aports issueshttps://gitlab.alpinelinux.org/alpine/aports/-/issues2019-07-23T11:53:03Zhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/7367[3.6] mosquitto: Pattern based ACLs can be bypassed (CVE-2017-7650)2019-07-23T11:53:03ZAlicha CH[3.6] mosquitto: Pattern based ACLs can be bypassed (CVE-2017-7650)A vulnerability exists in Mosquitto versions 0.15 to 1.4.11.
Pattern based ACLs can be bypassed by clients that set their
username/client id to ‘\#’ or ‘+’. This allows locally or remotely
connected clients to access MQTT
topics that ...A vulnerability exists in Mosquitto versions 0.15 to 1.4.11.
Pattern based ACLs can be bypassed by clients that set their
username/client id to ‘\#’ or ‘+’. This allows locally or remotely
connected clients to access MQTT
topics that they do have the rights to. The same issue may be present in
third party authentication/access control plugins for Mosquitto.
The vulnerability only comes into effect where pattern based ACLs are in
use, or potentially where third party plugins are in use.
### Fixed In Version:
mosquitto 1.4.12
### Reference:
http://mosquitto.org/2017/05/security-advisory-cve-2017-7650/
### Patch:
https://mosquitto.org/files/cve/2017-7650/
*(from redmine: issue id 7367, created on 2017-06-01, closed on 2017-06-15)*
* Relations:
* parent #7366
* Changesets:
* Revision 79170b170d09fe898c6c937ba588dc214dabb05c by Natanael Copa on 2017-06-01T13:03:28Z:
```
main/mosquitto: security upgrade to 1.4.12 (CVE-2017-7650)
fixes #7367
```3.6.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/7362[3.6] openldap: Double free vulnerability in servers/slapd/back-mdb/search.c ...2019-07-23T11:53:09ZAlicha CH[3.6] openldap: Double free vulnerability in servers/slapd/back-mdb/search.c (CVE-2017-9287)servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a
double free vulnerability. A user with access to search the
directory can crash slapd by issuing a search including the Paged
Results control with a page size of ...servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a
double free vulnerability. A user with access to search the
directory can crash slapd by issuing a search including the Paged
Results control with a page size of 0.
### Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-9287
### Patch:
https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=0cee1ffb6021b1aae3fcc9581699da1c85a6dd6e
*(from redmine: issue id 7362, created on 2017-06-01, closed on 2017-06-15)*
* Relations:
* parent #7360
* Changesets:
* Revision 70711fe484191a3cb0f1fded665524c40f4d51dc by Natanael Copa on 2017-06-01T11:14:08Z:
```
main/openldap: sec fix for CVE-2017-9287
fixes #7362
```3.6.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/7347[3.6] strongswan: Multiple vulnerabilities (CVE-2017-9022, CVE-2017-9023)2019-07-23T11:53:23ZAlicha CH[3.6] strongswan: Multiple vulnerabilities (CVE-2017-9022, CVE-2017-9023)CVE-2017-9022: Insufficient validation of RSA public keys passed to the gmp plugin
----------------------------------------------------------------------------------
RSA public keys passed to the gmp plugin aren’t validated sufficiently...CVE-2017-9022: Insufficient validation of RSA public keys passed to the gmp plugin
----------------------------------------------------------------------------------
RSA public keys passed to the gmp plugin aren’t validated sufficiently
before attempting signature verification, so that invalid input might
lead to a floating point
exception and crash of the process. A certificate with an appropriately
prepared public key sent by a peer could be used for a denial-of-service
attack.
### Affected versions:
All versions since 4.4.0, up to and including 5.5.2.
### Fixed In Version:
strongswan 5.5.3
### References:
https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html
### Patches:
https://download.strongswan.org/security/CVE-2017-9022/
CVE-2017-9023: Incorrect Handling of CHOICE types in ASN.1 parser and x509 plugin
---------------------------------------------------------------------------------
ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when
parsing X.509 certificates with extensions that use such types.
This could lead to infinite looping of the thread parsing a specifically
crafted certificate.
### Affected versions:
All strongSwan versions up to and including 5.5.2
### Fixed In Version:
strongswan 5.5.3
### References:
https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html
### Patches:
https://download.strongswan.org/security/CVE-2017-9023/
*(from redmine: issue id 7347, created on 2017-05-31, closed on 2017-06-15)*
* Relations:
* parent #7346
* Changesets:
* Revision f647e2d3d31f6c5e3c4f4f41bfbee7eea8d02271 by Natanael Copa on 2017-05-31T10:36:15Z:
```
main/strongswan: security upgrade to 5.5.3 (CVE-2017-9022,CVE-2017-9023)
fixes #7347
```3.6.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/7328[3.6] libtasn1: asn1_find_node() based stackoverflow (CVE-2017-6891)2019-07-23T11:53:34ZAlicha CH[3.6] libtasn1: asn1_find_node() based stackoverflow (CVE-2017-6891)Two errors in the “asn1\_find\_node()” function (lib/parser\_aux.c)
within GnuTLS libtasn1 version 4.10 can be exploited to cause a
stacked-based
buffer overflow by tricking a user into processing a specially crafted
assignments file v...Two errors in the “asn1\_find\_node()” function (lib/parser\_aux.c)
within GnuTLS libtasn1 version 4.10 can be exploited to cause a
stacked-based
buffer overflow by tricking a user into processing a specially crafted
assignments file via the e.g. asn1Coding utility.
### References:
https://secuniaresearch.flexerasoftware.com/secunia\_research/2017-11/
https://nvd.nist.gov/vuln/detail/CVE-2017-6891
### Patch:
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=5520704d075802df25ce4ffccc010ba1641bd484
*(from redmine: issue id 7328, created on 2017-05-25, closed on 2017-05-25)*
* Relations:
* parent #7326
* Changesets:
* Revision 9c7bef126531b81cd07fa8fb09f8fde105afe6ca on 2017-05-25T13:33:37Z:
```
main/libtasn1: security fix for CVE-2017-6891. Fixes #7328
```3.6.1Francesco ColistaFrancesco Colistahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/7320[3.6] samba: Remote code execution from a writable share (CVE-2017-7494)2019-07-23T11:53:42ZAlicha CH[3.6] samba: Remote code execution from a writable share (CVE-2017-7494)All versions of Samba from 3.5.0 onwards are vulnerable to a remote
code execution vulnerability, allowing a malicious client to upload a
shared library to a writable share, and then cause the server to load
and execute it.
Samba ...All versions of Samba from 3.5.0 onwards are vulnerable to a remote
code execution vulnerability, allowing a malicious client to upload a
shared library to a writable share, and then cause the server to load
and execute it.
Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as
security releases to correct the defect.
### References:
https://www.samba.org/samba/security/CVE-2017-7494.html
https://www.samba.org/samba/history/security.html
*(from redmine: issue id 7320, created on 2017-05-25, closed on 2017-05-25)*
* Relations:
* parent #7319
* Changesets:
* Revision c5b93ddc16cccf0e5aa939ebf89b81ce1de63c47 by Natanael Copa on 2017-05-25T10:01:18Z:
```
main/samba: security upgrade to 4.6.4 (CVE-2017-7494)
fixes #7320
```3.6.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/6899[3.6] libplist: Multiple issues (CVE-2017-5209, CVE-2017-5545, CVE-2017-5834,...2019-07-23T11:58:43ZAlicha CH[3.6] libplist: Multiple issues (CVE-2017-5209, CVE-2017-5545, CVE-2017-5834, CVE-2017-5835, CVE-2017-5836)CVE-2017-5209:
--------------
The base64decode function in base64.c in libimobiledevice libplist
through 1.12 allows attackers to obtain sensitive information
from process memory or cause a denial of service (buffer over-read) via
spl...CVE-2017-5209:
--------------
The base64decode function in base64.c in libimobiledevice libplist
through 1.12 allows attackers to obtain sensitive information
from process memory or cause a denial of service (buffer over-read) via
split encoded Apple Property List data.
### Reference:
https://github.com/libimobiledevice/libplist/issues/84
### Patch:
https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957
CVE-2017-5545:
--------------
The main function in plistutil.c in libimobiledevice libplist through
1.12 allows attackers to obtain sensitive information from process
memory or cause a denial of service (buffer over-read) via Apple
Property List data that is too short.
### Reference:
https://github.com/libimobiledevice/libplist/issues/87
http://seclists.org/oss-sec/2017/q1/239
### Patch:
https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee
CVE-2017-5834: heap-buffer-overflow in parse\_dict\_node
--------------------------------------------------------
### Reference:
https://github.com/libimobiledevice/libplist/issues/89
http://seclists.org/oss-sec/2017/q1/239
### Patch:
https://github.com/libimobiledevice/libplist/commit/4765d9a60ca4248a8f89289271ac69cbffcc29bc
CVE-2017-5835: memory allocation error
--------------------------------------
### Reference:
https://github.com/libimobiledevice/libplist/issues/88
http://seclists.org/oss-sec/2017/q1/239
### Patch:
https://github.com/libimobiledevice/libplist/commit/26061aac4ec75e7a4469a9aab9a424716223e5c4
CVE-2017-5836: issue in plist\_free\_data plist.c:185
-----------------------------------------------------
### Reference:
https://github.com/libimobiledevice/libplist/issues/86
http://seclists.org/oss-sec/2017/q1/239
### Patch:
https://github.com/libimobiledevice/libplist/commit/7a28a14cf6ed547dfd2e52a4db17f47242bfdef9
*(from redmine: issue id 6899, created on 2017-02-20, closed on 2017-06-29)*
* Relations:
* parent #6898
* Changesets:
* Revision d2b9ac4f2df9f3cb0899f67bfaf17fc03340d5b6 by Natanael Copa on 2017-05-31T14:10:29Z:
```
community/libplist: security upgrade to 2.0.0
CVE-2017-5209
CVE-2017-5545
CVE-2017-5834
CVE-2017-5835
CVE-2017-5836
This seems to be an update that is ABI compatible, and only kodi uses is.
fixes #6899
```3.6.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/6896[3.6] mupdf: stack-based buffer overflow in main (jstest_main.c)(CVE-2017-6060)2019-07-23T11:58:46ZAlicha CH[3.6] mupdf: stack-based buffer overflow in main (jstest_main.c)(CVE-2017-6060)### Affected version:
1.10a
### Reference:
http://openwall.com/lists/oss-security/2017/02/18/1
*(from redmine: issue id 6896, created on 2017-02-20, closed on 2019-05-03)*
* Relations:
* parent #6895### Affected version:
1.10a
### Reference:
http://openwall.com/lists/oss-security/2017/02/18/1
*(from redmine: issue id 6896, created on 2017-02-20, closed on 2019-05-03)*
* Relations:
* parent #68953.6.1Daniel SabogalDaniel Sabogalhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/7353Problem with php-fpm (for php5-fpm) init.d script2019-07-23T11:53:17ZAlain van HoofProblem with php-fpm (for php5-fpm) init.d script/etc/init.d/php-fpm start
\* Checking /etc/php5/php-fpm.conf …
sh: /usr/bin/php-fpm: not found
\* failed, please correct errors above \[ !! \]
\* ERROR: php-fpm failed to start
/etc/init.d/php-fpm should have : command=“/usr/bin.../etc/init.d/php-fpm start
\* Checking /etc/php5/php-fpm.conf …
sh: /usr/bin/php-fpm: not found
\* failed, please correct errors above \[ !! \]
\* ERROR: php-fpm failed to start
/etc/init.d/php-fpm should have : command=“/usr/bin/php-fpm5” (now it is
command=“/usr/bin/php-fpm” ) to start the service
*(from redmine: issue id 7353, created on 2017-05-31, closed on 2017-06-01)*
* Changesets:
* Revision a9574f08d353d8582b11384314b5a89d8e404041 by Natanael Copa on 2017-06-01T08:51:54Z:
```
community/php5: fix php-fpm init.d script
ref #7353
```
* Revision c11d515dc82a37c73e70ea05d7c2337985f83b9a by Natanael Copa on 2017-06-01T08:52:45Z:
```
community/php5: fix php-fpm init.d script
fixes #7353
```3.6.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/7338Package lxc-download needs wget2019-07-23T11:53:29ZJanus MarzPackage lxc-download needs wgetlxc-download depends on wget
*(from redmine: issue id 7338, created on 2017-05-28, closed on 2017-06-01)*
* Changesets:
* Revision b4add4241f236e6ff15d769bd769724d9e81959b on 2017-06-01T10:19:49Z:
```
main/lxc: add wget as dependen...lxc-download depends on wget
*(from redmine: issue id 7338, created on 2017-05-28, closed on 2017-06-01)*
* Changesets:
* Revision b4add4241f236e6ff15d769bd769724d9e81959b on 2017-06-01T10:19:49Z:
```
main/lxc: add wget as dependency of lxc-downloads. Fixes #7338
```
* Revision 403cb9a9d18439b30f2aa6c1e3c7faf654bd2c60 on 2017-06-01T10:27:31Z:
```
main/lxc: add wget as dependency of lxc-downloads. Fixes #7338
```3.6.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/7265libGL error: MESA-LOADER: failed to retrieve device information2019-07-23T11:54:30ZNed FlanderslibGL error: MESA-LOADER: failed to retrieve device informationI found a bug with Mesa.
It works fine as root but fails as normal user.
I have 2 reproduction cases.
You must have mesa-demos installed.
Case 1
------
**glxinfo | head**
name of display: :0
libGL error: MESA-LOADER: fai...I found a bug with Mesa.
It works fine as root but fails as normal user.
I have 2 reproduction cases.
You must have mesa-demos installed.
Case 1
------
**glxinfo | head**
name of display: :0
libGL error: MESA-LOADER: failed to retrieve device information
libGL error: Version 4 or later of flush extension not found
libGL error: failed to load driver: i915
libGL error: MESA-LOADER: failed to retrieve device information
display: :0 screen: 0
direct rendering: Yes
But **sudo glxinfo** works correctly without any errors.
Case 2
------
**glxgears**
It gives the same errors as above and the gears don’t load.
After a while my desktop freezes.
OTOH **sudo glxgears** works.
*(from redmine: issue id 7265, created on 2017-05-04, closed on 2017-06-01)*
* Uploads:
* [strace.log](/uploads/7f8ea9f2f27ef9386af9985d2ee68681/strace.log)
* [permissions-hardened.log](/uploads/fc79ba63ce6d2fd8465423535059cd74/permissions-hardened.log)
* [permissions-vanilla.log](/uploads/09f8164d886c343bf63db9a11d76fc3f/permissions-vanilla.log)3.6.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/7093Issue with getmntent_r with overlay/overlay2 with /proc/mounts entries >=1024...2019-11-26T16:59:44ZDimitrios LiappisIssue with getmntent_r with overlay/overlay2 with /proc/mounts entries >=1024 bytesWhile investigating an issue with Java and how JNI is using
[getMountEntries()](http://hg.openjdk.java.net/jdk8/jdk8/jdk/file/687fd7c7986d/src/solaris/classes/sun/nio/fs/LinuxFileSystem.java#l85)
and [it’s getmntent JNI
dispatcher](http:...While investigating an issue with Java and how JNI is using
[getMountEntries()](http://hg.openjdk.java.net/jdk8/jdk8/jdk/file/687fd7c7986d/src/solaris/classes/sun/nio/fs/LinuxFileSystem.java#l85)
and [it’s getmntent JNI
dispatcher](http://hg.openjdk.java.net/jdk8/jdk8/jdk/file/687fd7c7986d/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c#l174)
we came across a discrepancy between how `getmntent_r()` behaves in musl
and glibc on the following conditions:
- docker storage driver is overlay or overlay2
- there are enough layers so that the `overlay /` entry in proc mounts
in longer than 1024 characters
Note that this is separate from the [older Alpine
bug\#5703](http://bugs.alpinelinux.org/issues/5703) that deals with the
256byte fixed limit.
Here are the reproduction steps:
1. Ensure \`docker info\` reports overlay/overlay2. This is the default,
e.g. on Fedora, Docker for Mac and Docker for Windows.
2. Create the following files in your dir:
<pre>
cat >docker-compose.yml <<EOF
version: ‘2’
services:
mytester:
build: .
image: testgetmntent:alpine
EOF
</pre>
<pre>
cat >Dockerfile <<EOF
FROM alpine:latest
RUN apk update && apk add bash gcc musl-dev && rm -rf
/var/cache/apk/\*
RUN echo test 0 >/tmp/test0
RUN echo test 1 >/tmp/test1
RUN echo test 2 >/tmp/test2
RUN echo test 3 >/tmp/test3
RUN echo test 4 >/tmp/test4
RUN echo test 5 >/tmp/test5
RUN echo test 6 >/tmp/test6
RUN echo test 7 >/tmp/test7
RUN echo test 8 >/tmp/test8
RUN echo test 9 >/tmp/test9
RUN echo test 10 >/tmp/test10
RUN echo test 11 >/tmp/test11
EOF
</pre>
3. Build and run the resulting image with:
<pre>
docker-compose build —pull && docker-compose run mytester /bin/bash
</pre>
4. In the shell, create the following C program to test `getmntent_r`:
<pre>
cat >getmntent\_r\_tester.c <<EOF
\#include <stdio.h>
\#include <mntent.h>
void print\_mount(const struct mntent \*fs);
int main(int argc, char \*\*argv)
{
FILE \*fp;
struct mntent \*fs;
struct mntent ent;
char buf\[1024\];
int buflen = sizeof(buf);
fp = setmntent(“/proc/mounts”, “r”); /\* read only \*/
if (fp == NULL) {
printf(“Error calling setmntent\\n”);
return(1);
}
while ((fs = getmntent\_r(fp, &ent, (char\*)&buf, buflen )) != NULL)
print\_mount(fs);
endmntent(fp);
}
void print\_mount(const struct mntent \*fs)
{
printf(“%s %s %s %s %d %d\\n”,
fs->mnt\_fsname,
fs->mnt\_dir,
fs->mnt\_type,
fs->mnt\_opts,
fs->mnt\_freq,
fs->mnt\_passno);
}
EOF
</pre>
5. Compile and run it. Notice there’s no output.
<pre>
bash-4.3\# gcc getmntent\_r\_tester.c
bash-4.3\# ./a.out
</pre>
6. Notice that `overlay /` entry in `/proc/mounts` exceeds 1024bytes:
<pre>
bash-4.3\# grep overlay /proc/mounts | wc -c
1069
</pre>
7. Exit the container, run `docker-compose down`.
8. Edit the `Dockerfile` and remove the last 2 RUN commands
9. Rebuild, rerun the image and recompile and rerun the C program, in
steps 3-5:
<pre>
bash-4.3\# gcc getmntent\_r\_tester.c
bash-4.3\# grep overlay /proc/mounts | wc -c
961
bash-4.3\# ./a.out
overlay / overlay
rw,seclabel,relatime,lowerdir=/var/lib/docker/overlay2/l/LVWNODYSVRXAQW4P5QXNVVXDSS:/var/lib/docker/overlay2/l/RVAZXPKSLDGTV5QXZLI6HZAXXU:/var/lib/docker/overlay2/l/EJIOFNYRMEPTJ4AID2PXUZNJOC:/var/lib/docker/overlay2/l/P4BG3VO46BQDHUXLXPZ3KDXAIR:/var/lib/docker/overlay2/l/G563LG47W5E6A4YPFZCTQ5ORUG:/var/lib/docker/overlay2/l/E2PLIGC66VLBLKENQA2GUKOZXO:/var/lib/docker/overlay2/l/6C5UXCJ4COZVHKHDRDKGW7PKIZ:/var/lib/docker/overlay2/l/GY45BC44L45ZYGQB7XCUU3L4LU:/var/lib/docker/overlay2/l/FF4KRJU7RWCA2GQ6OZV4OHLCXM:/var/lib/docker/overlay2/l/5SZT4SYLCF5LZAZCAJIA6YFB3K:/var/lib/docker/overlay2/l/3SP6Y2WURVZ4L6IZD3WQ2T5ZRG:/var/lib/docker/overlay2/l/LZZGUAD7WB6NZAKG5PSE4K7S6B:/var/lib/docker/overlay2/l/5VA5PMTBPJ4VRPX7HNGUVOYARI,upperdir=/var/lib/docker/overlay2/9ff9f8c3a876cec942dbfa5324894d24d1fe4eb52700320e5e5fa3e7e34a137a/diff,workdir=/var/lib/docker/overlay2/9ff9f8c3a876cec942dbfa5324894d24d1fe4eb52700320e5e5fa3e7e34a137a/work
0 0
<snip here>
</pre>
10. Trying the same process with a different docker image base, based on
glibc, (e.g. fedora:latest) works in all cases.
*(from redmine: issue id 7093, created on 2017-04-05, closed on 2017-06-01)*
* Changesets:
* Revision 189a271214ef539691db0b2647a7246e6a8b8343 by Natanael Copa on 2017-05-30T15:58:56Z:
```
community/openjdk8: increase buffer size for getmntent_r
Java will only use 1024 byte buffer for parsing mounts. Unlike glibc
will musl return error when this is not big enough instead of truncating
it.
We solve it by allocating a much bigger buffer.
fixes #7093
We also build without precompiled headers, which does not work eith PIE.
```
* Revision d0a7b324194a36ae3963edd67f85a4f83bc61545 by Natanael Copa on 2018-06-13T21:18:57Z:
```
community/openjdk8: increase buffer size for getmntent_r
Java will only use 1024 byte buffer for parsing mounts. Unlike glibc
will musl return error when this is not big enough instead of truncating
it.
We solve it by allocating a much bigger buffer.
fixes #7093
We also build without precompiled headers, which does not work eith PIE.
```3.6.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/7047v4l2-ctl segfaults when setting control values2019-07-23T11:57:06ZHannes Gustafssonv4l2-ctl segfaults when setting control valuesRunning Alpine in Docker on Ubuntu LTS segfaults
/ # v4l2-ctl -c exposure_auto=0
Segmentation fault (core dumped)
Several options fail too
/ # v4l2-ctl -c exposure_auto=0,white_balance_temperature_auto=1
Segmentatio...Running Alpine in Docker on Ubuntu LTS segfaults
/ # v4l2-ctl -c exposure_auto=0
Segmentation fault (core dumped)
Several options fail too
/ # v4l2-ctl -c exposure_auto=0,white_balance_temperature_auto=1
Segmentation fault (core dumped)
Video device is mounted into container
docker run --device /dev/video0 -it alpine:3.5 /bin/sh
Getting camera info from within container works fine
/ # v4l2-ctl --all
Driver Info (not using libv4l2):
Driver name : uvcvideo
Card type : See3CAM_CU30
Bus info : usb-0000:00:14.0-2
Driver version: 4.4.49
Capabilities : 0x84200001
Video Capture
Streaming
Extended Pix Format
Device Capabilities
Device Caps : 0x04200001
Video Capture
Streaming
Extended Pix Format
Priority: 2
Video input : 0 (Camera 1: ok)
Format Video Capture:
Width/Height : 640/480
Pixel Format : 'UYVY'
Field : None
Bytes per Line : 1280
Size Image : 614400
Colorspace : Default
Transfer Function : Default
YCbCr Encoding : Default
Quantization : Default
Flags :
Crop Capability Video Capture:
Bounds : Left 0, Top 0, Width 640, Height 480
Default : Left 0, Top 0, Width 640, Height 480
Pixel Aspect: 1/1
Selection: crop_default, Left 0, Top 0, Width 640, Height 480
Selection: crop_bounds, Left 0, Top 0, Width 640, Height 480
Streaming Parameters Video Capture:
Capabilities : timeperframe
Frames per second: 30.000 (30/1)
Read buffers : 0
brightness (int) : min=-15 max=15 step=1 default=0 value=0
contrast (int) : min=0 max=60 step=1 default=10 value=10
saturation (int) : min=0 max=98 step=1 default=16 value=16
white_balance_temperature_auto (bool) : default=0 value=1
gamma (int) : min=16 max=125 step=1 default=40 value=40
gain (int) : min=0 max=100 step=1 default=0 value=1
white_balance_temperature (int) : min=11 max=50 step=1 default=17 value=17 flags=inactive
sharpness (int) : min=1 max=7 step=1 default=1 value=1
exposure_auto (menu) : min=0 max=3 default=1 value=0
exposure_absolute (int) : min=0 max=10000 step=1 default=312 value=312 flags=inactive
zoom_absolute (int) : min=100 max=800 step=1 default=100 value=100
Trying to rebuild v4l-utils with debug info (DEBUG=1) and running in GDB
yields the following backtrace:
(gdb) run -c exposure_auto=0
Starting program: /usr/bin/v4l2-ctl -c exposure_auto=0
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7dc0f2e in strchrnul () from /lib/ld-musl-x86_64.so.1
(gdb) bt
#0 0x00007ffff7dc0f2e in strchrnul () from /lib/ld-musl-x86_64.so.1
#1 0x000000000000003d in ?? ()
#2 0x00007ffff7dc0ed0 in strchr () from /lib/ld-musl-x86_64.so.1
#3 0x0000000000000000 in ?? ()
(gdb)
Other people have reported similar errors on IRC:
http://dev.alpinelinux.org/irclogs/%23alpine-linux-2017-02.log
>2017-02-02 15:20:50 <dnb_> Trying to run v4l2-ctl from v4l-utils,
and it segfaults running any control operation… Wondering what the
process should be to find out why? My devops guy tried compiling it on
alpine, but having a hard time with musl and include paths, etc….
>2017-02-02 22:01:33 <drewlover> v4l2-utils
>2017-02-02 22:02:08 <drewlover> the package in alpine segfaults,
and we don’t have time to wait for upstream fixes, nor can we find out
exactly wtf is going on with it… so… my devops guy is trying to build it
himself, and failing miserably
>2017-02-02 22:02:29 <Shiz> ah, right
>2017-02-02 22:02:46 <Shiz>
http://git.alpinelinux.org/cgit/aports/tree/main/v4l-utils?h=3.5-stable
>2017-02-02 22:02:48 <drewlover> none of us have any understanding
of musl and all that, and I haven’t messed with C in like 10 years, so
it’s reallllly rusty to me
>2017-02-02 22:02:54 <Shiz> well you can at least use the .patch
here
>2017-02-02 22:02:59 <Shiz> that should ostensibly make it compile
>2017-02-02 22:04:30 <drewlover> I assume these are patches made
simply to make it compile, but not tested for runtime
>2017-02-02 22:05:16 <Shiz> well, usually the packages alpine ships
are tested, but it should at least give you a base
>2017-02-02 22:05:28 <Shiz> the patch isn’t very special anyway,
nothing that can induce a segfault
>2017-02-02 22:06:06 <Shiz> that isnt /w 30
Versions:
# uname -a
Linux host 4.4.0-67-generic #88-Ubuntu SMP Wed Mar 8 16:34:45 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
docker version
Client:
Version: 1.12.6
API version: 1.24
Go version: go1.6.4
Git commit: 78d1802
Built: Tue Jan 10 20:38:45 2017
OS/Arch: linux/amd64
Server:
Version: 1.12.6
API version: 1.24
Go version: go1.6.4
Git commit: 78d1802
Built: Tue Jan 10 20:38:45 2017
OS/Arch: linux/amd64
*(from redmine: issue id 7047, created on 2017-03-22, closed on 2017-06-01)*
* Changesets:
* Revision bf732f20e9c9a8dfd0010618908bd458961f3ba4 by Natanael Copa on 2017-05-31T19:28:03Z:
```
main/v4l-utils: fix segfault due to undefined behavior in getsubopt
ref #7047
```
* Revision dfa7d220828b373c8d45ea627ea5b37dee28fcb7 by Natanael Copa on 2017-06-01T08:15:07Z:
```
main/v4l-utils: fix segfault due to undefined behavior in getsubopt
fixes #7047
```3.6.1Francesco ColistaFrancesco Colistahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/6969[3.6] libxdmcp: weak entropy usage for session keys (CVE-2017-2625)2019-07-23T11:57:57ZAlicha CH[3.6] libxdmcp: weak entropy usage for session keys (CVE-2017-2625)In the absence of arc4random(), xdmcp session keys are generated based
on getpid() and time(), which may allow a local attacker to
brute-force
the key.
### Affected Version:
1.1.2 and lower
### References:
https://www.x41-dsec.de...In the absence of arc4random(), xdmcp session keys are generated based
on getpid() and time(), which may allow a local attacker to
brute-force
the key.
### Affected Version:
1.1.2 and lower
### References:
https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/
https://bugzilla.redhat.com/show\_bug.cgi?id=CVE-2017-2625
*(from redmine: issue id 6969, created on 2017-03-07, closed on 2019-03-19)*
* Relations:
* parent #6968
* Changesets:
* Revision 7560948637780d243514c54d16631717c9e058ee by Natanael Copa on 2017-05-31T09:32:29Z:
```
main/libxcmcp: build against libbsd (CVE-2017-2625)
Use arc4random_buf from libbsd
fixes #6969
```3.6.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/6668Can't boot on Raspberry Pi 22019-07-23T12:01:39ZThibault MeyerCan't boot on Raspberry Pi 2Hi,
I just get a Raspberry Pi 2 and try to run Alpine Linux 3.5
(alpine-rpi-3.5.0-armhf.tar.gz) on a Class 10 Micro SD Card. But my
raspberry Pi 2 won’t boot.
With *disable\_splash* set to 0, I only get a rainbow screen. The red
led on...Hi,
I just get a Raspberry Pi 2 and try to run Alpine Linux 3.5
(alpine-rpi-3.5.0-armhf.tar.gz) on a Class 10 Micro SD Card. But my
raspberry Pi 2 won’t boot.
With *disable\_splash* set to 0, I only get a rainbow screen. The red
led on is on and the green led blink slowly.
Thanks
*(from redmine: issue id 6668, created on 2017-01-10, closed on 2017-06-01)*
* Changesets:
* Revision 9c088d864238c2e2232ebc8a623a03b8d8e09566 by Timo Teräs on 2017-05-30T08:03:27Z:
```
main/linux-rpi: update configs
fix rpi2 kernel config for armv7, ref #6668
```
* Revision ef5fef4f090142b525d02c4622922dd74a4a3df3 by Timo Teräs on 2017-05-30T08:10:30Z:
```
main/linux-rpi: update configs
fix rpi2 kernel config for armv7, ref #6668
```3.6.1Timo TeräsTimo Teräshttps://gitlab.alpinelinux.org/alpine/aports/-/issues/5795Please provide opencv package for x86 and Arm2019-07-23T13:31:42ZRay DavisPlease provide opencv package for x86 and Armfolks
Can we have opencv package for x86 and Arm (if possible neon optimized)
Please include version 3 and version 2.xx both.
*(from redmine: issue id 5795, created on 2016-06-24, closed on 2017-06-01)*folks
Can we have opencv package for x86 and Arm (if possible neon optimized)
Please include version 3 and version 2.xx both.
*(from redmine: issue id 5795, created on 2016-06-24, closed on 2017-06-01)*3.6.1