Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Bernd Kuhls <bernd@kuhls.net>
To: buildroot@buildroot.org
Cc: Romain Naour <romain.naour@gmail.com>,
	Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Subject: [Buildroot] [PATCH v2 1/1] package/{glibc, localedef}: security bump version to 2.44-6-g0b58f5d80
Date: Fri, 31 Jul 2026 22:41:14 +0200	[thread overview]
Message-ID: <20260731204115.925792-1-bernd@kuhls.net> (raw)

https://sourceware.org/pipermail/libc-announce/2026/000058.html

Fixes CVE-2026-4046, CVE-2026-4437, & CVE-2026-4438.

host-localedef: Added a build fix and rebased patches.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
v2: bumped to 2.44-6-g0b58f5d80

 package/glibc/glibc.hash                      |  2 +-
 package/glibc/glibc.mk                        | 38 +----------------
 ...ACK-only-build-and-install-localedef.patch | 14 +++----
 ...y-on-GCC-to-4.8-and-binutils-to-2.24.patch |  8 ++--
 .../0005-HACK-Fix-dependencies.patch          | 41 +++++++++++++++++++
 package/localedef/localedef.mk                |  2 +-
 6 files changed, 55 insertions(+), 50 deletions(-)
 create mode 100644 package/localedef/0005-HACK-Fix-dependencies.patch

diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash
index 97862aef14..2cf0c0ac06 100644
--- a/package/glibc/glibc.hash
+++ b/package/glibc/glibc.hash
@@ -1,5 +1,5 @@
 # Locally calculated (fetched from git)
-sha256  647325cc2e9f2c6260f3c48d0385ac5e30cb60d2ec2e5afd649555c518c9bf60  glibc-2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674-git4.tar.gz
+sha256  5d520b1927958d34494d273905c169226229e5f524172b779e885be0a7099628  glibc-2.44-6-g0b58f5d80d24cf83cfde9d8381aafb11fef0e152-git4.tar.gz
 
 # Hashes for license files
 sha256  edaef632cbb643e4e7a221717a6c441a4c1a7c918e6e4d56debc3d8739b233f6  COPYINGv2
diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index 5aa2ef5f99..c7036287e0 100644
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -7,7 +7,7 @@
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
 # When updating the version, please also update localedef
-GLIBC_VERSION = 2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
+GLIBC_VERSION = 2.44-6-g0b58f5d80d24cf83cfde9d8381aafb11fef0e152
 GLIBC_SITE = https://sourceware.org/git/glibc.git
 GLIBC_SITE_METHOD = git
 
@@ -19,42 +19,6 @@ GLIBC_CPE_ID_VENDOR = gnu
 # allow proper matching with the CPE database.
 GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
 
-# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
-GLIBC_IGNORE_CVES += CVE-2025-8058
-
-# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
-GLIBC_IGNORE_CVES += CVE-2026-0861
-
-# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
-GLIBC_IGNORE_CVES += CVE-2026-0915
-
-# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
-GLIBC_IGNORE_CVES += CVE-2025-15281
-
-# Fixed by glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
-GLIBC_IGNORE_CVES += CVE-2026-4437
-
-# Fixed by glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
-GLIBC_IGNORE_CVES += CVE-2026-4438
-
-# Fixed by glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
-GLIBC_IGNORE_CVES += CVE-2026-4046
-
-# Fixed by glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
-GLIBC_IGNORE_CVES += CVE-2026-5928
-
-# Fixed by glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
-GLIBC_IGNORE_CVES += CVE-2026-5450
-
-# Fixed by glibc-2.43-42-ge64ae5a591f0604b7504df4df631857bb11cc78b
-GLIBC_IGNORE_CVES += CVE-2026-5435
-
-# Fixed by glibc-2.43-43-g3a418da6a3938756763980541e440dbdd46900fb
-GLIBC_IGNORE_CVES += CVE-2026-6238
-
-# Fixed by glibc-2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
-GLIBC_IGNORE_CVES += CVE-2026-6791
-
 # This CVE is considered as not being security issues by
 # upstream glibc:
 #  https://security-tracker.debian.org/tracker/CVE-2010-4756
diff --git a/package/localedef/0001-HACK-only-build-and-install-localedef.patch b/package/localedef/0001-HACK-only-build-and-install-localedef.patch
index b7c51c4ed3..33aab4c3dc 100644
--- a/package/localedef/0001-HACK-only-build-and-install-localedef.patch
+++ b/package/localedef/0001-HACK-only-build-and-install-localedef.patch
@@ -11,7 +11,7 @@ Signed-off-by: Peter Seiderer <ps.report@gmx.net>
 Signed-off-by: Romain Naour <romain.naour@gmail.com>
 [yann.morin.1998@free.fr: rebase for 2.39]
 Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
-[Bernd: rebase for 2.43]
+[Bernd: rebase for 2.44]
 Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
 ---
  Rules           | 14 ++++++++++----
@@ -19,10 +19,10 @@ Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
  2 files changed, 10 insertions(+), 7 deletions(-)
 
 diff --git a/Rules b/Rules
-index b07400a979..4ce2180b49 100644
+index 71495028fb..5e1243e44d 100644
 --- a/Rules
 +++ b/Rules
-@@ -247,10 +247,16 @@ binaries-shared-notests = $(filter-out $(binaries-pie) $(binaries-static), \
+@@ -263,10 +263,16 @@ binaries-shared-notests = $(filter-out $(binaries-pie) $(binaries-static), \
  				       $(binaries-all-notests))
  
  ifneq "$(strip $(binaries-shared-notests))" ""
@@ -44,10 +44,10 @@ index b07400a979..4ce2180b49 100644
  
  ifneq "$(strip $(binaries-shared-tests))" ""
 diff --git a/locale/Makefile b/locale/Makefile
-index fc38c02114..c00bc085b4 100644
+index 25f9b5bbce..5cbcd34bd3 100644
 --- a/locale/Makefile
 +++ b/locale/Makefile
-@@ -76,7 +76,6 @@ aux = \
+@@ -77,7 +77,6 @@ aux = \
    xlocale \
    # aux
  others = \
@@ -55,7 +55,7 @@ index fc38c02114..c00bc085b4 100644
    localedef \
    # others
  #others-static = \
-@@ -84,7 +83,6 @@ others = \
+@@ -85,7 +84,6 @@ others = \
  # locale \
  # # others-static
  install-bin = \
@@ -63,7 +63,7 @@ index fc38c02114..c00bc085b4 100644
    localedef \
    # install-bin
  extra-objs = \
-@@ -96,7 +94,6 @@ extra-objs = \
+@@ -97,7 +95,6 @@ extra-objs = \
  generated += C-translit.h
  before-compile += $(objpfx)C-translit.h
  
diff --git a/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch b/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch
index 30799cfc46..1490b3d523 100644
--- a/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch
+++ b/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch
@@ -30,17 +30,17 @@ Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 Signed-off-by: Romain Naour <romain.naour@gmail.com>
 [yann.morin.1998@free.fr: rebase for 2.39]
 Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
-[Bernd: rebase for 2.43]
+[Bernd: rebase for 2.44]
 Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
 ---
  configure | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/configure b/configure
-index 0cd2269859..1c7e42ec10 100755
+index 604279533a..9daca5fb98 100755
 --- a/configure
 +++ b/configure
-@@ -5350,7 +5350,7 @@ printf %s "checking version of $LD... " >&6; }
+@@ -5307,7 +5307,7 @@ printf %s "checking version of $LD... " >&6; }
    ac_prog_version=`$LD --version 2>&1 | sed -n 's/^.*GNU ld.* \([0-9][0-9]*\.[0-9.]*\).*$/\1/p'`
    case $ac_prog_version in
      '') ac_prog_version="v. ?.??, bad"; ac_verc_fail=yes;;
@@ -49,7 +49,7 @@ index 0cd2269859..1c7e42ec10 100755
         ac_prog_version="$ac_prog_version, ok"; ac_verc_fail=no;;
      *) ac_prog_version="$ac_prog_version, bad"; ac_verc_fail=yes;;
  
-@@ -5799,7 +5799,7 @@ int
+@@ -5756,7 +5756,7 @@ int
  main (void)
  {
  
diff --git a/package/localedef/0005-HACK-Fix-dependencies.patch b/package/localedef/0005-HACK-Fix-dependencies.patch
new file mode 100644
index 0000000000..5d4841b93f
--- /dev/null
+++ b/package/localedef/0005-HACK-Fix-dependencies.patch
@@ -0,0 +1,41 @@
+From 8419660a3dcf8e6780365f7298e7d85ca0c5537f Mon Sep 17 00:00:00 2001
+From: Bernd Kuhls <bernd@kuhls.net>
+Date: Sun, 26 Jul 2026 12:17:36 +0200
+Subject: [PATCH] HACK: Fix dependencies
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Upstream commit 7cac99621e9601f916121bcaa9b7734a2e4c2529 changed the
+handling of dependencies which forced the addition of the make target
+'lib' to the target 'others' causing the build of unneeded targets for
+the host build of localedef including build errors:
+
+/home/bernd/buildroot/output/per-package/host-localedef/host/bin/ccache
+ /usr/bin/gcc gconv_simple.c
+[...]
+In file included from <command-line>:
+../include/wchar.h:154:20: error: ‘wcstof128’ undeclared here (not in a function); did you mean ‘wcstof128_l’?
+
+To fix the problem we remove the addition of the 'lib' make target.
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index a6aabca691..0ac1a45c36 100644
+--- a/Makefile
++++ b/Makefile
+@@ -581,7 +581,6 @@ endif
+ # 'tests' and 'xtests' additionally require the 'others' pass.  The
+ # testroot used by the container tests performs a full installation in
+ # its recipe, which must not run concurrently with the build passes.
+-$(addsuffix /others,$(subdirs)): lib
+ $(addsuffix /tests,$(subdirs)) $(addsuffix /xtests,$(subdirs)): others
+ $(objpfx)testroot.pristine/install.stamp: | others
+ 
+-- 
+2.47.3
+
diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk
index 732ed6d4ad..e204531224 100644
--- a/package/localedef/localedef.mk
+++ b/package/localedef/localedef.mk
@@ -7,7 +7,7 @@
 # Use the same VERSION and SITE as target glibc
 # As in glibc.mk, generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
-LOCALEDEF_VERSION = 2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
+LOCALEDEF_VERSION = 2.44-6-g0b58f5d80d24cf83cfde9d8381aafb11fef0e152
 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION)$(BR_FMT_VERSION_git).tar.gz
 LOCALEDEF_SITE = https://sourceware.org/git/glibc.git
 LOCALEDEF_SITE_METHOD = git
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

                 reply	other threads:[~2026-07-31 20:41 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260731204115.925792-1-bernd@kuhls.net \
    --to=bernd@kuhls.net \
    --cc=buildroot@buildroot.org \
    --cc=romain.naour@gmail.com \
    --cc=thomas.petazzoni@bootlin.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox