[no description] https://git.osdyson.ru/mirror/pkgsrc/atom?h=pkgsrc_2010Q3 2010-12-23T10:10:54Z 2010-12-23T10:10:54Z sbd sbd 2010-12-23T10:10:54Z urn:sha1:74934e6936a8c92f04c243cc18a220d4bbbe081c pkgsrc/lang/{php5,php53} security fixes Revisions pulled up: - pkgsrc/databases/php-mysql/Makefile 1.14 - pkgsrc/databases/php-mysqli/Makefile 1.3 - pkgsrc/databases/php-pdo_mysql/Makefile 1.12 - pkgsrc/lang/php5/Makefile 1.80, 1.81 - pkgsrc/lang/php5/Makefile.common 1.43, 1.44 - pkgsrc/lang/php5/distinfo 1.80, 1.81, 1.82 - pkgsrc/lang/php5/patches/patch-ak 1.8, deleted - pkgsrc/lang/php5/patches/patch-bf 1.1, deleted - pkgsrc/lang/php5/patches/patch-bg 1.1, deleted - pkgsrc/lang/php53/Makefile 1.5, 1.6 - pkgsrc/lang/php53/Makefile.common 1.3 - pkgsrc/lang/php53/distinfo 1.7, 1.8 - pkgsrc/lang/php53/patches/patch-ab 1.3 - pkgsrc/lang/php53/patches/patch-am 1.1, deleted - pkgsrc/lang/php53/patches/patch-an 1.1, deleted - pkgsrc/lang/php53/patches/patch-ao 1.1, deleted - pkgsrc/lang/php53/patches/patch-ap 1.1, deleted - pkgsrc/lang/php53/patches/patch-aq 1.1, deleted - pkgsrc/mail/php-imap/Makefile 1.21, 1.22 - pkgsrc/www/ap-php/Makefile 1.24 - pkgsrc/www/php-eaccelerator/Makefile 1.13 ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Thu Nov 25 03:43:50 UTC 2010 Modified Files: pkgsrc/lang/php53: Makefile distinfo Added Files: pkgsrc/lang/php53/patches: patch-am patch-an patch-ao patch-ap patch-aq Log Message: - GC bug fix: http://svn.php.net/viewvc?view=revision&revision=303016 - CVE-2010-3710 (a part of SA41724) http://svn.php.net/viewvc?view=revision&revision=303779 - CVE-2010-3870 (a part of SA41724) http://svn.php.net/viewvc?view=revision&revision=304959 - CVE-2010-4150 (php-imap) http://svn.php.net/viewvc?view=revision&revision=305032 - CVE-2010-4156 (SA42135) http://svn.php.net/viewvc?view=revision&revision=305214 Bump PKGREVISION. ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Thu Nov 25 03:44:16 UTC 2010 Modified Files: pkgsrc/lang/php5: Makefile distinfo Added Files: pkgsrc/lang/php5/patches: patch-ak patch-bf patch-bg Log Message: - CVE-2010-4150 (php-imap) http://svn.php.net/viewvc?view=revision&revision=305032 - CVE-2010-3710 (a part of SA41724) http://svn.php.net/viewvc?view=revision&revision=303885 - CVE-2010-3870 (a part of SA41724) http://svn.php.net/viewvc?view=revision&revision=305055 Bump PKGREVISION. ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Thu Nov 25 03:45:19 UTC 2010 Modified Files: pkgsrc/mail/php-imap: Makefile Log Message: Bump REVISION since CVE-2010-4150 fix was added. ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Mon Dec 13 13:15:46 UTC 2010 Modified Files: pkgsrc/lang/php5: Makefile Makefile.common distinfo Removed Files: pkgsrc/lang/php5/patches: patch-ak patch-bf patch-bg Log Message: Update php5 package to 5.2.15 (PHP 5.2.15): The PHP development team would like to announce the immediate availability of PHP 5.2.15. This release marks the end of support for PHP 5.2. All users of PHP 5.2 are encouraged to upgrade to PHP 5.3. This release focuses on improving the security and stability of the PHP 5.2.x branch with a small number, of predominatly security fixes. Security Enhancements and Fixes in PHP 5.2.15: * Fixed extract() to do not overwrite $GLOBALS and $this when using EXTR_OVERWRITE. * Fixed crash in zip extract method (possible CWE-170). * Fixed a possible double free in imap extension. * Fixed possible flaw in open_basedir (CVE-2010-3436). * Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). * Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data). Key enhancements in PHP 5.2.15 include: * Fixed bug #47643 (array_diff() takes over 3000 times longer than php 5.2.4). * Fixed bug #44248 (RFC2616 transgression while HTTPS request through proxy with SoapClient object). * To prepare for upgrading to PHP 5.3, now that PHP 5.2's support ended, a migration guide available on http://php.net/migration53, details the changes between PHP 5.2 and PHP 5.3. For a full list of changes in PHP 5.2.15 see the ChangeLog at http://www.php.net/ChangeLog-5.php#5.2.15. ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Mon Dec 13 13:16:37 UTC 2010 Modified Files: pkgsrc/lang/php53: Makefile Makefile.common distinfo pkgsrc/lang/php53/patches: patch-ab Removed Files: pkgsrc/lang/php53/patches: patch-am patch-an patch-ao patch-ap patch-aq Log Message: Update lang/php53 package to 5.3.4 (PHP 5.3.4). The PHP development team is proud to announce the immediate release of PHP 5.3.4. This is a maintenance release in the 5.3 series, which includes a large number of bug fixes. Security Enhancements and Fixes in PHP 5.3.4: * Fixed crash in zip extract method (possible CWE-170). * Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243). * Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150). * Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709). * Fixed possible flaw in open_basedir (CVE-2010-3436). * Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950). * Fixed symbolic resolution support when the target is a DFS share. * Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710). Key Bug Fixes in PHP 5.3.4 include: * Added stat support for zip stream. * Added follow_location (enabled by default) option for the http stream support. * Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al. * Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime. * Multiple improvements to the FPM SAPI. * Over 100 other bug fixes. For users upgrading from PHP 5.2 there is a migration guide available here, detailing the changes between those releases and PHP 5.3. For a full list of changes in PHP 5.3.4, see the ChangeLog. For source downloads please visit our downloads page, Windows binaries can be found on windows.php.net/download/. ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Mon Dec 13 13:18:20 UTC 2010 Modified Files: pkgsrc/databases/php-mysql: Makefile pkgsrc/databases/php-mysqli: Makefile pkgsrc/databases/php-pdo_mysql: Makefile pkgsrc/mail/php-imap: Makefile pkgsrc/www/ap-php: Makefile pkgsrc/www/php-eaccelerator: Makefile Log Message: Reset PKGREVISION by update of base PHP version. ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Thu Dec 16 14:20:45 UTC 2010 Modified Files: pkgsrc/lang/php5: Makefile.common distinfo Log Message: Update php5 pacakge to 5.2.16: PHP 5.2.16 Released! The PHP development team would like to announce the immediate availability of PHP 5.2.16. This release marks the end of support for PHP 5.2. All users of PHP 5.2 are encouraged to upgrade to PHP 5.3. This release focuses on addressing a regression in open_basedir implementation introduced in 5.2.15 in addition to fixing a crash inside PDO::pgsql on data retrieval when the server is down. All users who have upgraded to 5.2.15 and are utilizing open_basedir are strongly encouraged to upgrade to 5.2.16 or 5.3.4. To prepare for upgrading to PHP 5.3, now that PHP 5.2's support ended, a migration guide available on http://php.net/migration53, details the changes between PHP 5.2 and PHP 5.3. For a full list of changes in PHP 5.2.16 see the ChangeLog at http://www.php.net/ChangeLog-5.php#5.2.16. ChangeLog: Version 5.2.16 16-Dec-2010 * Fixed bug #53517 (segfault in pgsql_stmt_execute() when postgres is down). (gyp at balabit dot hu) * Fixed bug #53516 (Regression in open_basedir handling). (Ilia) 2010-11-29T20:27:09Z sbd sbd 2010-11-29T20:27:09Z urn:sha1:4d11530180e81980f552a3d8434d51dfff588223 Security update for "phpmyadmin" package Revisions pulled up: - pkgsrc/databases/phpmyadmin/Makefile 1.85 - pkgsrc/databases/phpmyadmin/distinfo 1.46 ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: tron Date: Mon Nov 29 19:13:30 UTC 2010 Modified Files: pkgsrc/databases/phpmyadmin: Makefile distinfo Log Message: Update "phpmyadmin" package to versino 2.11.11.1. Changes since 2.11.11: Fix XSS vulnerability reported in PMASA-2010-8 (CVE-2010-4329?). To generate a diff of this commit: cvs rdiff -u -r1.84 -r1.85 pkgsrc/databases/phpmyadmin/Makefile cvs rdiff -u -r1.45 -r1.46 pkgsrc/databases/phpmyadmin/distinfo 2010-11-09T20:38:48Z spz spz 2010-11-09T20:38:48Z urn:sha1:615a781cea447d1e2ce2d20e5cce65353438e97a security update Revisions pulled up: - pkgsrc/databases/mysql51-client/Makefile.common 1.13 - pkgsrc/databases/mysql51-client/distinfo 1.10 - pkgsrc/databases/mysql51-server/PLIST 1.10 - pkgsrc/databases/mysql51-server/distinfo 1.12 ------------------------------------------------------------------------- Module Name: pkgsrc Committed By: taca Date: Thu Nov 4 15:57:07 UTC 2010 Modified Files: pkgsrc/databases/mysql51-client: Makefile.common distinfo pkgsrc/databases/mysql51-server: PLIST distinfo Log Message: Update mysql51-{client,server} package from 5.1.51 to 5.1.52. This is maintainous release and pleare refer in detail: http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html One note from the changes: * Security Fix: In prepared-statement mode, EXPLAIN for a SELECT from a derived table caused a server crash. (Bug#54488) To generate a diff of this commit: cvs rdiff -u -r1.12 -r1.13 pkgsrc/databases/mysql51-client/Makefile.common cvs rdiff -u -r1.9 -r1.10 pkgsrc/databases/mysql51-client/distinfo cvs rdiff -u -r1.9 -r1.10 pkgsrc/databases/mysql51-server/PLIST cvs rdiff -u -r1.11 -r1.12 pkgsrc/databases/mysql51-server/distinfo 2010-10-15T11:55:42Z taca taca 2010-10-15T11:55:42Z urn:sha1:d0cf3d9ea1dd2ba18c63ad6c6a001f8fb2a6bb41 Rails 3.0.x, change dependency not match ruby-activerecord 3.0.0 and later. (There is ruby-acts-as-versioned 0.6.0 for Rails3). Bump PKGREVISION. 2010-10-15T11:43:27Z taca taca 2010-10-15T11:43:27Z urn:sha1:6831c2c3735ec17d483e7e324223b458e683a28b This release fixes CVE-2010-3933 security problem and it is part of Rails 3.0.1. 2010-10-15T11:35:19Z taca taca 2010-10-15T11:35:19Z urn:sha1:14ca4ed6c35f08c903ed0638cec27324fb5a6883 This release fixes CVE-2010-3933 security problem. And change depending pattern to prevent ruby-activesupport 3.0.0 and later. 2010-10-13T10:24:22Z obache obache 2010-10-13T10:24:22Z urn:sha1:9b5198691b254acee7c84b9656de82b7c941135b so switch to use default postgresql instead. Bump PKGREVISION. 2010-10-12T16:52:36Z joerg joerg 2010-10-12T16:52:36Z urn:sha1:d3190ac16333c73f896aff638d17b96133e43986 PostgreSQL versions in pkgsrc. 2010-10-07T15:53:54Z adam adam 2010-10-07T15:53:54Z urn:sha1:8445719924615ffdd9272192c1ae2ff11e6c8556 * Use a separate interpreter for each calling SQL userid in PL/Perl and PL/Tcl * Improve pg_get_expr() security fix so that the function can still be used on the output of a sub-select * Fix incorrect placement of placeholder evaluation * Fix join removal's handling of placeholder expressions * Fix possible duplicate scans of UNION ALL member relations * Prevent infinite loop in ProcessIncomingNotify() after unlistening * Prevent show_session_authorization() from crashing within autovacuum processes * Re-allow input of Julian dates prior to 0001-01-01 AD * Make psql recognize "DISCARD ALL" as a command that should not be encased in a transaction block in autocommit-off mode * Update build infrastructure and documentation to reflect the source code repository's move from CVS to Git 2010-10-07T15:53:22Z adam adam 2010-10-07T15:53:22Z urn:sha1:1de336e9e157ba517d74dcbd5192b129670b9229 * Use a separate interpreter for each calling SQL userid in PL/Perl and PL/Tcl * Prevent possible crashes in pg_get_expr() by disallowing it from being called with an argument that is not one of the system catalog columns it's intended to be used with * Treat exit code 128 (ERROR_WAIT_NO_CHILDREN) as non-fatal on Windows * Fix incorrect placement of placeholder evaluation * Fix possible duplicate scans of UNION ALL member relations * Fix "cannot handle unplanned sub-select" error * Fix mishandling of whole-row Vars that reference a view or sub-select and appear within a nested sub-select * Fix mishandling of cross-type IN comparisons * Fix computation of "ANALYZE" statistics for tsvector columns * Improve planner's estimate of memory used by array_agg(), string_agg(), and similar aggregate functions * Fix failure to mark cached plans as transient * Reduce PANIC to ERROR in some occasionally-reported btree failure cases, and provide additional detail in the resulting error messages * Fix incorrect search logic for partial-match queries with GIN indexes * Prevent show_session_authorization() from crashing within autovacuum processes * Defend against functions returning setof record where not all the returned rows are actually of the same rowtype * Fix possible corruption of pending trigger event lists during subtransaction rollback * Fix possible failure when hashing a pass-by-reference function result * Improve merge join's handling of NULLs in the join columns * Take care to fsync the contents of lockfiles (both "postmaster.pid" and the socket lockfile) while writing them * Avoid recursion while assigning XIDs to heavily-nested subtransactions * Avoid holding open old WAL segments in the walwriter process * Fix log_line_prefix's %i escape, which could produce junk early in backend startup * Prevent misinterpretation of partially-specified relation options for TOAST tables * Fix inheritance count tracking in "ALTER TABLE ... ADD CONSTRAINT" * Fix possible data corruption in "ALTER TABLE ... SET TABLESPACE" when archiving is enabled * Allow "CREATE DATABASE" and "ALTER DATABASE ... SET TABLESPACE" to be interrupted by query-cancel * Improve "CREATE INDEX"'s checking of whether proposed index expressions are immutable * Fix "REASSIGN OWNED" to handle operator classes and families * Fix possible core dump when comparing two empty tsquery values * Fix LIKE's handling of patterns containing % followed by _