openwrtv3/package
Jo-Philipp Wich 4e8c6f3407 dropbear: security update to 2016.74
- Security: Message printout was vulnerable to format string injection.

  If specific usernames including "%" symbols can be created on a system
  (validated by getpwnam()) then an attacker could run arbitrary code as root
  when connecting to Dropbear server.

  A dbclient user who can control username or host arguments could potentially
  run arbitrary code as the dbclient user. This could be a problem if scripts
  or webpages pass untrusted input to the dbclient program.

- Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
  the local dropbearconvert user when parsing malicious key files

- Security: dbclient could run arbitrary code as the local dbclient user if
  particular -m or -c arguments are provided. This could be an issue where
  dbclient is used in scripts.

- Security: dbclient or dropbear server could expose process memory to the
  running user if compiled with DEBUG_TRACE and running with -v

  The security issues were reported by an anonymous researcher working with
  Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2016-08-12 11:45:47 +02:00
..
base-files preinit: use only the image config options 2016-08-10 03:04:08 +02:00
boot uboot-lantiq: package does not build inside the SDK 2016-08-03 15:30:13 +02:00
devel gdb: fix build with gcc 4.1.2 as host compiler 2016-08-01 22:25:54 +02:00
firmware ath10k-firmware: Update to latest 99X0 CT firmware. 2016-08-11 10:55:22 +02:00
kernel mwlwifi: upgrade to 10.3.0.18-20160804 2016-08-11 21:04:42 +02:00
libs openssl: re-enable CMAC support 2016-08-09 07:18:03 +02:00
network dropbear: security update to 2016.74 2016-08-12 11:45:47 +02:00
system sysupgrade: unmount filesystems before reboot 2016-08-04 18:19:46 +02:00
utils mkelfimage: remove package, it is a host tool that has been unused for years 2016-08-02 13:54:56 +02:00
Makefile build: create a package feed directory containing all packages 2016-08-01 11:13:38 +02:00