(cherry picked from commit 83102fc)

(cherry picked from commit b98fa7c)

(cherry picked from commit f9ef2c1)

(cherry picked from commit 5858162)

(cherry picked from commit 7d1c2c0)

(cherry picked from commit 01de13a)

(cherry picked from commit 461843a)

(cherry picked from commit 86aab71)

(cherry picked from commit 4b7193b)

(cherry picked from commit e036261)

(cherry picked from commit 5f70a20)

(cherry picked from commit 2986699)

(cherry picked from commit 606a15d)

(cherry picked from commit 9f0dba1)

(cherry picked from commit affebc8)

(cherry picked from commit 22af8e8)

(cherry picked from commit 21d3ce5)

Wrap Qt program manually, remove makeWrapper from nativeBuildInputs.

(cherry picked from commit 98f1266)

Wrap Qt program manually, remove makeWrapper from nativeBuildInputs.

(cherry picked from commit a0a076b)

(cherry picked from commit 4ee9179)

(cherry picked from commit cc8d121)

(cherry picked from commit adae9f1)

(cherry picked from commit ec92227)

(cherry picked from commit 9384f48)

(cherry picked from commit 7dce1c5)

(cherry picked from commit 65050cd)

(cherry picked from commit 2e8962b)

(cherry picked from commit 1d8ea89)

(cherry picked from commit d5b14e5)

openssl/openssl@eb56324
openssl/openssl@64eef86

[19.09] openssl: patch CVE-2020-1967

Build security updates on release branch so *-small channel is updated as soon as possible.

https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/886

(cherry picked from commit d0419f9c25625a6c8a8916351077146c764b0e6c)

AP mode PMF disconnection protection bypass

Published: September 11, 2019
Identifiers:
- CVE-2019-16275
Latest version available from: https://w1.fi/security/2019-7/

Vulnerability

hostapd (and wpa_supplicant when controlling AP mode) did not perform
sufficient source address validation for some received Management frames
and this could result in ending up sending a frame that caused
associated stations to incorrectly believe they were disconnected from
the network even if management frame protection (also known as PMF) was
negotiated for the association. This could be considered to be a denial
of service vulnerability since PMF is supposed to protect from this type
of issues. It should be noted that if PMF is not enabled, there would be
no protocol level protection against this type of denial service
attacks.

An attacker in radio range of the access point could inject a specially
constructed unauthenticated IEEE 802.11 frame to the access point to
cause associated stations to be disconnected and require a reconnection
to the network.

Vulnerable versions/configurations

All hostapd and wpa_supplicants versions with PMF support
(CONFIG_IEEE80211W=y) and a runtime configuration enabled AP mode with
PMF being enabled (optional or required). In addition, this would be
applicable only when using user space based MLME/SME in AP mode, i.e.,
when hostapd (or wpa_supplicant when controlling AP mode) would process
authentication and association management frames. This condition would
be applicable mainly with drivers that use mac80211.

Possible mitigation steps

- Merge the following commit to wpa_supplicant/hostapd and rebuild:

  AP: Silently ignore management frame from unexpected source address

  This patch is available from https://w1.fi/security/2019-7/

- Update to wpa_supplicant/hostapd v2.10 or newer, once available

(cherry picked from commit 3e9f3a3)

[19.09] hostapd: apply patch for CVE-2019-16275

[19.09] Use qt5's mkDerivation in packages that otherwise crash

Kyndig on IRC noticed that building `ninja` from source would fail due
to a patch 404'ing (because the repo appears to no longer exist). Fetch
from upstream instead.

(cherry picked from commit 91d4e9a)
cc #85742

'toString false' results in an empty string, which, in this context,
is a syntax error. Use boolToString instead.

Fixes #86160

(cherry picked from commit c0a838d)

nixos/gitlab: Fix services.gitlab.enableStartTLSAuto

See
https://about.gitlab.com/releases/2020/04/14/critical-security-release-gitlab-12-dot-9-dot-3-released/
for details.

(cherry picked from commit d190292)

While it's already possible to invoke `update-data` with the `--rev`
argument, one still needs to run all later phases manually.

Fix this, by having `update-all` also accept a `--rev` argument, and
pass it down to `update-data`.

Also, make the help text a bit more usable, by suggesting the usual
versioning scheme used these times.

(cherry picked from commit 191c2c67a409ae8cf3d3bee7811a7b10397efe81)

(cherry picked from commit f7ddd30bef15238d6d9a12f48408d38571944d85)

(cherry picked from commit c86c77be0cf45023586e7252bfb05238ae6d38db)

`bundix -l` doesn't work, as it treats bundler's warning about upgrading
the lockfile version as an error, so invoke `bundle lock` manually.

(cherry picked from commit 4c26ab4)

https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_27.html

This update includes 2 security fixes.

CVEs: CVE-2020-6462 CVE-2020-6461
(cherry picked from commit db4aece)

Fixes: CVE-2020-6061, CVE-2020-6062

An exploitable heap overflow vulnerability exists in the way CoTURN
4.5.1.1 web server parses POST requests. A specially crafted HTTP
POST request can lead to information leaks and other misbehavior.
An attacker needs to send an HTTPS request to trigger this vulnerability.

An exploitable denial-of-service vulnerability exists in the way
CoTURN 4.5.1.1 web server parses POST requests. A specially crafted
HTTP POST request can lead to server crash and denial of service.
An attacker needs to send an HTTP request to trigger this vulnerability.

(cherry picked from commit 704a018)

[19.09] coturn: apply patch for CVE-2020-6061/6062

(cherry picked from commit 4644776)