pkgsrc, branch pkgsrc_2012Q2

Pullup tickets #3922 and #3923.

2012-09-27T11:10:28Z

Pullup ticket #3923 - requested by taca

2012-09-27T11:09:33Z

graphics/optipng: security update Revisions pulled up: - graphics/optipng/Makefile 1.26-1.27 - graphics/optipng/distinfo 1.22-1.23 --- Module Name: pkgsrc Committed By: adam Date: Sat Sep 1 09:19:20 UTC 2012 Modified Files: pkgsrc/graphics/optipng: Makefile distinfo Log Message: Changes 0.7.2: * Upgraded libpng to version 1.4.12. * Upgraded zlib to version 1.2.7-optipng. ! Fixed the display of huge (4GB+) file/IDAT sizes on 32-bit platforms. ! Issued a proper error message if the output IDAT can't fit in 2GB. Acknowledged this limitation in the user manual. (Thanks to John Sauter for the report.) ! Fixed the output file cleanup that should occur after a write error. * Added the option -debug and various undocumented debug features. * Moved the PNG reduction module (opngreduc) to a separate sub-project. --- Module Name: pkgsrc Committed By: taca Date: Fri Sep 21 04:07:22 UTC 2012 Modified Files: pkgsrc/graphics/optipng: Makefile distinfo Log Message: Update optipng to 0.7.3, security fix for SA50654 (CVE-2012-4432). Version 0.7.3 16-sep-2012 ------------- !! Fixed a use-after-free vulnerability in the palette reduction code. This vulnerability was accidentally introduced in version 0.7.

Pullup ticket #3922 - requested by taca

2012-09-27T11:06:01Z

www/apache22: security update Revisions pulled up: - www/apache22/Makefile 1.81 - www/apache22/PLIST 1.21 - www/apache22/distinfo 1.52 - www/apache22/patches/patch-af deleted - www/apache22/patches/patch-docs_man_apxs.8 1.1 - www/apache22/patches/patch-support_envvars-std.in deleted --- Module Name: pkgsrc Committed By: taca Date: Sun Sep 16 03:33:10 UTC 2012 Modified Files: pkgsrc/www/apache22: Makefile PLIST distinfo Added Files: pkgsrc/www/apache22/patches: patch-docs_man_apxs.8 Removed Files: pkgsrc/www/apache22/patches: patch-af patch-support_envvars-std.in Log Message: Update apache22 to 2.2.23. Changes with Apache 2.2.23 *) SECURITY: CVE-2012-0883 (cve.mitre.org) envvars: Fix insecure handling of LD_LIBRARY_PATH that could lead to the current working directory to be searched for DSOs. [Stefan Fritsch] *) SECURITY: CVE-2012-2687 (cve.mitre.org) mod_negotiation: Escape filenames in variant list to prevent a possible XSS for a site where untrusted users can upload files to a location with MultiViews enabled. [Niels Heinen ] *) htdbm, htpasswd: Don't crash if crypt() fails (e.g. with FIPS enabled). [Paul Wouters , Joe Orton] *) mod_ldap: Treat the "server unavailable" condition as a transient error with all LDAP SDKs. [Filip Valder ] *) core: Add filesystem paths to access denied / access failed messages. [Eric Covener] *) core: Fix error handling in ap_scan_script_header_err_brigade() if there is no EOS bucket in the brigade. PR 48272. [Stefan Fritsch] *) core: Prevent "httpd -k restart" from killing server in presence of config error. [Joe Orton] *) mod_ssl: when compiled against OpenSSL 1.0.1 or later, allow explicit control of TLSv1.1 and TLSv1.2 through the SSLProtocol directive, adding TLSv1.1 and TLSv1.2 support by default given 'SSLProtocol All'. [Kaspar Brand, William Rowe] *) mod_log_config: Fix %{abc}C truncating cookie values at first "=". PR 53104. [Greg Ames] *) Unix MPMs: Fix small memory leak in parent process if connect() failed when waking up children. [Joe Orton] *) mod_proxy_ajp: Add support for 'ProxyErrorOverride on'. PR 50945. [Peter Pramberger , Jim Jagielski] *) Added SSLProxyMachineCertificateChainFile directive so the proxy client can select the proper client certificate when using a chain and the remote server only lists the root CA as allowed. *) mpm_event, mpm_worker: Remain active amidst prevalent child process resource shortages. [Jeff Trawick] *) mod_rewrite: Add "AllowAnyURI" option. PR 52774. [Joe Orton] *) mod_rewrite: Fix the RewriteEngine directive to work within a location. Previously, once RewriteEngine was switched on globally, it was impossible to switch off. [Graham Leggett] *) mod_proxy_balancer: Restore balancing after a failed worker has recovered when using lbmethod_bybusyness. PR 48735. [Jeff Trawick] *) mod_dumpio: Properly handle errors from subsequent input filters. PR 52914. [Stefan Fritsch] *) mpm_worker: Fix cases where the spawn rate wasn't reduced after child process resource shortages. [Jeff Trawick] *) mpm_prefork: Reduce spawn rate after a child process exits due to unexpected poll or accept failure. [Jeff Trawick] *) core: Adjust ap_scan_script_header_err*() to prevent mod_cgi and mod_cgid from logging bogus data in case of errors. [Stefan Fritsch] *) mod_disk_cache, mod_mem_cache: Decline the opportunity to cache if the response is a 206 Partial Content. This stops a reverse proxied partial response from becoming cached, and then being served in subsequent responses. PR 49113. [Graham Leggett] *) configure: Fix usage with external apr and apu in non-default paths and recent gcc versions >= 4.6. [Jean-Frederic Clere] *) core: Fix building against PCRE 8.30 by switching from the obsolete pcre_info() to pcre_fullinfo(). PR 52623 [Ruediger Pluem, Rainer Jung] *) mod_proxy: Add the forcerecovery balancer parameter that determines if recovery for balancer workers is enforced. [Ruediger Pluem]

pullup #3921

2012-09-15T10:54:35Z

Pullup ticket #3921 - requested by bouyer

2012-09-15T10:27:14Z

net/freeradius2: security patch Revisions pulled up: - net/freeradius2/Makefile 1.24 - net/freeradius2/distinfo 1.13 - net/freeradius2/patches/patch-src_modules_rlm_eap_types_rlm_eap_tls_rlm_eap_tls.c 1.1 ------------------------------------------------------------------- Module Name: pkgsrc Committed By: bouyer Date: Wed Sep 12 18:37:10 UTC 2012 Modified Files: pkgsrc/net/freeradius2: Makefile distinfo Added Files: pkgsrc/net/freeradius2/patches: patch-src_modules_rlm_eap_types_rlm_eap_tls_rlm_eap_tls.c Log Message: Add patch from the freeradius git repository, fixing CVE-2012-3547. Bump PKGREVISION To generate a diff of this commit: cvs rdiff -u -r1.23 -r1.24 pkgsrc/net/freeradius2/Makefile cvs rdiff -u -r1.12 -r1.13 pkgsrc/net/freeradius2/distinfo cvs rdiff -u -r0 -r1.1 \ pkgsrc/net/freeradius2/patches/patch-src_modules_rlm_eap_types_rlm_eap_tls_rlm_eap_tls.c

Pullup tickets 3919 and 3920

2012-09-13T08:03:20Z

Pullup ticket #3920 - requested by taca

2012-09-13T08:01:13Z

net/{isc-dhcp4,isc-dhcpd4,isc-dhclient4,isc-dhcrelay} security fix Revisions pulled up: - net/isc-dhcp4/Makefile.common 1.17 - net/isc-dhcp4/distinfo 1.13 --- Module Name: pkgsrc Committed By: taca Date: Thu Sep 13 01:38:58 UTC 2012 Modified Files: pkgsrc/net/isc-dhcp4: Makefile.common distinfo Log Message: Update ISC DHCP package to 4.2.4p2 (ISC DHCP 4.2.4-P2). Changes since 4.2.4-P1 ! An issue with the use of lease times was found and fixed. Making certain changes to the end time of an IPv6 lease could cause the server to abort. Thanks to Glen Eustace of Massey University, New Zealand for finding this issue. [ISC-Bugs #30281] CVE: CVE-2012-3955

Pullup ticket #3919 - requested by taca

2012-09-13T07:48:01Z

net/bind?? CVE-2012-4244 security fix Revisions pulled up: - net/bind96/DESCR 1.2 - net/bind96/Makefile 1.29-1.30 - net/bind96/distinfo 1.20 - net/bind97/DESCR 1.2 - net/bind97/Makefile 1.18-1.19 - net/bind97/distinfo 1.16 - net/bind98/DESCR 1.2 - net/bind98/Makefile 1.15-1.16 - net/bind98/distinfo 1.14 - net/bind99/DESCR 1.2 - net/bind99/Makefile 1.10-1.11 - net/bind99/distinfo 1.8 --- Module Name: pkgsrc Committed By: wiz Date: Sun Aug 26 14:23:49 UTC 2012 Modified Files: pkgsrc/net/bind96: DESCR Makefile pkgsrc/net/bind97: DESCR Makefile pkgsrc/net/bind98: DESCR Makefile pkgsrc/net/bind99: DESCR Makefile Log Message: Make it clearer which package contains exactly which bind version. Patch from Bug Hunting. --- Module Name: pkgsrc Committed By: taca Date: Thu Sep 13 01:32:55 UTC 2012 Modified Files: pkgsrc/net/bind96: Makefile distinfo Log Message: Update bind96 to bind-9.6.3.1.ESV.7pl3 (BIND 9.6-ESV-R7-P3). --- 9.6-ESV-R7-P3 released --- 3364. [security] Named could die on specially crafted record. [RT #30416] 3358 [bug] Fix declaration of fatal in bin/named/server.c and bin/nsupdate/main.c. [RT #30522] --- Module Name: pkgsrc Committed By: taca Date: Thu Sep 13 01:33:40 UTC 2012 Modified Files: pkgsrc/net/bind97: Makefile distinfo Log Message: Update bind97 to bind-9.7.6pl3. --- 9.7.6-P3 released --- 3364. [security] Named could die on specially crafted record. [RT #30416] --- Module Name: pkgsrc Committed By: taca Date: Thu Sep 13 01:35:18 UTC 2012 Modified Files: pkgsrc/net/bind98: Makefile distinfo Log Message: Update bind98 to 9.8.3pl3 (BIND 9.8.3-P3). --- 9.8.3-P3 released --- 3364. [security] Named could die on specially crafted record. [RT #30416] --- Module Name: pkgsrc Committed By: taca Date: Thu Sep 13 01:35:56 UTC 2012 Modified Files: pkgsrc/net/bind99: Makefile distinfo Log Message: Update bind99 to 9.9.1pl3 (BIND 9.9.1-P3). --- 9.9.1-P3 released --- 3364. [security] Named could die on specially crafted record. [RT #30416]

pullup 3916

2012-09-09T22:20:15Z

Pullup ticket #3916 - requested by tron

2012-09-09T22:19:04Z

net/wireshark: security patch Revisions pulled up: - distinfo patch - Makefile patch - patches/patch-CVE-2012-3548 created by patch