openwisp-monitoring: added 0.1.1

Signed-off-by: Federico Capoano <f.capoano@openwisp.io>
(cherry picked from commit 0419a797ae7442dff8a1536de404a2fc38337f2f)

syslog-ng: update to version 3.37.1

- Changelog:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.37.1

- Bump config version

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ae7aefe111382630c7046cfb4539b3f1a72ff402)

Revert "lxc: export systemd cgroups after install"

The postinst script is sourced during image build, which causes the
follow failure:
/home/stijn/Development/OpenWrt/openwrt/build_dir/target-x86_64_musl/root-x86/etc/init.d/lxc-auto: line 3: /lib/functions.sh: No such file or directory
postinst script ./usr/lib/opkg/info/lxc-auto.postinst has failed with exit code 1

Sourcing /lib/functions.sh is not needed, as /etc/rc.common does so
already. Unfortunately removing that line from the init script is not
enough to fix the problem. The postinst script should also check
IPKG_INSTROOT. As these two changes are unrelated, they should go in
separate commits, and the solution to the image build problem is to
revert the commit that introduced the breakage.

This reverts commit 2cde10b95053bf958a4001fb0a82c4563bf345e2.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

lxc: export systemd cgroups after install

otherwise, a user would have to either manually run /etc/init.d/lxc-auto
boot or reboot the system to start using lxc.

originally committed in 2cde10b95053bf958a4001fb0a82c4563bf345e2
reverted in 039912dec5d3ba2b0f6f53ab8330ab9fea2f7adf

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 7da73565399f915f516c6cdd74a58f984d519e4b)

bind: update to version 9.16.30

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

libgd: install pkgconfig file

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

luajit: backport softfloat ppc support

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 24c0007ea2561611776e50c8876a7b040ffd6fdc)

luajit: fix build on macos (ldconfig issue)

fix ldconfig build issue. This patch is a backport from upstream:
https://github.com/LuaJIT/LuaJIT/commit/18c9cf7d3788a8f7408df45df92fc4ae3bcc0d80

Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
(cherry picked from commit 42c4d254552c04f41a2b93811147ef56af45bf9c)

openldap: drop use of HTTP in favor of HTTPS

Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit bab2f020eec5524984902c382591fc562b6e08aa)

beep: change git repository to fix CVE-2018-0492 and CVE-2018-1000532

1. Changed Git repository, which is used for Fedora packaging
https://github.com/johnath/beep/issues/11#issuecomment-450277122

Fixed CVEs:
CVE-2018-0492 - https://nvd.nist.gov/vuln/detail/CVE-2018-0492
CVE-2018-1000532 - https://nvd.nist.gov/vuln/detail/CVE-2018-1000532

2. Fixed SPDX License Identifier

3. Add patch to comment out -D_FORTIFY_SOURCE
Otherwise, it can not be built by default.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 6488eaf2502c75ffc8ac11fffd539f5c070f77c3)

beep: restore a dependency definition to the previous one on x86 target

Commit 9bcea2de2cf552d544786d1e4b82f55cda7015b1 causes a dependency
problem with some out-of-tree packages which expect "DEPENDS:=+kmod-pcspkr".

To fix this problem, this commit restores a dependency definition to
the previous one on x86 target.

Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
(cherry picked from commit 8b1216fb49dbc4f444606d0fb8c32297d66336c0)

beep: fix dependency to support non-x86 target and kmod-gpio-beeper

Beep is a target-independent software that can handle buzzers controlled by kmod-gpio-beeper.

This change is useful for some non-x86 enterprise APs and development boards
that have a buzzer connected to GPIO.

Compile-tested: ath79, ELECOM WAB-I1750-PS, 3fab4ac + device support patch
Run-tested: ath79, ELECOM WAB-I1750-PS, 3fab4ac + device support patch

Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
(cherry picked from commit 9bcea2de2cf552d544786d1e4b82f55cda7015b1)

beep: add missing PKG_MIRROR_HASH

Signed-off-by: Yanase Yuki <dev@zpc.sakura.ne.jp>
(cherry picked from commit ac52356c0bdb11127013e291ad10add6b44784b2)

Merge pull request #18696 from BKPepe/netatalk-1907

[19.07] netatalk: re-introduce 3.1.13 and backport pending fixes

netatalk: backport pending PR to fix segfaults

This commit backports pending PR, which solves segfaults:
- https://github.com/Netatalk/Netatalk/pull/174

To fix issues with segfaults described here:
- https://github.com/openwrt/packages/issues/18571
- https://github.com/Netatalk/Netatalk/issues/175

Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
(cherry picked from commit ab768578cd06364cc9327a1718631d16e8aa3e20)

Revert "Revert "netatalk: update to version 3.1.13""

This can be finally re-reverted, so we can use version 3.1.13, which
fixes multiple security vulnerabilities, but it segfaults almost
immediately. There is currently pending pull request, which fixes this,
and multiple users confirmed that it works on different GNU/Linux distributions.

This reverts commit bfe255064eeed30d06cbd969e4be36a89d76d0eb.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #18671 from turris-cz/libxml_2.9.14_backport

libxml2: backport 2.9.14 version bump

libxml2: update to 2.9.14

This fixes CVE-2022-29824.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit c12e1cfcab318d0a5b48d63d5952af418e62822e)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>

libxml2: update to 2.9.13

This fixes CVE-2022-23308.

Also switch to GNOME as download source and xz tarball.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 81fd836f97aee93c8cfcb4ebbf901c2a99c3525c)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>

libxml2: update to 2.9.12

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 6b932d3ff77c63fe01080139c147c86da12f0c88)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>

libxml2: update to 2.9.10

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 10e867d0261a0e7d6a94a672104e7f25ae884eff)
[remove no longer needed CVE-2019-19956 patch (fixed in libxml2 2.9.10)]
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>

db47: don't depend on libxml2 at run-time

libxml2 seems to be required only during build, hence no need to
depend on it in run-time.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1f3585a3872e253d38d202274965cf05938efc3a)

muninlite: update to new upstream release (2.1.2)

Signed-off-by: Lars Kruse <devel@sumpfralle.de>

muninlite: update to new upstream release (2.1.1)

Signed-off-by: Kim B. Heino <b@bbbs.net>

muninlite: update to new upstream release (2.1.0)

Signed-off-by: Lars Kruse <devel@sumpfralle.de>

muninlite: Bump PKG_RELEASE

Signed-off-by: Francois Dechery <wxopwx@gmail.com>

muninlite: Fixes munin xinetd service not launching.

Signed-off-by: Francois Dechery <wxopwx@gmail.com>

muninlite: remove patch "hostname"

Since muninlite 2.0 the unpatched upstream also uses
/proc/sys/kernel/hostname.  Thus the patch is not necessary anymore.

Signed-off-by: Lars Kruse <devel@sumpfralle.de>

muninlite: remove unused sections from Makefile

Signed-off-by: Lars Kruse <devel@sumpfralle.de>

muninlite: update to 2.0.1

* follow upstream ressources to github
* rename /usr/sbin/munin-node to /usr/sbin/muninlite
  (following the chane of upstream)
* change plugin directory from /usr/sbin/munin-node-plugin.d/
  to /etc/munin/plugins (compatible to upstream / munin-node)
* all patches (except one OpenWrt-specific patch) were merged
  upstream

Signed-off-by: Lars Kruse <devel@sumpfralle.de>

openwisp-config: update to 1.0.0

Signed-off-by: Federico Capoano <f.capoano@openwisp.io>

Revert "netatalk: update to version 3.1.13"

We received a report from Turris user on Turris support department that
netatalk version 3.1.13 does not work properly.

Process afpd says: INTERNAL ERROR Signal 11
because of that Apple Time Machine does not work as it should

This was already reported to netatalk by different people on various
GNU/Linux distributions like CentOS, AlmaLinux [1] [2]

netatalk developer states [3]:
```
Generally, at this point I can only advice to stop using Netatalk. There
are more pending CVEs that I currently don't have the bandwidth to work on.
```

[1] https://sourceforge.net/p/netatalk/bugs/669/
[2] https://sourceforge.net/p/netatalk/bugs/670/
[3] https://sourceforge.net/p/netatalk/mailman/message/37638871/

This reverts commit 165c5625a3c696a37665d62b849eaa85b4d3815a.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

lxc: export systemd cgroups after install

otherwise, a user would have to either manually run /etc/init.d/lxc-auto
boot or reboot the system to start using lxc.

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 2cde10b95053bf958a4001fb0a82c4563bf345e2)

postgresql: security update to 11.16

* fixes CVE-2022-1552

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

youtube-dl: update to 2021.12.17

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit ef29bf0163669257c137ebf4e459757b37ddce96)

youtube-dl: update to version 2021.6.6

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit fbe30791792f47e6b925f80ca32f6b4573f4fb0d)

ecdsautils: update to v0.4.1

This fixes CVE-2022-24884.

Also update the package URL to match the source repository.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit de5671e58226a4cd062e92c2b12e20dcd7854e82)

bind: update to version 9.16.28

Changelog:
https://downloads.isc.org/isc/bind9/9.16.28/RELEASE-NOTES-bind-9.16.28.html

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

ruby: update to 2.6.10

Fixes from 2.6.9:
- CVE-2021-41817: Regular Expression Denial of Service Vulnerability of
  Date Parsing Methods
- CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parse

Fixes from 2.6.10:
- CVE-2022-28739: Buffer overrun in String-to-Float conversion

After this release, Ruby 2.6 reaches EOL.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>

sane-backends: revert BUILDONLY flag

BUILDONLY was disabling SANE backends (drivers) build.

Closes #14484

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit bf4340e19ecd85e44d9b5a08719dd0e531d2c20a)

zabbix: update to version 4.0.37

- Fixes CVE-2020-15803, CVE-2021-27927

- SourceForge does not provide tarball for version 4.0.37 and it was
necessary to use Zabbix CDN to download it.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

nano: provide nano-full with most features enabled

Provide a new variant, nano-full, that enables almost
all functionality of nano. Only libmagic file type detection
has been left out.

Ship with a minimal /etc/nanorc that the user can modify.
nanorc documentation at
https://www.nano-editor.org/dist/latest/nanorc.5.html

Provide color highlighting for the uci config files.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 6a51794638a64e5d72a2c0b69d70b8402fc316aa)

netatalk: update to version 3.1.13

Please update to this latest release as soon as possible as this
releases fixes the following major security issues: CVE-2021-31439,
CVE-2022-23121, CVE-2022-23122, CVE-2022-23123, CVE-2022-23124,
CVE-2022-23125 and CVE-2022-0194.

For a summary of news and a detailed list of changes see the
ReleaseNotes[1].

[1]: https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 951ef67479dbf52af124671d367dd5e1a6d16121)

coova-chilli: add dependency for miniportal

If miniportal option is enabled, some haserl scripts are provided which
present a simple login web page. To make it functional haserl is required.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 532088818af2eb2b1481420b93b649a10d14c724)

coova-chilli: clean up Makefile

- add missing configs to PKG_CONFIG_DEPENDS and sort it
- remove redundant INSTALL_DIR

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 2c71fb2065fdefdaca301943da48e93b59e54d82)

coova-chilli: remove dnslog option

dnslog feature has been removed since v1.4.

Signed-off-by: Sungbo Eo <mans0n@gorani.run>
(cherry picked from commit 95954b84f5f4b4fc114da5d96a04e704946cc9ea)

coova-chili: Fix version

Upstream was sloppy when cutting the release.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit df20377ee92a9ea5085771aee4ddefe12da1746c)

coova-chilli: Update to 1.5

Remove upstreamed patches.

Added patch to fix compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 68b5a71883ab8b421c2ce4e0a9486ec1d391e7f8)

Merge pull request #18127 from jefferyto/python-3.7.13-openwrt-19.07

[openwrt-19.07] python3: Update to 3.7.13, refresh patches

python3: Update to 3.7.13, refresh patches

Includes fixes for:
* Windows builds updated to bzip2 1.0.8 to mitigate CVE-2016-3189 and
  CVE-2019-12900
* CVE-2022-26488: Escalation of privilege via Windows Installer

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

bind: bump to 9.16.27

Fixes security issues:

 * CVE-2022-0396 -- A synchronous call to closehandle_cb() caused
isc__nm_process_sock_buffer() to be called recursively,
which in turn left TCP connections hanging in the
CLOSE_WAIT state blocking indefinitely when
out-of-order processing was disabled.

 * CVE-2021-25220 -- The rules for acceptance of records into the cache
have been tightened to prevent the possibility of
poisoning if forwarders send records outside
the configured bailiwick.

Signed-off-by: Noah Meyerhans <frodo@morgul.net>

syslog-ng: update to version 3.36.1

- Bump version in config file

Release notes:
https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-3.36.1

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 110d46eb370b9ea5962944386fb06c2abd1d50f1)

expat: import patches for CVEs

* import patches for CVEs from alpine 3.13

CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-23852, CVE-2022-23990
CVE-2022-25235, CVE-2022-25236, CVE-2022-25313, CVE-2022-25314, CVE-2022-25315

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 584c0c43782bf173c29e7406756335c11b6f73e6)

expat: update to 2.2.10

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c69160e6aea07da47a202418cd1b5195875f6694)

htpdate: drop freebsd.org from default server list

The FreeBSD project stopped publishing HTTP date headers and seeks to
limit further resource taxing by distributed htpdate clients using the
www.freebsd.org host as default time source.

Fixes: #17924
Reported-by: Allan Jude <allanjude@freebsd.org>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit e8713180026e0cf1c9d1421e3b664fee3fa4df12)

nano: update to 6.2

Update nano to 6.2.
Remove inactive second maintainer.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit a3f14c51149ff0c3604baf130987ee2bf5203edb)
[removed AUTORELEASE]

nano: update to 6.1

Update nano to version 6.1.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 717efb8c9622cc73bc8ab1c4ac2e67252b9c4401)
[removed aurorelease]

ruby: update to 2.6.9

* fixes CVE-2021-41817 and CVE-2021-41819

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>

Merge pull request #17778 from turris-cz/bind-19.07

bind: update to version 9.16.25

bind: update to version 9.16.25

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

CI: fix runtime testing for non master branch

The runtime testing always ran on master branch aka snapshots since the
branch wasn't passed over to the container execution!

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit f535d770901674d7d9f3d8cd9abe566d9db63ebe)

Merge pull request #17756 from BKPepe/nss-cve-2021-43527

nss: backport patch for CVE-2021-43527

nano: Add a plus variant with more features

Nano is by default built as "tiny" with most features disabled.
That is suitable for basic tasks in routers with small flash.

Add a new nano-plus variant that enables selected additional
features in the build config:
 * multiple files (multibuffer)
 * Unicode/utf8
 * justify
 * .nanorc support
 * help
 * also some key bindings get enabled as "tiny" configure option
   is removed.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 85cb71d8d81af3c549406d5f42080ed58be9b9b0)

nss: backport patch for CVE-2021-43527

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

prosody: update to version 0.11.13

Fixes CVEs:
- CVE-2022-0217
- CVE-2021-37601
- CVE-2021-32918
- CVE-2021-32920
- CVE-2021-32921
- CVE-2021-32917
- CVE-2021-32919

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit dcedbe802744102b215835f1dd53bc2bb5756807)

prosody: fix shellcheck warnings

Remove paxctl stuff. pax is not packaged in OpenWrt.

Add reload support.

Install lua cfg file as 644. It's needed to be readable as prosody user

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit eb46e231cd2a1fb816f06cf7d630adc864296abc)

prosody: update to 0.11.7

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 68a3a06e98c234069afaffbc59bcc169e9205e93)

prosody: update to 0.11.5

Signed-off-by: Vieno Hakkerinen <vieno@hakkerinen.eu>
(cherry picked from commit bc500293e37b806e6b880ede492c0c9b9f42268d)

prosody: /etc/prosody permissions fix

Signed-off-by: Sergio E. Nemirowski <sergio@outerface.net>
(cherry picked from commit 838306cb37aaede5c0db61559166b06737bf5c6b)

prosody: Update to 0.11.3

Several Makefile rearrangements for consistency between packages.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 73d29b9fd7b4abf4276b261fd113af2a1dcc4e2a)

tvheadend: fix conffiles section

The previous one was wrong, and it did not work. It could be checked
inside compiled package in control.tar.gz that there was missing
``conffiles`` file with content `/etc/config/tvheadend`

It is also possible to verify that the config is not overwritten on the router
by running ``opkg install tvheadend --force-reinstall``

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 752d1ffc28971b9b641162498a877750fa687bbd)

domoticz: backport patch to fix compilation with uClibc-ng

This helps to compile domoticz on arc target.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

domoticz: bump to 4.10717

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
(cherry picked from commit 7e50722145943e36bb687bc7462f8e483c8652b6)

domoticz: Fix compilation without deprecated OpenSSL APIs

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 8c77bcc19f4283813cdbb99842bb1c330fadf124)

netdata: Update init script to use -D rather than -nd

The current init script is using the deprecated -nd flag. This updates netdata to be started with -D.

Signed-off-by: James White <james@jmwhite.co.uk>
(cherry picked from commit cf9d5a887031f245fbae6f8bcd3366078996f123)

apache: security bump to 2.4.51

Fixes (see [1] for details):

  CVE-2021-33193
  CVE-2021-41524
  CVE-2021-41773
  CVE-2021-42013

[1] https://httpd.apache.org/security/vulnerabilities_24.html

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
(cherry picked from commit da4b1ca8d65b788d85489cd3ca83d91b0fd72f0f)

haveged: update to 1.9.17

Update havged to version 1.9.17.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit e065ccda94aff9ac39d0aeac0449e9cd2cecc703)
(Autorelease removed)

Merge pull request #17476 from BKPepe/buildonly

treewide: add missing BUILDONLY

treewide: add missing BUILDONLY

Fixes Makefile warnings:

WARNING: skipping X -- package has no install section

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5a7148d112113544611ee358a7d062cec85c1629)

zsh: drop bash syntax in postinst

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit c09d6042fe3b58d7eb0fdc65fc9968c47d98aea1)

zsh: fix invalid postrm script and little refactor of scripts

The postrm script was missing shebang. Postrm scripts are packaged and
executed directly and not sourced by default script (as in case of prerm
and postinst).

Also move some indents around to not confuse reader. The section in
postinst was indented to same level as grep "condition" but is on same
level as initial grep (not part of that "condition").

Signed-off-by: Karel Kočí <karel.koci@nic.cz>
(cherry picked from commit d2d193d81885cd2351e3bd53f6f4cc8ec092e26d)

nano: update to version 6.0

Update nano editor to version 6.0

Version 6.0 enable toggling the display of the line numbers with
the shortcut key M-N (Alt-n). Also the cmdline option "-l" works.
Remove earlier patch regarding that.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(backported from commits 0571f5400, 9023845d5 and ae7f62d63)

Merge pull request #17250 from ynezz/ynezz/cares-fix-CVE-2021-3672

[19.07] libs/c-ares: fix domain hijacking CVE-2021-3672

Merge pull request #17267 from BKPepe/postgresql-update

[19.07] postgresql: security update to version 11.14

msmtp: update to version 1.8.1.9

Changelog:
https://marlam.de/msmtp/news/msmtp-1-8-19/

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 173faad3340772e1b2194c618fb8c1f13f81b9a9)

postgresql: security update to version 11.14

Patch 001-configure_fixes does not apply anymore.
Other patches were refreshed.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

libs/c-ares: fix domain hijacking CVE-2021-3672

Missing input validation of host names returned by Domain Name Servers
in the c-ares library can lead to output of wrong hostnames (leading to
Domain Hijacking).

I've just taken patch from the advisory[1] and rebased it onto 1.15.0
version.

1. https://github.com/c-ares/c-ares/compare/809d5e8..44c009b.patch

Fixes: CVE-2021-3672
Signed-off-by: Petr Štetiar <ynezz@true.cz>

msmtp: update to version 1.8.17

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 18261fcd313b073e36a5ba39eeaf0aef808a1694)

syslog-ng: update to version 3.35.1

Also bump the version in syslog-ng config file.
Removes this warning:

Nov 16 14:19:41 turris syslog-ng[15159]: WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.35 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.33'

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 2d2fd36e28a40a63b1bd16c77cce57d446d656cc)

Merge pull request #17209 from peci1/patch-1

ddns-scripts: Fix wrong whitespace in preinst and postinst scripts

icu: Fix memory bug w/ baseName

CVE-2021-30535 : Double free in ICU
https://nvd.nist.gov/vuln/detail/CVE-2021-30535
https://security-tracker.debian.org/tracker/CVE-2021-30535

ICU-21587 : Fix memory bug w/ baseName
https://github.com/unicode-org/icu/pull/1698

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

ddns-scripts: Fix wrong whitespace in preinst and postinst scripts

Signed-off-by: Martin Pecka <peckama2@fel.cvut.cz>

bind: update to version 9.16.23

Changelog:
https://downloads.isc.org/isc/bind9/9.16.23/RELEASE-NOTES-bind-9.16.23.html

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

Merge pull request #17114 from paper42/cve-2019-19906-19

[19.07] cyrus-sasl: patch CVE-2019-19906

cyrus-sasl: patch CVE-2019-19906

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit f7717bd382d4f03c6353beaaf198d29a34c8e6ab)

Merge pull request #17110 from thg2k/pr/19_php72_ini_1

[19.07] php7: Update and clean up distributed php7.ini

php7: Clean up and update distributed php.ini for php 7.2.34

Details:
- Cleaned up whitespace and removed comments (refer to official PHP documentation for that)
- Removed directives that no longer exist as of PHP 7.2.34
- Added '~E_DEPRECATED' to 'error_reporting'

Directives removed that no longer exist as of PHP 7.2.34:
- zend.ze1_compatibility_mode
- y2k_compliance
- register_globals
- register_long_arrays
- magic_quotes_gpc
- magic_quotes_runtime
- magic_quotes_sybase
- always_populate_raw_post_data

Signed-off-by: Giovanni Giacobbi <giovanni@giacobbi.net>

syslog-ng: update to version 3.34.1

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit d8e88ef51ec85c3f459fb4e8bf0e08fa26cffb29)

ffmpeg: update to version 3.4.9 (security fix)

Fixes:
CVE-2020-13904
CVE-2020-2044
CVE-2020-20453
CVE-2020-22015
CVE-2020-22019
CVE-2020-22033
CVE-2020-22021
CVE-2020-22037
CVE-2020-35965
CVE-2021-38114
CVE-2021-38171
CVE-2021-38291

Refresh patches

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>

bind: Bump to 9.16.22

The following CVEs are addressed:

* CVE-2021-25219: The "lame-ttl" option is now forcibly set to 0. This
  effectively disables the lame server cache, as it could previously
  be abused by an attacker to significantly degrade resolver performance.

Signed-off-by: Noah Meyerhans <frodo@morgul.net>