[Buildroot] [git commit branch/2025.02.x] package/dropbear: security bump version to 2026.93

commit: https://gitlab.com/buildroot.org/buildroot/-/commit/89d60620e413a0024b796811823b311070893427
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/2025.02.x

https://matt.ucc.asn.au/dropbear/CHANGES

- Security: Fix a use-after-free in X11 forwarding that could possibly lead
  to memory corruption. This is vulnerable to authenticated users if X11
  forwarding is enabled. By default X11 forwarding is not built.
  In 2026.89 the server is running as the authenticated user for X11
  forwarding, in earlier versions it runs as root.
  This removes X11 "single connection" which has probably never been used.
  Reported by @peter-pe
  https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4

Added patch to fix build errors which would be introduced by this bump:
https://github.com/mkj/dropbear/commit/86baa66fc934bb55a911eacec28d93d86fb0e6f8

Signed-off-by: Bernd Kuhls <[email protected]>
Signed-off-by: Julien Olivain <[email protected]>
(cherry picked from commit 0c8bd5739c1d63550bc80f0b204f67ff8a2854c8)
Signed-off-by: Thomas Perale <[email protected]>
---
 .../0001-scp-fix-build-with-gcc-14.x.patch         | 40 ++++++++++++++++++++++
 package/dropbear/dropbear.hash                     |  2 +-
 package/dropbear/dropbear.mk                       |  2 +-
 3 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/package/dropbear/0001-scp-fix-build-with-gcc-14.x.patch b/package/dropbear/0001-scp-fix-build-with-gcc-14.x.patch
new file mode 100644
index 0000000000..0c2b5cbdb5
--- /dev/null
+++ b/package/dropbear/0001-scp-fix-build-with-gcc-14.x.patch
@@ -0,0 +1,40 @@
+From 0c67372257575f6ec59364aba5ca579c126b7678 Mon Sep 17 00:00:00 2001
+From: Voxel <[email protected]>
+Date: Tue, 21 Jul 2026 19:28:00 +0200
+Subject: [PATCH] scp: fix build with gcc >= 14.x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes build errors seen with gcc 14.x:
+
+src/scp.c: In function ‘sink’:
+src/scp.c:1214:32: error: implicit declaration of function ‘ascii_isdigit’
+ [-Wimplicit-function-declaration]
+
+src/scp.c: In function ‘okname’:
+src/scp.c:1501:22: error: implicit declaration of function ‘ascii_isalpha’
+ [-Wimplicit-function-declaration]
+
+Upstream: https://github.com/mkj/dropbear/pull/474
+
+Signed-off-by: Bernd Kuhls <[email protected]>
+---
+ src/scp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/scp.c b/src/scp.c
+index d7266fdd..633b4dba 100644
+--- a/src/scp.c
++++ b/src/scp.c
+@@ -81,6 +81,7 @@
+ #include "compat.h"
+ #include "scpmisc.h"
+ #include "progressmeter.h"
++#include "dbutil.h"
+ 
+ void bwlimit(int);
+ 
+-- 
+2.47.3
+
diff --git a/package/dropbear/dropbear.hash b/package/dropbear/dropbear.hash
index 9df81ea4b5..2538132463 100644
--- a/package/dropbear/dropbear.hash
+++ b/package/dropbear/dropbear.hash
@@ -1,5 +1,5 @@
 # From https://matt.ucc.asn.au/dropbear/releases/SHA256SUM.asc
-sha256  91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e  dropbear-2026.92.tar.bz2
+sha256  310a6087952897c182efbe16088fa0c4d07c467e850a22699472137278fabf09  dropbear-2026.93.tar.bz2
 
 # License file, locally computed
 sha256  a99ce657d790b761c132ee7e0de18edb437ae6361e536d991c6a12f36e770445  LICENSE
diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
index e7e6703057..e595ebc10c 100644
--- a/package/dropbear/dropbear.mk
+++ b/package/dropbear/dropbear.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DROPBEAR_VERSION = 2026.92
+DROPBEAR_VERSION = 2026.93
 DROPBEAR_SITE = https://matt.ucc.asn.au/dropbear/releases
 DROPBEAR_SOURCE = dropbear-$(DROPBEAR_VERSION).tar.bz2
 DROPBEAR_LICENSE = MIT, BSD-2-Clause, Public domain

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot