+diff --git a/src/client_side_reply.cc b/src/client_side_reply.cc
+index d73bf3f99f6..fc2feccf802 100644
+--- a/src/client_side_reply.cc
+++ b/src/client_side_reply.cc
+@@ -94,7 +94,7 @@ clientReplyContext::clientReplyContext(ClientHttpRequest *clientContext) :
+ void
+ clientReplyContext::setReplyToError(
+     err_type err, Http::StatusCode status, char const *uri,
+-    const ConnStateData *conn, HttpRequest *failedrequest, const char *unparsedrequest,
+    const ConnStateData *conn, HttpRequest *failedrequest, const char *,
+ #if USE_AUTH
+     Auth::UserRequest::Pointer auth_user_request
+ #else
+@@ -104,9 +104,6 @@ clientReplyContext::setReplyToError(
+ {
+     auto errstate = clientBuildError(err, status, uri, conn, failedrequest, http->al);
+ 
+-    if (unparsedrequest)
+-        errstate->request_hdrs = xstrdup(unparsedrequest);
+-
+ #if USE_AUTH
+     errstate->auth_user_request = auth_user_request;
+ #endif
+@@ -995,11 +992,14 @@ clientReplyContext::traceReply()
+     triggerInitialStoreRead();
+     http->storeEntry()->releaseRequest();
+     http->storeEntry()->buffer();
+    MemBuf content;
+    content.init();
+    http->request->pack(&content, true /* hide authorization data */);
+     const HttpReplyPointer rep(new HttpReply);
+-    rep->setHeaders(Http::scOkay, nullptr, "text/plain", http->request->prefixLen(), 0, squid_curtime);
+    rep->setHeaders(Http::scOkay, nullptr, "message/http", content.contentSize(), 0, squid_curtime);
+    rep->body.set(SBuf(content.buf, content.size));
+     http->storeEntry()->replaceHttpReply(rep);
+-    http->request->swapOut(http->storeEntry());
+-    http->storeEntry()->complete();
+    http->storeEntry()->completeSuccessfully("traceReply() stored the entire response");
+ }
+ 
+ #define SENDING_BODY 0
+diff --git a/src/errorpage.cc b/src/errorpage.cc
+index d7a588d099f..06046de9ebb 100644
+--- a/src/errorpage.cc
+++ b/src/errorpage.cc
+@@ -792,7 +792,6 @@ ErrorState::~ErrorState()
+ {
+     safe_free(redirect_url);
+     safe_free(url);
+-    safe_free(request_hdrs);
+     wordlistDestroy(&ftp.server_msg);
+     safe_free(ftp.request);
+     safe_free(ftp.reply);
+@@ -850,7 +849,7 @@ ErrorState::Dump(MemBuf * mb)
+                     SQUIDSBUFPRINT(request->url.path()),
+                     AnyP::ProtocolType_str[request->http_ver.protocol],
+                     request->http_ver.major, request->http_ver.minor);
+-        request->header.packInto(&str);
+        request->header.packInto(&str, true /* hide authorization data */);
+     }
+ 
+     str.append("\r\n", 2);
+@@ -1112,18 +1111,10 @@ ErrorState::compileLegacyCode(Build &build)
+                 p = "[no request]";
+             break;
+         }
+-        if (request) {
+-            mb.appendf(SQUIDSBUFPH " " SQUIDSBUFPH " %s/%d.%d\n",
+-                       SQUIDSBUFPRINT(request->method.image()),
+-                       SQUIDSBUFPRINT(request->url.path()),
+-                       AnyP::ProtocolType_str[request->http_ver.protocol],
+-                       request->http_ver.major, request->http_ver.minor);
+-            request->header.packInto(&mb, true); //hide authorization data
+-        } else if (request_hdrs) {
+-            p = request_hdrs;
+-        } else {
+        else if (request)
+            request->pack(&mb, true /* hide authorization data */);
+        else
+             p = "[no request]";
+-        }
+         break;
+ 
+     case 's':
+diff --git a/src/errorpage.h b/src/errorpage.h
+index abca4a17d7b..297b306978d 100644
+--- a/src/errorpage.h
+++ b/src/errorpage.h
+@@ -194,7 +194,6 @@ class ErrorState
+         MemBuf *listing = nullptr;
+     } ftp;
+ 
+-    char *request_hdrs = nullptr;
+     char *err_msg = nullptr; /* Preformatted error message from the cache */
+ 
+     AccessLogEntryPointer ale; ///< transaction details (or nil)
+diff --git a/src/tests/stub_HttpRequest.cc b/src/tests/stub_HttpRequest.cc
+index 495597d9a1b..48a0f1ce03e 100644
+--- a/src/tests/stub_HttpRequest.cc
+++ b/src/tests/stub_HttpRequest.cc
+@@ -45,7 +45,7 @@ bool HttpRequest::expectingBody(const HttpRequestMethod &, int64_t &) const STUB
+ bool HttpRequest::bodyNibbled() const STUB_RETVAL(false)
+ int HttpRequest::prefixLen() const STUB_RETVAL(0)
+ void HttpRequest::swapOut(StoreEntry *) STUB
+-void HttpRequest::pack(Packable *) const STUB
+void HttpRequest::pack(Packable *, bool) const STUB
+ void HttpRequest::httpRequestPack(void *, Packable *) STUB
+ HttpRequest * HttpRequest::FromUrl(const SBuf &, const MasterXaction::Pointer &, const HttpRequestMethod &) STUB_RETVAL(nullptr)
+ HttpRequest * HttpRequest::FromUrlXXX(const char *, const MasterXaction::Pointer &, const HttpRequestMethod &) STUB_RETVAL(nullptr)
@@ -15,6 +15,9 @@ SQUID_SELINUX_MODULES = apache squid
 # 0001-Fix-ASN-1-encoding-of-long-SNMP-OIDs.patch
 SQUID_IGNORE_CVES += CVE-2025-59362

+# 0002-Proxy-auth-data-visible-to-scripts.patch
+SQUID_IGNORE_CVES += CVE-2025-62168
+
 SQUID_DEPENDENCIES = libcap host-libcap libtool libxml2 host-pkgconf \
 	$(if $(BR2_PACKAGE_LIBNETFILTER_CONNTRACK),libnetfilter_conntrack)
 SQUID_CONF_ENV = \
@@ -1,78 +0,0 @@
-From 5686ef63f81fcac2ca6ec6e7160829b295ad4e79 Mon Sep 17 00:00:00 2001
-From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
-Date: Sun, 28 Dec 2025 15:01:38 +0100
-Subject: [PATCH] src/Makefile: create links with ln -sf
-
-Running "make installlinks" twice towards the same destination
-directory will fail, as symlink will already exist. This is not really
-expected as "make install" is normally expected to work again and
-again towards the same destination directory.
-
-Fix this by using ln -sf.
-
-Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
-Upstream: https://github.com/vim/vim/commit/6df5360691266b5eca49380e94f3e21fa48e5e0b
---
- src/Makefile | 24 ++++++++++++------------
- 1 file changed, 12 insertions(+), 12 deletions(-)
-
-diff --git a/src/Makefile b/src/Makefile
-index 6fb1eb95e..39f798260 100644
--- a/src/Makefile
-+++ b/src/Makefile
-@@ -2746,40 +2746,40 @@ installvimdiff: $(DEST_BIN)/$(VIMDIFFTARGET)
- installgvimdiff: $(DEST_BIN)/$(GVIMDIFFTARGET)
- 
- $(DEST_BIN)/$(EXTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(EXTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(EXTARGET)
- 
- $(DEST_BIN)/$(VIEWTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(VIEWTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(VIEWTARGET)
- 
- $(DEST_BIN)/$(GVIMTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(GVIMTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(GVIMTARGET)
- 
- $(DEST_BIN)/$(GVIEWTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(GVIEWTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(GVIEWTARGET)
- 
- $(DEST_BIN)/$(RVIMTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(RVIMTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(RVIMTARGET)
- 
- $(DEST_BIN)/$(RVIEWTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(RVIEWTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(RVIEWTARGET)
- 
- $(DEST_BIN)/$(RGVIMTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(RGVIMTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(RGVIMTARGET)
- 
- $(DEST_BIN)/$(RGVIEWTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(RGVIEWTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(RGVIEWTARGET)
- 
- $(DEST_BIN)/$(VIMDIFFTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(VIMDIFFTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(VIMDIFFTARGET)
- 
- $(DEST_BIN)/$(GVIMDIFFTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(GVIMDIFFTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(GVIMDIFFTARGET)
- 
- $(DEST_BIN)/$(EVIMTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(EVIMTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(EVIMTARGET)
- 
- $(DEST_BIN)/$(EVIEWTARGET): $(DEST_BIN)
-	cd $(DEST_BIN); ln -s $(VIMTARGET) $(EVIEWTARGET)
-+	cd $(DEST_BIN); ln -sf $(VIMTARGET) $(EVIEWTARGET)
- 
- # Create links for the manual pages with various names to vim.	This is only
- # done when the links (or manpages with the same name) don't exist yet.
-- 
-2.52.0
-
@@ -1,4 +1,4 @@
 # Locally computed
-sha256  be1d60091d27bbdbc090e0bb19798baeea378aa29645fd47dc4c222dc14efcaf  vim-9.1.2017.tar.gz
+sha256  f9ec31df8f1a78e130dd06c395e6626c2a8a8ec2705d8e7b7667bd3ecd499c6b  vim-9.1.2148.tar.gz
 sha256  0b3f1f330cb1b179bb17c7c687d4cec601e0aa3462bc7f890ad4c3888d37d720  LICENSE
 sha256  ee1d0885bbc4a95a24e49873a075391bdf26b69d13758e30f3d9271f8f42bd2d  README.txt
@@ -4,7 +4,7 @@
 #
 ################################################################################

-VIM_VERSION = 9.1.2017
+VIM_VERSION = 9.1.2148
 VIM_SITE = $(call github,vim,vim,v$(VIM_VERSION))
 VIM_DEPENDENCIES = ncurses $(TARGET_NLS_DEPENDENCIES)
 VIM_SUBDIR = src
@@ -5,7 +5,7 @@
 ################################################################################

 # Buildroot version to use
-RELEASE='2025.11'
+RELEASE='2026.02'

 ### Change here for more memory/cores ###
 VM_MEMORY=2048
Author	SHA1	Message	Date
Chen Wang	ab30db03f0	Description for quiz Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-02 15:44:42 +08:00
Chen Wang	0c0af2cdac	Add python3 Include python3 curses module due to the snake.py need it. Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:52:31 +08:00
Chen Wang	adc0b6483f	Increase image size to 128M We will add more packages such as python3, 60M is too small. Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:50:14 +08:00
Chen Wang	ec3b4253d5	Enable bash and use it as default shell Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:47:32 +08:00
Chen Wang	86dfc8acea	Add vim Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:45:53 +08:00
Chen Wang	1e05d3ffa7	Use coreutils Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:42:46 +08:00
Chen Wang	0b5ad28c8a	Use sysV as init system Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:41:07 +08:00
Chen Wang	548fcdaf53	Don't build host-qemu Use system pre-installed qemu-system-riscv64 ( version 8.2.2 and above are recommended). Run by "start-qemu.sh --use-system-qemu". Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:30:30 +08:00
Chen Wang	b1c5c5342b	Use external buildroot toolchain Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 13:20:44 +08:00
Chen Wang	28171e2caf	Use latest kernel version Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 10:35:15 +08:00
Chen Wang	c951648d5f	Use mainland mirrors to accelerate downloading. Signed-off-by: Chen Wang <unicorn_wang@outlook.com>	2026-04-01 10:11:13 +08:00
Peter Korsgaard	52ee2f5644	Update for 2026.02 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2026-03-04 09:11:17 +01:00
James Hilliard	346d6667fe	package/ruby: disable zjit for all builds The zjit option introduces a rust dependency and due to that not being handled appropriately it can cause build failures if this feature gets incorrectly autodetected as being available. This feature was introduced when ruby was bumped to version 4.0.0 in `f594f86f9d`. Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2026-03-03 22:48:19 +01:00
Neal Frager	64083817de	board/xilinx/arm-trusted-firmware.hash: add license file hashes Now that custom arm-trusted-firmware versions can specify license files, add license file hashes for the Xilinx custom arm-trusted-firmware version. Signed-off-by: Neal Frager <neal.frager@amd.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2026-03-03 22:05:43 +01:00
Neal Frager	38486b310d	board/xilinx/linux.hash: add license file hashes Now that custom Linux versions can specify license files, add license file hashes for the Xilinx custom Linux version. Signed-off-by: Neal Frager <neal.frager@amd.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2026-03-03 22:05:36 +01:00
William Sherrer	166ef8a12c	package/ruby: fix extension dependency after bump to 4.0.1 Commit `127f36b406` ("package/ruby: bump to version 4.0.1") adjusted RUBY_VERSION_EXT, but ruby 4.0.1 still installs its extensions into the 4.0.0 subdir: ls target/usr/lib/ruby/ 4.0.0 site_ruby vendor_ruby So revert the RUBY_VERSION_EXT change to ensure the unneeded extensions are correctly removed. Signed-off-by: William Sherrer <william@sherrer.com> [Peter: significantly extend commit message] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>	2026-03-03 21:46:12 +01:00
Thomas Perale	6f9f9caa45	package/graphicsmagick: add patch for CVE-2025-27796 Fixes the following vulnerability: - CVE-2025-27796: ReadWPGImage in WPG in GraphicsMagick before 1.3.46 mishandles palette buffer allocation, resulting in out-of-bounds access to heap memory in ReadBlob. For more information, see - https://www.cve.org/CVERecord?id=CVE-2025-27796 - https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/883ebf8cae6dfa5873d975fe3476b1a188ef3 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:30:15 +01:00
Thomas Perale	5c03ddb286	package/graphicsmagick: add CVE-2007-0770 to IGNORE_CVES This vulnerability match on every version of graphicsmagick [1]. It was issued because of an incomplete patch for CVE-2006-5456 and has been since remediated [2]. Since it's really old it's unlikely it will be updated and is thus added to IGNORE_CVES. [1] https://nvd.nist.gov//vuln/detail/CVE-2007-0770 [2] https://bugzilla.redhat.com/show_bug.cgi?id=210921#c5 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:30:15 +01:00
Thomas Perale	b55fd37919	package/graphicsmagick: add CVE-2008-6621 to IGNORE_CVES This vulnerability match on every version of graphicsmagick. Since it's really old it's unlikely it will be updated and is thus added to IGNORE_CVES. See [1]. [1] https://nvd.nist.gov//vuln/detail/CVE-2008-6621 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:30:15 +01:00
Thomas Perale	8d184e5504	package/freerdp: patch various vulnerabilities Patches mostly backported with the basis of the work of Ubuntu Security team. See [1]. Fix the following vulnerabilities: - CVE-2024-32661: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2024-32661 - CVE-2026-23530: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-23530 - CVE-2026-23531: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the destination rectangle, allowing an out-of-bounds read/write via crafted RDPGFX surface updates. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-23531 - CVE-2026-23532: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between destination rectangle clamping and the actual copy size. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-23532 - CVE-2026-23533: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes out-of-bounds writes during color output. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-23533 - CVE-2026-23534: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past the end of the destination surface buffer. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-23534 - CVE-2026-23948: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-23948 - CVE-2026-24675: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-24675 - CVE-2026-24676: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-24676 - CVE-2026-24679: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-24679 - CVE-2026-24681: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-24681 - CVE-2026-24682: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-24682 - CVE-2026-24683: FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is fixed in 3.22.0. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-24683 [1] https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:25:22 +01:00
Thomas Perale	dc8fc4b803	package/freerdp: add CVE-2025-68118 to IGNORE_CVES Only affects Windows platform. See [1] for more information. [1] https://security-tracker.debian.org/tracker/CVE-2025-68118 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:25:22 +01:00
Thomas Perale	a3329fd492	package/freerdp: add CVE-2024-32662 to IGNORE_CVES The CVE-2024-32662 was Introduced in v3.0.0-beta1. For more information see [1]. [1] https://security-tracker.debian.org/tracker/CVE-2024-32662 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:25:22 +01:00
Thomas Perale	73861bb720	package/freerdp: bump to v2.11.8 For more information on the release, see: - https://github.com/FreeRDP/FreeRDP/commit/9b678b6d5a40ce01607d8c3b1b1416437c8416c4 - https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.8 - https://github.com/FreeRDP/FreeRDP/compare/2.11.7...2.11.8 Note: the previous freerdp version 2.11.7-18-g0ee17e2f in Buildroot is only 5 commits prior the 2.11.8 tag. This is a very minimal bump. Signed-off-by: Thomas Perale <thomas.perale@mind.be> [Julien: add note in commit log] Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:25:22 +01:00
Thomas Perale	8918f1c2c8	package/squid: add patch for CVE-2025-62168 Fixes the following vulnerability: - CVE-2025-62168: Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-62168 - https://github.com/squid-cache/squid/commit/0951a0681011dfca3d78c84fd7f1e19c78a4443f The backport has been compared against debian patch [1]. [1] https://sources.debian.org/src/squid/6.13-2%2Bdeb13u1/debian/patches/CVE-2025-62168.patch Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:22:52 +01:00
Thomas Perale	95dad8f85c	package/vim: security bump to v9.1.2148 For changes, see: - https://github.com/vim/vim/compare/v9.1.2017...v9.1.2148 Fixes the following vulnerabilities: - CVE-2026-25749: Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-25749 - https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9 - CVE-2026-26269: Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command. The issue has been fixed as of Vim patch v9.1.2148. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-26269 - https://github.com/vim/vim/commit/c5f312aad8e4179e437f81ad39a860cd0ef11970 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>	2026-03-03 18:19:57 +01:00