[no description] https://git.osdyson.ru/mirror/pkgsrc/atom?h=pkgsrc-2016Q1 2016-07-02T13:53:04Z 2016-07-02T13:53:04Z bsiegert bsiegert@pkgsrc.org 2016-07-02T13:53:04Z urn:sha1:c313d10f0903bb5720fe1f7d1656561737e42c02 2016-06-28T19:38:32Z bsiegert bsiegert@pkgsrc.org 2016-06-28T19:38:32Z urn:sha1:628ae3a6ee9b72299d22f17c2e84195818da9d1a lang/php70: security fix Revisions pulled up: - lang/php/phpversion.mk 1.141 - lang/php70/Makefile 1.4 - lang/php70/Makefile.php 1.2 - lang/php70/distinfo 1.14 --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 24 15:27:57 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php70: Makefile Makefile.php distinfo Log Message: Update php70 to 7.0.8 (PHP 7.0.8), including security fixes. pkgsrc change: * remove confiugre from SUBST_FILES.path. * Remove --with-regex=3Dsystem and --without-mysql from CONFIGURE_ARGS.= * Add --without-mysqli to CONFIGURE_ARGS. 23 Jun 2016 PHP 7.0.8 - Core: . Fixed bug #72218 (If host name cannot be resolved then PHP 7 crashe= s). (Esminis at esminis dot lt) . Fixed bug #72221 (segfault, past-the-end access). (Lauri Kentt=E4) . Fixed bug #72268 (Integer Overflow in nl2br()). (Stas) . Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()). (Stas) . Fixed bug #72400 (Integer Overflow in addcslashes/addslashes). (Sta= s) . Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL).= (Stas) - FPM: . Fixed bug #72308 (fastcgi_finish_request and logging environment variables). (Laruence) - GD: . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas) . Fixed bug #72337 (invalid dimensions can lead to crash) (Pierre) . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (Pierre) . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas)= - Intl: . Fixed bug #64524 (Add intl.use_exceptions to php.ini-*). (Anatol) - mbstring: . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (= Stas) - mcrypt: . Fixed bug #72455 (Heap Overflow due to integer overflows). (Stas) - PCRE: . Fixed bug #72143 (preg_replace uses int instead of size_t). (Joe) - PDO_pgsql: . Fixed bug #71573 (Segfault (core dumped) if paramno beyond bound). (Laruence) . Fixed bug #72294 (Segmentation fault/invalid pointer in connection with pgsql_stmt_dtor). (Anatol) - Phpdbg: . Fixed bug #72284 (phpdbg fatal errors with coverage). (Bob) - Postgres: . Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free). (La= ruence) . Fixed bug #72197 (pg_lo_create arbitrary read). (Anatol) - SPL: . Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (S= tas) . Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorith= m and unserialize). (Dmitry) - Standard: . Fixed bug #72017 (range() with float step produces unexpected resul= t). (Thomas Punt) . Fixed bug #72193 (dns_get_record returns array containing elements = of type 'unknown'). (Laruence) . Fixed bug #72229 (Wrong reference when serialize/unserialize an obj= ect). (Laruence) . Fixed bug #72300 (ignore_user_abort(false) has no effect). (Laruenc= e) - XML: . Fixed bug #72206 (xml_parser_create/xml_parser_free leaks mem). (Jo= e) - XMLRPC: . Fixed bug #72155 (use-after-free caused by get_zval_xmlrpc_type). (Joe, Laruence) - WDDX: . Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (St= as) - Zip: . Fixed ug #72258 (ZipArchive converts filenames to unrecoverable for= m). (Anatol) . Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in = PHP's GC algorithm and unserialize). (Dmitry) 2016-06-28T19:37:34Z bsiegert bsiegert@pkgsrc.org 2016-06-28T19:37:34Z urn:sha1:819301cb97d1991ef0614434b90e77df0bda2d84 lang/php56: security fix Revisions pulled up: - lang/php/phpversion.mk 1.140 - lang/php56/Makefile 1.12 - lang/php56/distinfo 1.28 --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 24 15:25:21 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php56: Makefile distinfo Log Message: Update php56 to 5.6.23 (PHP 5.6.23), including security fixes. pkgsrc change: remove confiugre from SUBST_FILES.path. 23 Jun 2016, PHP 5.6.23 - Core: . Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()). (Stas) . Fixed bug #72400 (Integer Overflow in addcslashes/addslashes). (Stas) . Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL). (Stas) - GD: . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas) . Fixed bug #72337 (invalid dimensions can lead to crash) (Pierre) . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (Pierre) . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas) . Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (Pierre) - Intl: . Fixed bug #70484 (selectordinal doesn't work with named parameters). (Anatol) - mbstring: . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (Stas) - mcrypt: . Fixed bug #72455 (Heap Overflow due to integer overflows). (Stas) - Phar: . Fixed bug #72321 (invalid free in phar_extract_file()). (hji at dyntopia dot com) - SPL: . Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (Stas) . Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (Dmitry) - OpenSSL: . Fixed bug #72140 (segfault after calling ERR_free_strings()). (Jakub Zelenka) - WDDX: . Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (Stas) - zip: . Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (Dmitry) 2016-06-28T19:35:57Z bsiegert bsiegert@pkgsrc.org 2016-06-28T19:35:57Z urn:sha1:00e1b9346e0038182d0227289a57e8a56015b465 lang/php55: security fix Revisions pulled up: - lang/php/phpversion.mk 1.139 - lang/php55/Makefile 1.27 - lang/php55/distinfo 1.54 --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 24 15:23:00 UTC 2016 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php55: Makefile distinfo Log Message: Update php55 to 5.5.37 (PHP 5.5.37), including security fixes. pkgsrc change: remove confiugre from SUBST_FILES.path. 23 Jun 2016, PHP 5.5.37 - Core: . Fixed bug #72268 (Integer Overflow in nl2br()). (Stas) . Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()). (Stas) . Fixed bug #72400 (Integer Overflow in addcslashes/addslashes). (Stas) . Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL). (Stas) - GD: . Fixed bug #66387 (Stack overflow with imagefilltoborder) (CVE-2015-8874). (cmb) . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas) . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (Pierre) . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas) . Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (Pierre) - mbstring: . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (Stas) - mcrypt: . Fixed bug #72455 (Heap Overflow due to integer overflows). (Stas) - SPL: . Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (Stas) . Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (Dmitry) - WDDX: . Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (Stas) - zip: . Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (Dmitry) 2016-06-28T19:32:52Z bsiegert bsiegert@pkgsrc.org 2016-06-28T19:32:52Z urn:sha1:e9a36d76fb7422cabe9e07613f7ef1db97c70f1f graphics/optipng: security fix Revisions pulled up: - graphics/optipng/Makefile 1.33 - graphics/optipng/distinfo 1.29 - graphics/optipng/patches/patch-src_optipng_osys.c deleted --- Module Name: pkgsrc Committed By: adam Date: Fri Jun 17 14:03:10 UTC 2016 Modified Files: pkgsrc/graphics/optipng: Makefile distinfo Removed Files: pkgsrc/graphics/optipng/patches: patch-src_optipng_osys.c Log Message: Version 0.7.6 ------------- * Upgraded libpng to version 1.6.21. ! Fixed an assertion failure in the image reduction code. !! Fixed various security-sensitive defects in the BMP decoder. ! Fixed a benign uninitialized memory read in the GIF decoder. ! Fixed a build failure occurring under the Estonian (et_EE) locale. ! Fixed a build failure occurring on Mac OS X, FreeBSD, and possibly other systems that lack POSIX-compliant high-resolution timestamps. ! Fixed a typo causing build failures in 32-bit ANSI C compilation. 2016-06-28T19:24:41Z bsiegert bsiegert@pkgsrc.org 2016-06-28T19:24:41Z urn:sha1:33a3dd921c62cc69458aa8115125c408275444d4 multimedia/adobe-flash-plugin: security fix Revisions pulled up: - multimedia/adobe-flash-plugin11/Makefile 1.61 - multimedia/adobe-flash-plugin11/distinfo 1.58 --- Module Name: pkgsrc Committed By: tsutsui Date: Thu Jun 16 16:30:06 UTC 2016 Modified Files: pkgsrc/multimedia/adobe-flash-plugin11: Makefile distinfo Log Message: Update adobe-flash-plugin11 to 11.2.202.626. Upstream announcement: https://helpx.adobe.com/security/products/flash-player/apsb16-18.html Adobe Security Bulletin Security updates available for Adobe Flash Player Release date: June 16, 2016 Vulnerability identifier: APSB16-18 CVE number: CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4135, CVE-2016-4136, CVE-2016-4137, CVE-2016-4138, CVE-2016-4139, CVE-2016-4140, CVE-2016-4141, CVE-2016-4142, CVE-2016-4143, CVE-2016-4144, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148, CVE-2016-4149, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 Platform: Windows, Macintosh, Linux and ChromeOS 2016-06-28T18:59:07Z bsiegert bsiegert@pkgsrc.org 2016-06-28T18:59:07Z urn:sha1:d9d4a1a5a19fd1f818aa487aaf2c60c1a83d1902 lang/php70: build fix Revisions pulled up: - lang/php70/distinfo 1.13 - lang/php70/patches/patch-sapi_cli_Makefile.frag 1.3 --- Module Name: pkgsrc Committed By: joerg Date: Tue Jun 7 19:23:50 UTC 2016 Modified Files: pkgsrc/lang/php70: distinfo pkgsrc/lang/php70/patches: patch-sapi_cli_Makefile.frag Log Message: Unbreak unprivileged build. Actually test for executable. 2016-06-25T19:49:01Z bsiegert bsiegert@pkgsrc.org 2016-06-25T19:49:01Z urn:sha1:db068e74662ac399a4bbe0830406e33475b55c18 2016-06-25T19:48:46Z bsiegert bsiegert@pkgsrc.org 2016-06-25T19:48:46Z urn:sha1:bb144ad4be7414176284c666ea707c3d15b65ca4 www/drupal7: security fix Revisions pulled up: - www/drupal7/Makefile 1.39 - www/drupal7/distinfo 1.30 --- Module Name: pkgsrc Committed By: taca Date: Thu Jun 16 23:20:16 UTC 2016 Modified Files: pkgsrc/www/drupal7: Makefile distinfo Log Message: Update drupal7 to 7.44 (Drupal 7.44). Drupal 7.44, 2016-06-15 ----------------------- - Fixed security issues (privilege escalation). See SA-CORE-2016-002. 2016-06-19T17:03:47Z spz spz@pkgsrc.org 2016-06-19T17:03:47Z urn:sha1:1bd1e0fd521f6cbb4fdc33a9fbe100700e777ef6