package/qt5/qt5webengine: security bump to version 5.15.19
commit: https://gitlab.com/buildroot.org/buildroot/-/commit/f753f0980f5952cd57f51081ad09573aa5640aa7
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/master
Fixes the following security issues:
- CVE-2024-10229: inappropriate implementation in Extensions
- CVE-2024-10827: use after free in Serial
- CVE-2024-12694: use after free in Compositing
- CVE-2025-0436: integer overflow in Skia
- CVE-2024-11477: issue in the LZMA SDK
- CVE-2025-0996: inappropriate implementation in Browser UI
- CVE-2025-1426: heap buffer overflow in GPU
- CVE-2025-0762: use after free in DevTools
- CVE-2025-0999: heap buffer overflow in V8
- CVE-2024-55549: use after free related to excluded namespaces in libxslt
- CVE-2025-24855: use after free of XPath context node in libxslt
- CVE-2025-1919: issue in Chromium
- CVE-2025-2783: incorrect handle provided in unspecified circumstances in Mojo on Windows
- CVE-2025-24201: issue in ANGLE
- CVE-2025-2136: issue in Chromium
- CVE-2025-3619: issue in Chromium
Bump qt5webengine to the v5.15.19-lts tag, following QT5_VERSION again, and qt5webengine-chromium to the submodule version of this tag.
For qt5webengine-chromium, the Python 3.12/3.13 fixes backported by Qt make some of our patches obsolete:
- 0002-Remove-unused-python-import.patch is dropped, merged upstream in cd438f6f3546 ("[backport] Fix builds with pyhton 3.12");
- 0004-tools-grit-grit-util.py-fix-Python-3.12-build-issue.patch is dropped, as e78dbf724ae0 ("[backport] Fixes for python 3.12") fixes the same imports;
- 0008-Shorted-printed-cmd-when-long-commands-fail.patch is dropped, as 480e246dfe9d ("Fix build with python 3.12/3.13") already removes the pipes module, which is what we needed it for;
- 0006-protobuf-python-google-protobuf-internal-python_mess.patch is
refreshed: its first hunk is dropped, as 480e246dfe9d removes the six.moves import itself, and keeps the six import that new code uses.
The remaining patches are renumbered.
The LICENSE hash of the LZMA SDK changed in qt5webengine-chromium: a paragraph detailing the public domain terms was added to it with the update of the LZMA SDK.
--- ...tch => 0002-Migrate-presubmit-to-python3.patch} | 0 .../0002-Remove-unused-python-import.patch | 47 --------------- ...Fix-build-in-Python-3.11-invalid-mode-rU.patch} | 0 ...hon-google-protobuf-internal-python_mess.patch} | 14 +---- ...-grit-util.py-fix-Python-3.12-build-issue.patch | 70 ---------------------- ...-command_buffer-service-program_manager..patch} | 0 ...nclude-cstdint-for-uintptr_t-uint8_t-etc.patch} | 0 ...0007-Fix-build-with-glibc-2.43-and-above.patch} | 0 ...orted-printed-cmd-when-long-commands-fail.patch | 57 ------------------ .../qt5webengine-chromium.hash | 4 +- .../qt5webengine-chromium/qt5webengine-chromium.mk | 2 +- package/qt5/qt5webengine/qt5webengine.hash | 2 +- package/qt5/qt5webengine/qt5webengine.mk | 2 +- 13 files changed, 7 insertions(+), 191 deletions(-)
package/qt5/qt5webengine-chromium/0002-Migrate-presubmit-to-python3.patch renamed from package/qt5/qt5webengine-chromium/0003-Migrate-presubmit-to-python3.patch +0 -0
package/qt5/qt5webengine-chromium/0002-Remove-unused-python-import.patch deleted +0 -47
47 lines not on this page · raw message
package/qt5/qt5webengine-chromium/0003-Fix-build-in-Python-3.11-invalid-mode-rU.patch renamed from package/qt5/qt5webengine-chromium/0005-Fix-build-in-Python-3.11-invalid-mode-rU.patch +0 -0
package/qt5/qt5webengine-chromium/0004-protobuf-python-google-protobuf-internal-python_mess.patch renamed from package/qt5/qt5webengine-chromium/0006-protobuf-python-google-protobuf-internal-python_mess.patch +2 -12
@@ -18,17 +18,7 @@ diff --git a/chromium/third_party/protobuf/python/google/protobuf/internal/pytho index 803ae848493..a1954ce88c9 100755 --- a/chromium/third_party/protobuf/python/google/protobuf/internal/python_message.py +++ b/chromium/third_party/protobuf/python/google/protobuf/internal/python_message.py -@@ -55,9 +55,6 @@ import struct - import sys - import weakref - --import six --from six.moves import range -- - # We use "as" to avoid name collisions with variables. - from google.protobuf.internal import api_implementation - from google.protobuf.internal import containers -@@ -467,7 +464,7 @@ def _ReraiseTypeErrorWithFieldName(message_name, field_name): +@@ -466,7 +466,7 @@ def _ReraiseTypeErrorWithFieldName(message_name, field_name): exc = TypeError('%s for field %s.%s' % (str(exc), message_name, field_name)) # re-raise possibly-amended exception with original traceback:
@@ -37,7 +27,7 @@ index 803ae848493..a1954ce88c9 100755 def _AddInitMethod(message_descriptor, cls): -@@ -480,7 +477,7 @@ def _AddInitMethod(message_descriptor, cls): +@@ -479,7 +479,7 @@ def _AddInitMethod(message_descriptor, cls): enum_type with the same name. If the value is not a string, it's returned as-is. (No conversion or bounds-checking is done.) """
package/qt5/qt5webengine-chromium/0004-tools-grit-grit-util.py-fix-Python-3.12-build-issue.patch deleted +0 -70
70 lines not on this page · raw message
package/qt5/qt5webengine-chromium/0005-chromium-gpu-command_buffer-service-program_manager..patch renamed from package/qt5/qt5webengine-chromium/0007-chromium-gpu-command_buffer-service-program_manager..patch +0 -0
package/qt5/qt5webengine-chromium/0006-Include-cstdint-for-uintptr_t-uint8_t-etc.patch renamed from package/qt5/qt5webengine-chromium/0009-Include-cstdint-for-uintptr_t-uint8_t-etc.patch +0 -0
package/qt5/qt5webengine-chromium/0007-Fix-build-with-glibc-2.43-and-above.patch renamed from package/qt5/qt5webengine-chromium/0010-Fix-build-with-glibc-2.43-and-above.patch +0 -0
package/qt5/qt5webengine-chromium/0008-Shorted-printed-cmd-when-long-commands-fail.patch deleted +0 -57
57 lines not on this page · raw message
package/qt5/qt5webengine-chromium/qt5webengine-chromium.hash +2 -2
@@ -1,5 +1,5 @@ # Locally calculated -sha256 c1c73b6b72a90bb345e0d4365b9e69ce05e898d1c4480a4e9444e39a1c2801da qtwebengine-chromium-85337c28bae7d7d2c79282c4f4c92435cd7649b8.tar.bz2 +sha256 a1a41e5bb70594081c475af697abc4121df5a504815b99da9bbe66dd99604271 qtwebengine-chromium-6d29e9cfcfffa7632cc3858ceaf8940677ba9c91.tar.bz2 # Locally calculated with: # for i in $(find * -type f \( -iname 'license*' -o -iname 'copying*' -o -name 'APPLE_LICENSE' -o -name 'Copyright' -o -path '*/license_texts/*' -o -path '*/licenses/*' \) -a -not -name '*.cc' -not -name '*.py' -not -name '*.pyc' -not -name '*.h' -not -name 'LICENSE.sha1' -not -name 'licensecheck.pl*' -not -name 'license.after' -not -name 'license.before' -not -path 'chromium/third_party/catapult/*') ; do echo -n "sha256 " ; sha256sum $i ; done | sort --key=3
@@ -1055,7 +1055,7 @@ sha256 31346421254a3e6e12687cf17f19f6357ee73a617fa7b3d3ccefdcbabe49bdd3 chromi sha256 7e48e290b6bfccc2ec1b297023a1d77f2fd87417f71fbb9f50aabef40a851819 chromium/third_party/libxslt/src/Copyright sha256 2b2cc1180c7e6988328ad2033b04b80117419db9c4c584918bbb3cfec7e9364f chromium/third_party/libyuv/LICENSE sha256 0d4077a7055ead389c4c5a9a6ac4bb8b784fc6e9e37be2caf544fcceed26cb16 chromium/third_party/lottie/LICENSE -sha256 6e3e0a978f1e136cb3efb89702f4314671581a0c70c9a52447669e00f7b129e8 chromium/third_party/lzma_sdk/LICENSE +sha256 7de6196d9c03ec05e626d4fe7ab86a9c900f11d73176a816423fc14e0a1ee0de chromium/third_party/lzma_sdk/LICENSE sha256 c3b124673c93872156757a934c75b498d68eec09510e25e549d9dc2013776499 chromium/third_party/mako/LICENSE sha256 0bbe88228fd63d20ec097f64e58d5a0a465123ae139140a18d406c60b48824b5 chromium/third_party/markupsafe/LICENSE sha256 58d1e17ffe5109a7ae296caafcadfdbe6a7d176f0bc4ab01e12a689b0499d8bd chromium/third_party/material_design_icons/LICENSE
package/qt5/qt5webengine-chromium/qt5webengine-chromium.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -QT5WEBENGINE_CHROMIUM_VERSION = 85337c28bae7d7d2c79282c4f4c92435cd7649b8 +QT5WEBENGINE_CHROMIUM_VERSION = 6d29e9cfcfffa7632cc3858ceaf8940677ba9c91 QT5WEBENGINE_CHROMIUM_SITE = $(QT5_SITE)/qtwebengine-chromium/-/archive/$(QT5WEBENGINE_CHROMIUM_VERSION) QT5WEBENGINE_CHROMIUM_SOURCE = qtwebengine-chromium-$(QT5WEBENGINE_CHROMIUM_VERSION).tar.bz2 QT5WEBENGINE_CHROMIUM_PATCH_DEPENDENCIES = qt5webengine-chromium-catapult
package/qt5/qt5webengine/qt5webengine.hash +1 -1
@@ -1,5 +1,5 @@ # Locally calculated -sha256 8fa9d026fe0d04cb436ab7a66cdf249d189a91b61c565a1564a9bf05c7c73f7a qtwebengine-v5.15.18-lts.tar.bz2 +sha256 0d11c3ca5bf6f23d9d77fc43c53afad5b0deed6909f3a84b6ee7ed5790222393 qtwebengine-v5.15.19-lts.tar.bz2 # Locally calculated sha256 f34787ef0342c614b667186a6ec2f5d6b9d650e30142a2788a589a89743e88e9 LICENSE.Chromium
package/qt5/qt5webengine/qt5webengine.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -QT5WEBENGINE_VERSION = 5.15.18 +QT5WEBENGINE_VERSION = $(QT5_VERSION) QT5WEBENGINE_SITE = $(QT5_SITE)/qtwebengine/-/archive/v$(QT5WEBENGINE_VERSION)-lts QT5WEBENGINE_SOURCE = qtwebengine-v$(QT5WEBENGINE_VERSION)-lts.tar.bz2 QT5WEBENGINE_DEPENDENCIES = qt5declarative qt5webchannel
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot