www/immich: Security update to 3.4.0
An attacker-chosen OAuth state cookie allowed forced account linking and
takeover of any account. Further fixes cover a partner reading locked
folder metadata, read-scoped API keys resetting cluster group people
data, an unbounded motion photo offset exhausting memory and disk, and a
share link revealing whether the owner has a given file.
Adds JPEG XL support, two new match types for the EXIF metadata filter
and a trigger that runs a workflow once OCR processing has finished.
Changelog:
https://github.com/immich-app/immich/releases/tag/v3.4.0
Security: 9e9c6e36-dd9f-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
www/immich-cli: Security update to 3.4.0
A malicious or intercepted server could read, exfiltrate and delete
arbitrary local files through the duplicate check.
Changelog:
https://github.com/immich-app/immich/releases/tag/v3.4.0
Security: 9e9c6e36-dd9f-11f1-bae2-3497f65b111b
Sponsored by: Netzkommune GmbH
net-mgmt/semaphore: Update to 2.20.23
Keeps the chosen language per user, fixes deleting a user and no longer
submits the CLI argument dialog on Enter.
The vendored modernc.org/sqlite now carries current FreeBSD bindings for
every architecture, so the restriction to aarch64 and amd64 can go.
Changelog:
https://github.com/semaphoreui/semaphore/releases/tag/v2.20.23
Sponsored by: Netzkommune GmbH
periodic: Fix empty output check
The empty_output variable is normalized to YES or NO, but we were
comparing it to TRUE, so the comparison always failed no matter what it
was set to. Compare it to YES instead.
This feature has been disabled since 2007, so flip the default to NO to
preserve the current behavior. Adjust the documentation accordingly.
Relnotes: yes
PR: 300676
MFC after: 1 week
Fixes: 68c35072f914 ("Add an option to make periodic(8) quiet when no output was generated.")
Reviewed by: ivy, emaste
Differential Revision: https://reviews.freebsd.org/D61435
tests: udp_bindings: connect_bound_socket_from_2address_jail mark XFAIL in CI
This testcase has been failing reliably in CI since it was introduced in
2e16d37e275f. Mark the testcase XFAIL when run via CI to make the
overall test run a bit more green.
PR: 300696
MFC after: 1 week
security/doas: Do not install sample as doas.conf
The doas.conf.sample was not installed as sample intentionally.
PR: 300634
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 86deb2ebd4f97e44078e6145bf4e169940a06e5c)
tests/sys/netlink: mark :overflow as XFAIL when run via CI
This testcase has been failing reliably for 5+ months now. Mark it as an
expected failure to make the standard Jenkins run a bit more green.
PR: 289240
MFC after: 1 week
security/doas: Do not install sample as doas.conf
The doas.conf.sample was not installed as sample intentionally.
PR: 300634
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
top: allow filtering by command name
top(1) already supports interactive command filtering using
the '/' key. Support it also with a command line
argument '-g' / '--grep'.
Reviewed by: kib
Obtained from: OpenBSD
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D61160
cd9660: Fix dereferencing invalid RR outlen ptr
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the
initializers set the `outlen` field while the other two,
`cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized.
The uninitialized paths can dereference an invalid pointer on error
paths which causes a kernel panic.
To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's
initialized and check that `outlen` is non-null on the error path
in `cd9660_rrip_loop`.
While testing the above, I encountered another kernel panic due to
mounting continuing after the error branch. Evidently, the ISO continued
mounting through the normal ISO 9660 path then triggered a panic down
the line due to a very broken file system from the ISO. To fix that, I
propagate the error from the RR path then fail in the mount path.
[13 lines not shown]
security/py-keepkey: Fix Python 3 and protobuf compatibility
Regenerate protobuf modules at build time to fix import failures with
current protobuf. Use the device-protocol revision matching upstream
7.2.1, which includes the required Tendermint definitions.
Fix Python 2 remnants in keepkeyctl and protobuf_json, and support
the protobuf descriptor API changes. Remove the unused exchange
module, which depends on the obsolete protobuf3 library.
Switch to PEP 517, correct the package version metadata, add the
python category, and expand the port description. Bump PORTREVISION.
PR: 300278
bhyve: rfb: do not destroy a mutex that was never initialized
rfb_init()'s error path tests pixfmt_mtx against NULL, which only
compiles where pthread_mutex_t is a pointer, and destroys it. Every
jump to that label is before the mutex is initialized, so there is
nothing to destroy. The test and the destroy came in with the
SetPixelFormat support (D46402).
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Fixes: dda0f9837b1c ("bhyve: support noVNC SetPixelFormat request")
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61425
bhyve: nvme: initialize the AEN condition variable
aen_cond is used with pthread_cond_wait() and pthread_cond_signal() but
never initialized. That works where a zeroed pthread_cond_t is
initialized on first use; elsewhere pthread_cond_wait() fails at once
and aen_thr() spins with aen_mtx held.
Signed-off-by: Wanpeng Qian <wanpengqian at gmail.com>
Reviewed by: markj
MFC after: 1 week
Sponsored by: keelos.dev
Differential Revision: https://reviews.freebsd.org/D61424
pmap: Fix some bugs around accounting of wired mappings
The amd64 and arm64 pmaps failed to decrement the count when tearing
down a 1GB largepage mapping. The riscv pmap failed to decrement the
count when unwiring a superpage mapping.
Reported by: alc
Reviewed by: bnovkov, alc, kib
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61414
link_elf: validate the section headers in link_elf_load_file()
e_shentsize isn't checked, and e_shstrndx, sh_link and sh_name are used
unchecked. Do what link_elf_obj.c does.
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61389
link_elf: bounds-check the dynamic section's tables
parse_dynamic() only checks the DT_HASH header. nbuckets, nchains and
the other DT_* tables come from the module unchecked. Check them
against the mapping, and reject a size without its table.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61387
link_elf: validate symbol name offsets
st_name isn't checked against the string table size, for any of the
symbol tables used here. Do what link_elf_obj.c does since 4e2c2842e.
Reported by: llm-postcr
MFC after: 1 week
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D61388
sysvmsg: Fix sequence number wraparound races
The SysV message queue code has the same problem that we fixed in the
semaphore code in SA-26:54.sysvsem and SA-26:64.sysvsem. That is,
kern_msgrcv() and kern_msgsnd() are susceptible to TOCTOU races when
they sleep waiting for messages and queue space, respectively. Unlike
the semaphore code, however, the message queue array is never resized
and there is no notion of message queue sets, so such races do not open
up any memory safety bugs.
Fix the races, following the pattern from the SysV semaphore changes:
use a global sequence number array with wide counters, to avoid changing
the KBI which is embedded in userspace tools. Fix kern_msgsnd(), which
did not validate the sequence number at all after sleeping. Use a
msgvalid() helper to factor out some duplicated checks. Convert a
couple of local flag variables to bools.
Reported by: Apex Security Research
Reviewed by: kib
[3 lines not shown]
