summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2011-03-30Pullup ticket #3397.pkgsrc_2010Q4tron1-0/+3
2011-03-30Pullup ticket #3397 - requested by drochnertron6-6/+44
sysutils/xenkernel3: security patch sysutils/xenkernel33: security patch Revisions pulled up: - sysutils/xenkernel3/Makefile 1.20 - sysutils/xenkernel3/distinfo 1.13 - sysutils/xenkernel3/patches/patch-ac 1.3 - sysutils/xenkernel33/Makefile 1.13 - sysutils/xenkernel33/distinfo 1.11 - sysutils/xenkernel33/patches/patch-ac 1.1 --- Module Name: pkgsrc Committed By: drochner Date: Thu Mar 24 12:04:57 UTC 2011 Modified Files: pkgsrc/sysutils/xenkernel33: Makefile distinfo Added Files: pkgsrc/sysutils/xenkernel33/patches: patch-ac Log Message: add patch from upstream (manually, due to changed #ifdefs and indentation) to fix possible crashes triggered by 64-bit guests (found by Cherry G. Mathew, CVE-2011-1166) bump PKGREV --- Module Name: pkgsrc Committed By: drochner Date: Thu Mar 24 12:43:53 UTC 2011 Modified Files: pkgsrc/sysutils/xenkernel3: Makefile distinfo Added Files: pkgsrc/sysutils/xenkernel3/patches: patch-ac Log Message: add patch from upstream (manually, due to changed #ifdefs and indentation) to fix possible crashes triggered by 64-bit guests (found by Cherry G. Mathew, CVE-2011-1166) bump PKGREV
2011-03-22Pullup tickets 3393, 3394 and 3395sbd1-0/+6
2011-03-22Pullup ticket #3395 - requested by tacasbd10-389/+23
security fix for lang/php53 Revisions pulled up: - lang/php53/Makefile 1.8 - lang/php53/Makefile.common 1.5 - lang/php53/distinfo 1.13 - lang/php53/patches/patch-aa 1.2 - lang/php53/patches/patch-ab 1.4 - lang/php53/patches/patch-af 1.2 - lang/php53/patches/patch-ar Removed - lang/php53/patches/patch-ext_exif_exif.c Removed - lang/php53/patches/patch-ext_zip_lib_zip__name__locate.c Removed - lang/php53/patches/patch-ext_zip_php__zip.c Removed --- Module Name: pkgsrc Committed By: taca Date: Sat Mar 19 07:01:19 UTC 2011 Modified Files: pkgsrc/lang/php53: Makefile Makefile.common distinfo pkgsrc/lang/php53/patches: patch-aa patch-ab patch-af Removed Files: pkgsrc/lang/php53/patches: patch-ar patch-ext_exif_exif.c patch-ext_zip_lib_zip__name__locate.c patch-ext_zip_php__zip.c Log Message: Update lang/php53 package to PHP 5.3. PHP 5.3.6 Released! [17-Mar-2011] The PHP development team would like to announce the immediate availability of PHP 5.3.6. This release focuses on improving the stability of the PHP 5.3.x branch with over 60 bug fixes, some of which are security related. Security Enhancements and Fixes in PHP 5.3.6: * Enforce security in the fastcgi protocol parsing with fpm SAPI. * Fixed bug #54247 (format-string vulnerability on Phar). (CVE-2011-1153) * Fixed bug #54193 (Integer overflow in shmop_read()). (CVE-2011-1092) * Fixed bug #54055 (buffer overrun with high values for precision ini setting). * Fixed bug #54002 (crash on crafted tag in exif). (CVE-2011-0708) * Fixed bug #53885 (ZipArchive segfault with FL_UNCHANGED on empty archive). (CVE-2011-0421) Key enhancements in PHP 5.3.6 include: * Upgraded bundled Sqlite3 to version 3.7.4. * Upgraded bundled PCRE to version 8.11. * Added ability to connect to HTTPS sites through proxy with basic authentication using stream_context/http/header/Proxy-Authorization. * Added options to debug backtrace functions. * Changed default value of ini directive serialize_precision from 100 to 17. * Fixed Bug #53971 (isset() and empty() produce apparently spurious runtime error). * Fixed Bug #53958 (Closures can't 'use' shared variables by value and by reference). * Fixed bug #53577 (Regression introduced in 5.3.4 in open_basedir with a trailing forward slash). * Over 60 other bug fixes.
2011-03-22Pullup ticket #3393 - requested by tacasbd5-3/+89
security fix for lang/php5 Revisions pulled up: - lang/php5/Makefile 1.84 - lang/php5/distinfo 1.89 - lang/php5/patches/patch-main_snprintf.c 1.1 - lang/php5/patches/patch-main_snprintf.h 1.1 - lang/php5/patches/patch-main_spprintf.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Mon Mar 21 16:34:28 UTC 2011 Modified Files: pkgsrc/lang/php5: Makefile distinfo Added Files: pkgsrc/lang/php5/patches: patch-main_snprintf.c patch-main_snprintf.h patch-main_spprintf.c Log Message: Apply changes by r308525 from PHP's repository to fix bug #54055 (buffer overrun with high values for precision ini setting). It fixes one of security fixes by PHP 5.3.6. Bump PKGREVISION.
2011-03-22Pullup ticket #3394 - requested by tacasbd3-5/+19
security fix for devel/php-shmop Revisions pulled up: - devel/php-shmop/Makefile 1.10 - lang/php5/distinfo 1.88 - lang/php5/patches/patch-ext_shmop_shmop.c 1.1 --- Module Name: pkgsrc Committed By: taca Date: Mon Mar 21 16:08:29 UTC 2011 Modified Files: pkgsrc/devel/php-shmop: Makefile pkgsrc/lang/php5: distinfo Added Files: pkgsrc/lang/php5/patches: patch-ext_shmop_shmop.c Log Message: Add a patch to fix bug #54193 (Integer overflow in shmop_read()) referring r309018 from PHPs' repository. (CVE-2011-1092) Bump PKGREVISION of devel/php-shmop.
2011-03-13Pullup ticket #3388sbd1-0/+2
2011-03-13Pullup ticket #3388 - requested by tronsbd3-3/+24
Security update for graphic/tiff Revisions pulled up: - graphics/tiff/Makefile 1.99 - graphics/tiff/distinfo 1.50 - graphics/tiff/patches/patch-SA43593 1.1 --- Module Name: pkgsrc Committed By: tron Date: Sat Mar 12 16:10:43 UTC 2011 Modified Files: pkgsrc/graphics/tiff: Makefile distinfo Added Files: pkgsrc/graphics/tiff/patches: patch-SA43593 Log Message: Add fix for vulnerability reported in SA43593 taken from the "libtiff" CVS repository.
2011-03-12Pullup ticket #3387sbd1-0/+2
2011-03-12Pullup ticket #3387 - requested by wizsbd1-1/+1
build fix for devel/bmake Revisions pulled up: - devel/bmake/files/make-bootstrap.sh.in 1.2 --- Module Name: pkgsrc Committed By: wiz Date: Wed Jan 26 10:13:48 UTC 2011 Modified Files: pkgsrc/devel/bmake/files: make-bootstrap.sh.in Log Message: Add missing ".o". Found by Matthieu Herrb in PR 44461.
2011-03-11Pullup ticket #3385.tron1-0/+2
2011-03-11Pullup ticket #3385 - requested by tacatron13-408/+29
mail/postfix-current: security update Revisions pulled up: - mail/postfix-current/MESSAGE patch - mail/postfix-current/MESSAGE.sasl patch - mail/postfix-current/Makefile patch - mail/postfix-current/PLIST patch - mail/postfix-current/distinfo patch - mail/postfix-current/files/mailer.conf patch - mail/postfix-current/patches/patch-aa patch - mail/postfix-current/patches/patch-ag patch - mail/postfix-current/patches/patch-ai patch - mail/postfix-current/patches/patch-as patch - mail/postfix-current/patches/patch-at deleted - mail/postfix-current/patches/patch-au deleted - mail/postfix-current/patches/patch-av deleted --- Update "postfix-current" package to version 2.8.1: Postfix stable release 2.8.0 is available. This release continues the move towards improving code and documentation, and making the system better prepared for changes in the threat environment. The postscreen daemon (a zombie blocker in front of Postfix) is now included with the stable release. postscreen now supports TLS and can log the rejected sender, recipient and helo information. See the POSTSCREEN_README file for recommended usage scenarios. Support for DNS whitelisting (permit_rhswl_client), and for pattern matching to filter the responses from DNS white/blacklist servers (e.g., reject_rhsbl_client zen.spamhaus.org=127.0.0.[1..10]). Improved message tracking across SMTP-based content filters; the after-filter SMTP server can log the before-filter queue ID (the XCLIENT protocol was extended). Read-only support for sqlite databases. See sqlite_table(5) and SQLITE_README. Support for 'footers' that are appended to SMTP server "reject" responses. See "smtpd_reject_footer" in the postconf(5) manpage.
2011-03-09Pullup ticket #3386 - requested by glstron3-2/+21
www/py-moin: security patch Revisions pulled up: - www/py-moin/Makefile 1.16 - www/py-moin/distinfo 1.7 - www/py-moin/patches/patch-MoinMoin_parser_text__rst.py 1.1 --- Module Name: pkgsrc Committed By: gls Date: Mon Mar 7 20:51:41 UTC 2011 Modified Files: pkgsrc/www/py-moin: Makefile distinfo Added Files: pkgsrc/www/py-moin/patches: patch-MoinMoin_parser_text__rst.py Log Message: Add a fix for CVE CVE 2011-1058. Taken from http://moinmo.in/SecurityFixes
2011-03-09Pullup tickets #3383, #3384 and #3386.tron1-0/+6
2011-03-09Pullup ticket #3384 - requested by tacatron3-18/+8
mail/postfix: security update Revisions pulled up: - mail/postfix/Makefile patch - mail/postfix/distinfo patch - mail/postfix/patches/patch-ag patch --- Postfix legacy releases 2.7.3, 2.6.9, 2.5.12 and 2.4.16 are available. These releases contain a fix for CVE-2011-0411 which allows plaintext command injection with SMTP sessions over TLS. This defect was introduced with Postfix version 2.2. The same flaw exists in other implementations of the STARTTLS command. Note: CVE-2011-0411 is an issue only for the minority of SMTP clients that actually verify server certificates. Without server certificate verification, clients are always vulnerable to man-in-the-middle attacks that allow attackers to inject plaintext commands or responses into SMTP sessions, and more. Postfix 2.8 and 2.9 are not affected. The following problems were fixed with the Postfix legacy releases: * Fix for CVE-2011-0411: discard buffered plaintext input, after reading the SMTP "STARTTLS" command or response. * Fix to the local delivery agent: look up the "unextended" address in the local aliases database, when that address has a malformed address extension. * Fix to virtual alias expansion: report a tempfail error, instead of silently ignoring recipients that exceed the virtual_alias_expansion_limit or the virtual_alias_recursion_limit. * Fix for Solaris: the Postfix event engine was deaf for SIGHUP and SIGALRM signals after the switch from select() to /dev/poll. Symptoms were delayed "postfix reload" response, and killed processes with watchdog timeout values under 100 seconds. * Fix for HP-UX: the Postfix event engine was deaf for SIGALRM signals. Symptoms were killed processes with watchdog timeout values under 100 seconds. * Fix for BSD-ish mkdir() to prevent maildir directories from inheriting their group ownership from the parent directory. * Fix to the SMTP client: missing support for mail to [ipv6:ipv6addr] address literal destinations. * FreeBSD back-ported closefrom() from FreeBSD 8x to 7x, breaking Postfix builds retroactively. Historical note: Wietse Venema discovered the problem two weeks before the Postfix 2.8 release, and silently fixed it pending further investigation. While investigating the problem's scope and impact, Victor Duchovni found that many other TLS applications were also affected. At that point, CERT/CC was asked to coordinate with the problem's resolution. You can find the updated Postfix source code at the mirrors listed at http://www.postfix.org/.
2011-03-09Pullup ticket #3383 - requested by toniotron12-22/+551
chat/weechat: security update Revisions pulled up: - chat/weechat/Makefile 1.27 - chat/weechat/PLIST 1.14 - chat/weechat/distinfo 1.18 - chat/weechat/patches/patch-aa 1.4 - chat/weechat/patches/patch-ab 1.6 - chat/weechat/patches/patch-ac 1.5 - chat/weechat/patches/patch-ad 1.4 - chat/weechat/patches/patch-src_core_wee-hook.c 1.1 - chat/weechat/patches/patch-src_core_wee-hook.h 1.1 - chat/weechat/patches/patch-src_core_wee-network.c 1.1 - chat/weechat/patches/patch-src_plugins_irc_irc-server.c 1.1 - chat/weechat/patches/patch-src_plugins_rmodifier_rmodifier-config.h 1.1 --- Module Name: pkgsrc Committed By: tonio Date: Sat Mar 5 22:48:07 UTC 2011 Modified Files: pkgsrc/chat/weechat: Makefile PLIST distinfo pkgsrc/chat/weechat/patches: patch-aa patch-ab patch-ac patch-ad Added Files: pkgsrc/chat/weechat/patches: patch-src_core_wee-hook.c patch-src_core_wee-hook.h patch-src_core_wee-network.c patch-src_plugins_irc_irc-server.c patch-src_plugins_rmodifier_rmodifier-config.h Log Message: Update chat/weechat to 0.3.4 Fix for SA43543 and update kindly provided by gls@ This is a major release, with lot of bugs fixed and major new features. Among the new features: - 256 colors support, with unlimited number of nick colors - irc proxy (relay plugin) - redirection of IRC commands - command /notify - rmodifier plugin - regular expressions for highlights - color support for timestamp in chat buffer - irc option to force color for some nicks - share input line between buffers.
2011-03-06Pullup ticket #3379.tron1-0/+2
2011-03-06Pullup ticket #3379 - requested by tnntron6-28/+27
mail/thunderbird: security update Revisions pulled up: - mail/thunderbird/Makefile 1.66 via patch - mail/thunderbird/distinfo 1.78 - mail/thunderbird/patches/patch-directory_c-sdk_configure.in 1.2 - mail/thunderbird/patches/patch-directory_c-sdk_ldap_include_portable.h 1.3 - mail/thunderbird/patches/patch-directory_c-sdk_ldap_libraries_libldap_Makefile.in 1.2 - mail/thunderbird/patches/patch-mm 1.4 --- Module Name: pkgsrc Committed By: tnn Date: Sat Mar 5 13:09:36 UTC 2011 Modified Files: pkgsrc/mail/thunderbird: Makefile distinfo pkgsrc/mail/thunderbird/patches: patch-directory_c-sdk_configure.in patch-directory_c-sdk_ldap_include_portable.h patch-directory_c-sdk_ldap_libraries_libldap_Makefile.in patch-mm Log Message: Stability and security update of thunderbird to 3.1.8. MFSA 2011-09 Crash caused by corrupted JPEG image MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)
2011-03-06Pullup #3381, requested by tnnschnoebe6-14/+18
firefox-3.6.15 update and prerequisite commits. pkgsrc/www/firefox/Makefile 1.82, 1.83 pkgsrc/devel/xulrunner/Makefile 1.46, 1.47, 1.48 pkgsrc/devel/xulrunner/dist.mk 1.18 pkgsrc/devel/xulrunner/distinfo 1.40 pkgsrc/devel/xulrunner/patches/patch-mm 1.4 Module Name: pkgsrc Committed By: wiz Date: Thu Jan 13 13:40:12 UTC 2011 Modified Files: pkgsrc/www/firefox: Makefile Log Message: png shlib name changed for png>=1.5.0, so bump PKGREVISIONs. --- Module Name: pkgsrc Committed By: wiz Date: Thu Jan 13 13:53:34 UTC 2011 Modified Files: pkgsrc/devel/xulrunner: Makefile Log Message: png shlib name changed for png>=1.5.0, so bump PKGREVISIONs. --- Module Name: pkgsrc Committed By: markd Date: Sun Jan 23 11:18:27 UTC 2011 Modified Files: pkgsrc/devel/xulrunner: Makefile Log Message: set FREEBL_NO_DEPEND=0 in MAKE_ENV otherwise Linux2.6 defaults to FREEBL_NO_DEPEND=1 and files not in PLIST are installed. OKed by tnn. --- Module Name: pkgsrc Committed By: tnn Date: Sat Mar 5 11:57:17 UTC 2011 Modified Files: pkgsrc/devel/xulrunner: Makefile dist.mk distinfo pkgsrc/devel/xulrunner/patches: patch-mm pkgsrc/www/firefox: Makefile Log Message: Stability & security update of firefox to 3.6.15. MFSA 2011-10 CSRF risk with plugins and 307 redirects MFSA 2011-09 Crash caused by corrupted JPEG image MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents MFSA 2011-07 Memory corruption during text run construction (Windows) MFSA 2011-06 Use-after-free error using Web Workers MFSA 2011-05 Buffer overflow in JavaScript atom map MFSA 2011-04 Buffer overflow in JavaScript upvarMap MFSA 2011-03 Use-after-free error in JSON.stringify MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)
2011-03-06Pullup ticket #3380.tron1-0/+2
2011-03-06Pullup ticket #3380 - requested by glstron2-9/+10
chat/cgiirc: security update Revisions pulled up: - chat/cgiirc/Makefile 1.17 - chat/cgiirc/distinfo 1.7 --- Module Name: pkgsrc Committed By: gls Date: Wed Mar 2 20:24:40 UTC 2011 Modified Files: pkgsrc/chat/cgiirc: Makefile distinfo Log Message: Update chat/cgiirc to 0.5.10 Upstream changes: After ~5 years without a release 0.5.10 is now available. This is actually just 0.5.9 with one security fix: CVE-2011-0050: XSS in R param in nonjs interface Thanks to Michael Brooks (Sitewatch) for discovering this. pkgsrc changes: - Update MASTER_SITES and HOMEPAGE to point to cgiirc.org - Add LICENSE
2011-03-05Pullup tickets #3376 and #3382.schnoebe1-0/+4
2011-03-05pull up request 3382, requested by tnn@schnoebe2-6/+6
Revisions pulled up: + pkgsrc/www/seamonkey/Makefile 1.46, 1.47 + pkgsrc/www/seamonkey/distinfo 1.59 Module Name: pkgsrc Committed By: wiz Date: Thu Jan 13 13:53:34 UTC 2011 Modified Files: pkgsrc/www/seamonkey: Makefile Log Message: png shlib name changed for png>=1.5.0, so bump PKGREVISIONs. To generate a diff of this commit: cvs rdiff -u -r1.45 -r1.46 pkgsrc/www/seamonkey/Makefile Module Name: pkgsrc Committed By: tnn Date: Sat Mar 5 14:48:21 UTC 2011 Modified Files: pkgsrc/www/seamonkey: Makefile distinfo Log Message: Security and stability update of seamonkey to 2.0.12. MFSA 2011-10 CSRF risk with plugins and 307 redirects MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents MFSA 2011-07 Memory corruption during text run construction (Windows) MFSA 2011-06 Use-after-free error using Web Workers MFSA 2011-05 Buffer overflow in JavaScript atom map MFSA 2011-04 Buffer overflow in JavaScript upvarMap MFSA 2011-03 Use-after-free error in JSON.stringify MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)
2011-03-05Pull up ticket 3376, requested by tron@schnoebe2-6/+8
Module Name: pkgsrc Committed By: adam Date: Tue Feb 8 07:56:09 UTC 2011 Modified Files: pkgsrc/security/clamav: Makefile distinfo Log Message: Changes 0.97: ClamAV 0.97 brings many improvements, including complete Windows support (all major components compile out-of-box under Visual Studio), support for signatures based on SHA1 and SHA256, better error detection, as well as speed and memory optimizations. The complete list of changes is available in the ChangeLog file.
2011-03-05pullups 3377 + 3378spz1-0/+4
2011-03-05Pullup ticket #3378 - requested by tronspz5-3/+183
devel/pango: security fix Revisions pulled up: - devel/pango/Makefile 1.152 - devel/pango/distinfo 1.88 Files added: devel/pango/patches/patch-CVE-2011-0064-1 devel/pango/patches/patch-CVE-2011-0064-2 devel/pango/patches/patch-CVE-2011-0064-3 --------------------------------------------------------------------- Module Name: pkgsrc Committed By: tron Date: Sat Mar 5 13:37:20 UTC 2011 Modified Files: pkgsrc/devel/pango: Makefile distinfo Added Files: pkgsrc/devel/pango/patches: patch-CVE-2011-0064-1 patch-CVE-2011-0064-2 patch-CVE-2011-0064-3 Log Message: Add openSUSE's fix for the DoS vulnerability remoted in CVE-2011-0064.
2011-03-05Pullup ticket #3377 - requested by tronspz4-2/+64
devel/pango: security update Revisions pulled up: - devel/pango/Makefile 1.151 - devel/pango/distinfo 1.87 - devel/pango/patches/patch-ac 1.15 - devel/pango/patches/patch-ad 1.12 ---------------------------------------------------------------------------- Module Name: pkgsrc Committed By: drochner Date: Thu Jan 27 14:04:51 UTC 2011 Modified Files: pkgsrc/devel/pango: Makefile distinfo Added Files: pkgsrc/devel/pango/patches: patch-ac patch-ad Log Message: -add patch from https://bugzilla.gnome.org/show_bug.cgi?id=3D639882 to fix possible heap corruption when parsing a corrupt font (CVE-2011-0020) -being here, add a patch from upstream to fix a scaling inconsistency bump PKGREV
2011-03-05Pullup ticket #3373, #3374 and #3375.tron1-0/+6
2011-03-05Pullup ticket #3375 - requested by tacatron1-1/+3
www/typo3: dependence fix Revisions pulled up: - www/typo3/Makefile 1.32 --- Module Name: pkgsrc Committed By: bouyer Date: Wed Mar 2 19:06:09 UTC 2011 Modified Files: pkgsrc/www/typo3: Makefile Log Message: This requires php-json
2011-03-05Pullup ticket #3374 - requested by tacatron3-88/+180
www/mongrel: build fix Revisions pulled up: - www/mongrel/Makefile 1.14 via patch - www/mongrel/files/gemspec 1.1 - www/mongrel/patches/patch-ac 0 --- Module Name: pkgsrc Committed By: taca Date: Mon Feb 28 15:46:39 UTC 2011 Modified Files: pkgsrc/www/mongrel: Makefile Added Files: pkgsrc/www/mongrel/files: gemspec Removed Files: pkgsrc/www/mongrel/patches: patch-ac Log Message: Fix build problem with ruby18. Give up to patch gemspec but use pre-generated one.
2011-03-05Pullup ticket #3373 - requested by tacatron4-16/+86
graphics/ruby-imlib2: build fix Revisions pulled up: - graphics/ruby-imlib2/Makefile 1.25 - graphics/ruby-imlib2/distinfo 1.7 - graphics/ruby-imlib2/files/gemspec 1.1 - graphics/ruby-imlib2/patches/patch-aa 0 --- Module Name: pkgsrc Committed By: taca Date: Mon Feb 28 15:46:08 UTC 2011 Modified Files: pkgsrc/graphics/ruby-imlib2: Makefile distinfo Added Files: pkgsrc/graphics/ruby-imlib2/files: gemspec Removed Files: pkgsrc/graphics/ruby-imlib2/patches: patch-aa Log Message: Fix build problem with ruby18. Give up to patch gemspec but use pre-generated one.
2011-03-03Pullup ticket #3368sbd1-0/+2
2011-03-03Pullup ticket #3368 - requested by tacasbd2-6/+6
net/samba35 security fix. Revisions pulled up: - net/samba35/Makefile 1.2 - net/samba35/distinfo 1.2 --- Module Name: pkgsrc Committed By: taca Date: Mon Feb 28 14:34:56 UTC 2011 Modified Files: pkgsrc/net/samba35: Makefile distinfo Log Message: Update samba35 pacakge to 3.5.7. Release Announcements ===================== Samba 3.5.7, 3.4.12 and 3.3.15 are security releases in order to address CVE-2011-0719. o CVE-2011-0719: All current released versions of Samba are vulnerable to a denial of service caused by memory corruption. Range checks on file descriptors being used in the FD_SET macro were not present allowing stack corruption. This can cause the Samba code to crash or to loop attempting to select on a bad file descriptor set. A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated (guest connection). Currently we do not believe this flaw is exploitable beyond a crash or causing the code to loop, but on the advice of our security reviewers we are releasing fixes in case an exploit is discovered at a later date. Changes ------- o Jeremy Allison <jra at samba.org> * BUG 7949: Fix DoS in Winbind and smbd with many file descriptors open.
2011-03-02pullups 3371 and 3372spz1-0/+4
2011-03-02Pullup ticket 3372 - requested by sbdspz1-2/+2
build fix for Linux Revisions pulled up: - pkgsrc/net/samba35/Makefile 1.3 ----------------------------------------------------------------------------- Module Name: pkgsrc Committed By: sbd Date: Tue Mar 1 11:28:59 UTC 2011 Modified Files: pkgsrc/net/samba35: Makefile Log Message: Add --with-cifsumount to CONFIGURE_ARGS on Linux systems in order to build umount.cifs To generate a diff of this commit: cvs rdiff -u -r1.2 -r1.3 pkgsrc/net/samba35/Makefile
2011-03-02Pullup ticket 3371 - requested by tronspz4-66/+6
security update Revisions pulled up: - pkgsrc/net/wireshark/Makefile 1.60 - pkgsrc/net/wireshark/distinfo by patch Files deleted: pkgsrc/net/wireshark/patches/patch-af pkgsrc/net/wireshark/patches/patch-ag ----------------------------------------------------------------------------- Module Name: pkgsrc Committed By: tron Date: Wed Mar 2 00:09:15 UTC 2011 Modified Files: pkgsrc/net/wireshark: Makefile distinfo Removed Files: pkgsrc/net/wireshark/patches: patch-af patch-ag Log Message: Update "wireshark" package to version 1.4.4. Changes since 1.4.3: - Bug Fixes The following vulnerabilities have been fixed. See the security advisory for details and a workaround. o Huzaifa Sidhpurwala of the Red Hat Security Response Team discovered that Wireshark could free an uninitialized pointer while reading a malformed pcap-ng file. (Bug 5652) Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3. CVE-2011-0538 o Huzaifa Sidhpurwala of the Red Hat Security Response Team discovered that a large packet length in a pcap-ng file could crash Wireshark. (Bug 5661) Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3. o Wireshark could overflow a buffer while reading a Nokia DCT3 trace file. (Bug 5661) Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3. CVE-2011-0713 o Paul Makowski working for SEI/CERT discovered that Wireshark on 32 bit systems could crash while reading a malformed 6LoWPAN packet. (Bug 5661) Versions affected: 1.4.0 to 1.4.3. o joernchen of Phenoelit discovered that the LDAP and SMB dissectors could overflow the stack. (Bug 5717) Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3. (Prior versions including 1.0.x are also affected.) o Xiaopeng Zhang of Fortinet's Fortiguard Labs discovered that large LDAP Filter strings can consume excessive amounts of memory. (Bug 5732) Versions affected: 1.2.0 to 1.2.14 and 1.4.0 to 1.4.3. (Prior versions including 1.0.x are also affected.) The following bugs have been fixed: o A TCP stream would not always be recognized as the same stream. (Bug 2907) o Wireshark Crashing by pressing 2 Buttons. (Bug 4645) o A crash can occur in the NTLMSSP dissector. (Bug 5157) o The column texts from a Lua dissector could be mangled. (Bug 5326) (Bug 5630) o Corrections to ANSI MAP ASN.1 specifications. (Bug 5584) o When searching in packet bytes, the field and bytes are not immediately shown. (Bug 5585) o Malformed Packet: ULP reported when dissecting ULP SessionID PDU. (Bug 5593) o Wrong IEI in container of decode_gtp_mm_cntxt. (Bug 5598) o Display filter does not work for expressions of type BASE_DEC, BASE_DEC_HEX and BASE_HEX_DEC. (Bug 5606) o NTLMSSP dissector may fail to compile due to space embedded in C comment delimiters. (Bug 5614) o Allow for name resolution of link-scope and multicast IPv6 addresses from local host file. (Bug 5615) o DHCPv6 dissector formats DUID_LLT time incorrectly. (Bug 5627) o Allow for IEEE 802.3bc-2009 style PoE TLVs. (Bug 5639) o Various fixes to the HIP packet dissector. (Bug 5646) o Display "Day of Year" for January 1 as 1, not 0. (Bug 5653) o Accommodate the CMake build on Ubuntu 10.10. (Bug 5665) o E.212 MCC 260 Poland update according to local national regulatory. (Bug 5668) o IPP on ports other than 631 not recognized. (Bug 5677) o Potential access violation when writing to LANalyzer files. (Bug 5698) o IEEE 802.15.4 Superframe Specification - Final CAP Slot always 0. (Bug 5700) o Peer SRC and DST AS numbers are swapped for cflow. (Bug 5702) o dumpcap: -q option behavior doesn't match documentation. (Bug 5716) - Updated Protocol Support ANSI MAP, BitTorrent, DCM, DHCPv6, DTAP, DTPT, E.212, GSM Management, GTP, HIP, IEEE 802.15.4, IPP, LDAP, LLDP, Netflow, NTLMSSP, P_Mul, Quake, Skinny, SMB, SNMP, ULP - New and Updated Capture File Support LANalyzer, Nokia DCT3, Pcap-ng To generate a diff of this commit: cvs rdiff -u -r1.59 -r1.60 pkgsrc/net/wireshark/Makefile cvs rdiff -u -r1.41 -r1.42 pkgsrc/net/wireshark/distinfo cvs rdiff -u -r1.1 -r0 pkgsrc/net/wireshark/patches/patch-af \ pkgsrc/net/wireshark/patches/patch-ag
2011-03-01Pullup tickets 3365 3366 3367 3369 3370sbd1-0/+10
2011-03-01Pullup ticket #3370 - requested by tacasbd3-16/+18
lang/pear security fix. Revisions pulled up: - lang/pear/Makefile 1.15 - lang/pear/distinfo 1.7 - lang/pear/patches/patch-aa 1.6 --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Tue Mar 1 03:15:17 UTC 2011 Modified Files: pkgsrc/lang/pear: Makefile distinfo pkgsrc/lang/pear/patches: patch-aa Log Message: Update pear package to 1.9.2, including update of these PEAR packages Console_GetOpt and Structures_Graph. PEAR 1.9.2: Release date: 2011-02-28 18:58 UTC Changelog: Important! This is a security fix release. The advisory can be found at http://pear.php.net/advisory-20110228.txt Bugs: * Fixed Bug #17463: Regression: On Windows, svntag [patch by doconnor] * Fixed Bug #17641: pecl-list doesn't sort packages by name [dufuz] * Fixed Bug #17781: invalid argument warning on foreach due to an empty optional dependencie [dufuz] * Fixed Bug #17801: PEAR run-tests wrongly detects php-cgi [patch by David Jean Louis (izi)] * Fixed Bug #17839: pear svntag does not tag package.xml file [dufuz] * Fixed Bug #17986: PEAR Installer cannot handle files moved between packages [dufuz] * Fixed Bug #17997: Strange output if directories are not writeable [dufuz] * Fixed Bug #18001: PEAR/RunTest coverage fails [dufuz] * Fixed Bug #18056 [SECURITY]: Symlink attack in PEAR install [dufuz] * Fixed Bug #18218: "pear package" does not allow the use of late static binding [dufuz and Christer Edvartsen] * Fixed Bug #18238: Wrong return code from "pear help" [till] * Fixed Bug #18308: Broken error message about missing channel validator [yunosh] This feature is implemented as a result of #18056 * Implemented Request #16648: Use TMPDIR for builds instead of /var/tmp [dufuz] Console_GetOpt 1.3.0 Release date: 2010-12-11 21:23 UTC Changelog: * Implement Request #13140: [PATCH] to skip unknown parameters. [patch by rquadling, improved on by dufuz] Structures_Graph 1.0.4 Release date: 2010-10-26 04:10 UTC Changelog: Bugfix Release: * Bug #17108 BasicGraph::test_directed_degree fails on PHP 5 [clockwerx]
2011-03-01Pullup ticket #3369 - requested by tronsbd3-3/+100
Security patch for "python26" package Revisions pulled up: - lang/python26/Makefile 1.34 - lang/python26/distinfo 1.32 - lang/python26/patches/patch-SA43463 1.1 --- Module Name: pkgsrc Module Name: pkgsrc Committed By: tron Date: Mon Feb 28 22:35:53 UTC 2011 Modified Files: pkgsrc/lang/python26: Makefile distinfo Added Files: pkgsrc/lang/python26/patches: patch-SA43463 Log Message: Add fix for the information disclosure vulnerability reported in SA43463 taken from the Python SVN repository.
2011-03-01Pullup ticket #3367 - requested by tacasbd2-7/+6
net/samba33 security fix. Revisions pulled up: - net/samba33/Makefile 1.13 - net/samba33/distinfo 1.6 --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Mon Feb 28 14:34:09 UTC 2011 Modified Files: pkgsrc/net/samba33: Makefile distinfo Log Message: Update samba33 pacakge to 3.3.15. Release Announcements ===================== Samba 3.5.7, 3.4.12 and 3.3.15 are security releases in order to address CVE-2011-0719. o CVE-2011-0719: All current released versions of Samba are vulnerable to a denial of service caused by memory corruption. Range checks on file descriptors being used in the FD_SET macro were not present allowing stack corruption. This can cause the Samba code to crash or to loop attempting to select on a bad file descriptor set. A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated (guest connection). Currently we do not believe this flaw is exploitable beyond a crash or causing the code to loop, but on the advice of our security reviewers we are releasing fixes in case an exploit is discovered at a later date. Changes ------- o Jeremy Allison <jra at samba.org> * BUG 7949: Fix DoS in Winbind and smbd with many file descriptors open.
2011-03-01Pullup ticket #3366 - requested by tacasbd9-37/+39
databases/mysql5-{client,server} security fixes. Revisions pulled up: - databases/mysql5-client/Makefile.common 1.41 - databases/mysql5-client/distinfo 1.30 - databases/mysql5-client/patches/patch-ad 1.8 - databases/mysql5-client/patches/patch-af 1.9 - databases/mysql5-server/PLIST 1.17 - databases/mysql5-server/distinfo 1.26 - databases/mysql5-server/patches/patch-aa 1.7 - databases/mysql5-server/patches/patch-ag 1.9 - databases/mysql5-server/patches/patch-ah 1.8 --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Sat Feb 26 02:58:56 UTC 2011 Modified Files: pkgsrc/databases/mysql5-client: Makefile.common distinfo pkgsrc/databases/mysql5-client/patches: patch-ad patch-af pkgsrc/databases/mysql5-server: PLIST distinfo pkgsrc/databases/mysql5-server/patches: patch-aa patch-ag patch-ah Log Message: Update mysql5-{client,server} pacakge to 5.0.92. Functionality added or changed: * The time zone tables available at http://dev.mysql.com/downloads/timezones.html have been updated. These tables can be used on systems such as Windows or HP-UX that do not include zoneinfo files. (Bug#40230) Bugs fixed: * Security Fix: During evaluation of arguments to extreme-value functions (such as LEAST() and GREATEST()), type errors did not propagate properly, causing the server to crash. (Bug#55826, CVE-2010-3833) * Security Fix: The server could crash after materializing a derived table that required a temporary table for grouping. (Bug#55568, CVE-2010-3834) * Security Fix: A user-variable assignment expression that is evaluated in a logical expression context can be precalculated in a temporary table for GROUP BY. However, when the expression value is used after creation of the temporary table, it was re-evaluated, not read from the table and a server crash resulted. (Bug#55564, CVE-2010-3835) * Security Fix: Joins involving a table with a unique SET column could cause a server crash. (Bug#54575, CVE-2010-3677) * Security Fix: Pre-evaluation of LIKE predicates during view preparation could cause a server crash. (Bug#54568, CVE-2010-3836) * Security Fix: GROUP_CONCAT() and WITH ROLLUP together could cause a server crash. (Bug#54476, CVE-2010-3837) * Security Fix: Queries could cause a server crash if the GREATEST() or LEAST() function had a mixed list of numeric and LONGBLOB arguments, and the result of such a function was processed using an intermediate temporary table. (Bug#54461, CVE-2010-3838) * Security Fix: Using EXPLAIN with queries of the form SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...) could cause a server crash. (Bug#52711, CVE-2010-3682) * InnoDB Storage Engine: Creating or dropping a table with 1023 transactions active caused an assertion failure. (Bug#49238) * The make_binary_distribution target to make could fail on some platforms because the lines generated were too long for the shell. (Bug#54590) * A client could supply data in chunks to a prepared statement parameter other than of type TEXT or BLOB using the mysql_stmt_send_long_data() C API function (or COM_STMT_SEND_LONG_DATA command). This led to a crash because other data types are not valid for long data. (Bug#54041) * Builds of the embedded mysqld would fail due to a missing element of the struct NET. (Bug#53908, Bug#53912) * The definition of the MY_INIT macro in my_sys.h included an extraneous semicolon, which could cause compilation failure. (Bug#53906) * If the remote server for a FEDERATED table could not be accessed, queries for the INFORMATION_SCHEMA.TABLES table failed. (Bug#35333) * mysqld could fail during execution when using SSL. (Bug#34236) * Threads that were calculating the estimated number of records for a range scan did not respond to the KILL statement. That is, if a range join type is possible (even if not selected by the optimizer as a join type of choice and thus not shown by EXPLAIN), the query in the statistics state (shown by the SHOW PROCESSLIST) did not respond to the KILL statement. (Bug#25421)
2011-03-01Pullup ticket #3365 - requested by tacasbd2-2/+4
textproc/php-intl security fix Revisions pulled up: - textproc/php-intl/Makefile 1.5 - textproc/php-intl/distinfo 1.3 - textproc/php-intl/patches/patch-grapheme_grapheme__string.c 1.1 --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Sat Feb 26 02:55:28 UTC 2011 Modified Files: pkgsrc/textproc/php-intl: Makefile distinfo Added Files: pkgsrc/textproc/php-intl/patches: patch-grapheme_grapheme__string.c Log Message: Add a fix for CVE-2011-0420 (CERT: VU#210829) from PHP's repository, r306449. Bump PKGREVISION.
2011-02-27Pullup ticket #3361.tron1-0/+96
2011-02-27Pullup ticket #3361 - requested by tacatron100-147/+239
archivers/ruby-libarchive: dependence update comms/ruby-termios: dependence update converters/ruby-uconv: dependence update databases/ruby-do_sqlite3: dependence update databases/ruby-ldap: dependence update databases/ruby-mysql: dependence update databases/ruby-odbc: dependence update databases/ruby-pg: dependence update databases/ruby-postgresql: dependence update databases/ruby-qdbm: dependence update databases/ruby-sqlite: dependence update databases/ruby-sqlite3: dependence update databases/ruby-tokyocabinet: dependence update devel/ruby-SDL: dependence update devel/ruby-debug-base: dependence update devel/ruby-eet: dependence update devel/ruby-eventmachine: dependence update devel/ruby-ffi: dependence update devel/ruby-gnome2-atk: dependence update devel/ruby-gnome2-bonobo: dependence update devel/ruby-gnome2-bonoboui: dependence update devel/ruby-gnome2-gconf: dependence update devel/ruby-gnome2-gio: dependence update devel/ruby-gnome2-glib: dependence update devel/ruby-gnome2-libglade: dependence update devel/ruby-gnome2-pango: dependence update devel/ruby-linecache: dependence update devel/ruby-memcache: dependence update devel/ruby-ncurses: dependence update devel/ruby-priority-queue: dependence update devel/ruby-racc: dependence update devel/ruby-rbtree: dependence update devel/ruby-rcov: dependence update devel/ruby-rcsparse: dependence update devel/ruby-subversion: dependence update devel/ruby-thrift: dependence update graphics/ruby-RMagick: dependence update graphics/ruby-clutter-cairo: dependence update graphics/ruby-clutter-core: dependence update graphics/ruby-clutter-gtk: dependence update graphics/ruby-gd: dependence update graphics/ruby-gnome2-gdkpixbuf: dependence update graphics/ruby-gnome2-gnomecanvas: dependence update graphics/ruby-gnome2-goocanvas: dependence update graphics/ruby-gnome2-gtkglext: dependence update graphics/ruby-gnome2-libart: dependence update graphics/ruby-gnome2-rsvg: dependence update graphics/ruby-imlib2: dependence update graphics/ruby-opengl: dependence update graphics/ruby-rcairo: dependence update inputmethod/ruby-zinnia: dependence update lang/ruby: dependence update lang/ruby18-base: security update lang/ruby19-base: security update mail/ruby-tmail: dependence update math/ruby-rb-gsl: dependence update multimedia/ruby-clutter-gst: dependence update multimedia/ruby-gnome2-gstreamer: dependence update multimedia/ruby-ming: dependence update print/ruby-gnome2-gnomeprint: dependence update print/ruby-gnome2-gnomeprintui: dependence update print/ruby-gnome2-poppler: dependence update security/ruby-password: dependence update security/ruby-tcpwrap: dependence update sysutils/ruby-quota: dependence update textproc/ruby-bluecloth: dependence update textproc/ruby-cabocha: dependence update textproc/ruby-eruby: dependence update textproc/ruby-ferret: dependence update textproc/ruby-hpricot: dependence update textproc/ruby-itex2MML: dependence update textproc/ruby-json: dependence update textproc/ruby-libxml: dependence update textproc/ruby-mecab: dependence update textproc/ruby-native-hyperestraier: dependence update textproc/ruby-nokogiri: dependence update textproc/ruby-oniguruma: dependence update textproc/ruby-redcloth: dependence update textproc/ruby-sary: dependence update textproc/ruby-xmlparser: dependence update textproc/ruby-xslt: dependence update textproc/ruby-yamcha: dependence update www/mongrel: dependence update www/ruby-clearsilver: dependence update www/ruby-fcgi: dependence update www/ruby-gnome2-gtkhtml2: dependence update www/ruby-gnome2-gtkmozembed: dependence update www/ruby-patron: dependence update www/thin: dependence update x11/ruby-gnome2-gnome: dependence update x11/ruby-gnome2-gtk: dependence update x11/ruby-gnome2-gtksourceview: dependence update x11/ruby-gnome2-gtksourceview2: dependence update x11/ruby-gnome2-panelapplet: dependence update x11/ruby-gnome2-vte: dependence update Revisions pulled up: - archivers/ruby-libarchive/Makefile 1.2 - comms/ruby-termios/Makefile 1.23 - converters/ruby-uconv/Makefile 1.19 - databases/ruby-do_sqlite3/Makefile 1.2 - databases/ruby-ldap/Makefile 1.7 - databases/ruby-mysql/Makefile 1.34 via patch - databases/ruby-odbc/Makefile 1.10 via patch - databases/ruby-pg/Makefile 1.6 - databases/ruby-postgresql/Makefile 1.37 - databases/ruby-qdbm/Makefile 1.12 - databases/ruby-sqlite/Makefile 1.3 - databases/ruby-sqlite3/Makefile 1.15 - databases/ruby-tokyocabinet/Makefile 1.24 - devel/ruby-SDL/Makefile 1.9 via patch - devel/ruby-debug-base/Makefile 1.7 - devel/ruby-eet/Makefile 1.8 - devel/ruby-eventmachine/Makefile 1.7 - devel/ruby-ffi/Makefile 1.3 - devel/ruby-gnome2-atk/Makefile 1.8 - devel/ruby-gnome2-bonobo/Makefile patch - devel/ruby-gnome2-bonoboui/Makefile patch - devel/ruby-gnome2-gconf/Makefile patch - devel/ruby-gnome2-gio/Makefile 1.3 via patch - devel/ruby-gnome2-glib/Makefile 1.11 - devel/ruby-gnome2-libglade/Makefile patch - devel/ruby-gnome2-pango/Makefile 1.18 via patch - devel/ruby-linecache/Makefile 1.5 - devel/ruby-memcache/Makefile 1.4 - devel/ruby-ncurses/Makefile 1.9 - devel/ruby-priority-queue/Makefile 1.6 - devel/ruby-racc/Makefile 1.18 - devel/ruby-rbtree/Makefile 1.6 - devel/ruby-rcov/Makefile 1.5 - devel/ruby-rcsparse/Makefile 1.10 - devel/ruby-subversion/Makefile 1.28 - devel/ruby-thrift/Makefile 1.4 via patch - graphics/ruby-RMagick/Makefile 1.76 via patch - graphics/ruby-clutter-cairo/Makefile 1.8 via patch - graphics/ruby-clutter-core/Makefile 1.11 via patch - graphics/ruby-clutter-gtk/Makefile 1.8 via patch - graphics/ruby-gd/Makefile 1.34 via patch - graphics/ruby-gnome2-gdkpixbuf/Makefile 1.20 via patch - graphics/ruby-gnome2-gnomecanvas/Makefile patch - graphics/ruby-gnome2-goocanvas/Makefile 1.12 via patch - graphics/ruby-gnome2-gtkglext/Makefile patch - graphics/ruby-gnome2-libart/Makefile patch - graphics/ruby-gnome2-rsvg/Makefile 1.21 va patch - graphics/ruby-imlib2/Makefile 1.24 va patch - graphics/ruby-opengl/Makefile 1.31 - graphics/ruby-rcairo/Makefile 1.22 via patch - inputmethod/ruby-zinnia/Makefile 1.3 - lang/ruby/buildlink3.mk 1.13 - lang/ruby/rubyversion.mk 1.58-1.59 - lang/ruby18-base/distinfo 1.47 - lang/ruby19-base/DEINSTALL 1.2 - lang/ruby19-base/Makefile 1.7 - lang/ruby19-base/PLIST 1.4 - lang/ruby19-base/distinfo 1.4 - lang/ruby19-base/patches/patch-string.c 1.1 - mail/ruby-tmail/Makefile 1.19 - math/ruby-rb-gsl/Makefile 1.9 - multimedia/ruby-clutter-gst/Makefile 1.9 via patch - multimedia/ruby-gnome2-gstreamer/Makefile 1.7 - multimedia/ruby-ming/Makefile 1.15 via patch - print/ruby-gnome2-gnomeprint/Makefile patch - print/ruby-gnome2-gnomeprintui/Makefile patch - print/ruby-gnome2-poppler/Makefile 1.19 via patch - security/ruby-password/Makefile 1.5 - security/ruby-tcpwrap/Makefile 1.18 - sysutils/ruby-quota/Makefile 1.21 - textproc/ruby-bluecloth/Makefile 1.5 - textproc/ruby-cabocha/Makefile 1.3 - textproc/ruby-eruby/Makefile 1.26 - textproc/ruby-ferret/Makefile 1.6 - textproc/ruby-hpricot/Makefile 1.8 - textproc/ruby-itex2MML/Makefile 1.7 - textproc/ruby-json/Makefile 1.9 - textproc/ruby-libxml/Makefile 1.7 - textproc/ruby-mecab/Makefile 1.6 - textproc/ruby-native-hyperestraier/Makefile 1.6 - textproc/ruby-nokogiri/Makefile 1.4 - textproc/ruby-oniguruma/Makefile 1.6 - textproc/ruby-redcloth/Makefile 1.14 - textproc/ruby-sary/Makefile 1.7 - textproc/ruby-xmlparser/Makefile 1.15 - textproc/ruby-xslt/Makefile 1.7 - textproc/ruby-yamcha/Makefile 1.3 - www/mongrel/Makefile 1.13 via patch - www/ruby-clearsilver/Makefile 1.15 - www/ruby-fcgi/Makefile 1.15 - www/ruby-gnome2-gtkhtml2/Makefile patch - www/ruby-gnome2-gtkmozembed/Makefile 1.17 via patch - www/ruby-patron/Makefile 1.5 - www/thin/Makefile 1.8 via patch - x11/ruby-gnome2-gtk/Makefile 1.25 via patch - x11/ruby-gnome2-gtksourceview/Makefile patch via 1.12 - x11/ruby-gnome2-gtksourceview2/Makefile patch - x11/ruby-gnome2-panelapplet/Makefile patch - x11/ruby-gnome2-vte/Makefile 1.16 via patch --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Mon Feb 21 14:31:06 UTC 2011 Modified Files: pkgsrc/lang/ruby: rubyversion.mk Log Message: * Start upate of ruby18 and ruby19 packags. * Remove redundant GEM_HOME definition from PLIST. --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Mon Feb 21 14:35:38 UTC 2011 Modified Files: pkgsrc/lang/ruby18-base: distinfo Log Message: Update ruby18-base package to 1.8.7.334 (Ruby 1.8.7p334). * The FileUtils Vulnerability http://www.ruby-lang.org/en/news/2011/02/18/fileutils-is-vulnerable-to-symlink-race-attacks/ * The $SAFE Vulnerability Fri Feb 18 21:18:55 2011 Shugo Maeda <shugo@ruby-lang.org> * test/ruby/test_exception.rb (TestException::test_to_s_taintness_propagation): Test for below. Fri Feb 18 21:18:55 2011 URABE Shyouhei <shyouhei@ruby-lang.org> * error.c (exc_to_s): untainted strings can be tainted via Exception#to_s, which enables attackers to overwrite sane strings. Reported by: Yusuke Endoh <mame at tsg.ne.jp>. * error.c (name_err_to_s): ditto. Fri Feb 18 21:17:22 2011 Shugo Maeda <shugo@ruby-lang.org> * lib/fileutils.rb (FileUtils::remove_entry_secure): there is a race condition in the case where the given path is a directory, and some other user can move that directory, and create a symlink while this method is executing. Reported by: Nicholas Jefferson <nicholas at pythonic.com.au> Fri Feb 18 19:46:46 2011 NAKAMURA Usaku <usa@ruby-lang.org> * win32/win32.c (init_stdhandle): backport mistake of r29382. some code are needless in ruby 1.8. [ruby-core:34579] Fri Feb 18 19:22:17 2011 URABE Shyouhei <shyouhei@ruby-lang.org> * configure.in: revert revision r29854. This revision introduced binary incompatibilities on some circumstances. The bug that revision was fixing gets reopened by this reversion. [ruby-dev:43152] cf. [Bug #2553] --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Mon Feb 21 14:44:11 UTC 2011 Modified Files: pkgsrc/lang/ruby19-base: DEINSTALL Makefile PLIST distinfo Added Files: pkgsrc/lang/ruby19-base/patches: patch-string.c Log Message: Update ruby19-base package to 1.9.2pl180 (Ruby 1.9.2 p180). * The FileUtils Vulnerability http://www.ruby-lang.org/en/news/2011/02/18/fileutils-is-vulnerable-to-symlink-race-attacks/ * Add a patch r30779 from repository; a bug of utf-8 string handling. For more detail changes of Ruby 1.9.2pl180, please refer: http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_180/ChangeLog --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Mon Feb 21 15:00:34 UTC 2011 Modified Files: pkgsrc/lang/ruby: buildlink3.mk rubyversion.mk Log Message: Introduce RUBY_ABI_VERSION and use it BUILDLINK_ABI_DEPENDS. There are ABI incompatibility amaong Ruby 1.8.7 patchlevel 302, 330 and 334, So it would be handle if such problem in future. --- Module Name: pkgsrc Module Name: pkgsrc Committed By: taca Date: Mon Feb 21 16:01:24 UTC 2011 Modified Files: pkgsrc/archivers/ruby-libarchive: Makefile pkgsrc/comms/ruby-termios: Makefile pkgsrc/converters/ruby-uconv: Makefile pkgsrc/databases/ruby-do_sqlite3: Makefile pkgsrc/databases/ruby-ldap: Makefile pkgsrc/databases/ruby-mysql: Makefile pkgsrc/databases/ruby-odbc: Makefile pkgsrc/databases/ruby-pg: Makefile pkgsrc/databases/ruby-postgresql: Makefile pkgsrc/databases/ruby-qdbm: Makefile pkgsrc/databases/ruby-sqlite: Makefile pkgsrc/databases/ruby-sqlite3: Makefile pkgsrc/databases/ruby-tokyocabinet: Makefile pkgsrc/devel/ruby-SDL: Makefile pkgsrc/devel/ruby-debug-base: Makefile pkgsrc/devel/ruby-eet: Makefile pkgsrc/devel/ruby-eventmachine: Makefile pkgsrc/devel/ruby-ffi: Makefile pkgsrc/devel/ruby-gnome2-atk: Makefile pkgsrc/devel/ruby-gnome2-gio: Makefile pkgsrc/devel/ruby-gnome2-glib: Makefile pkgsrc/devel/ruby-gnome2-pango: Makefile pkgsrc/devel/ruby-linecache: Makefile pkgsrc/devel/ruby-memcache: Makefile pkgsrc/devel/ruby-ncurses: Makefile pkgsrc/devel/ruby-priority-queue: Makefile pkgsrc/devel/ruby-racc: Makefile pkgsrc/devel/ruby-rbtree: Makefile pkgsrc/devel/ruby-rcov: Makefile pkgsrc/devel/ruby-rcsparse: Makefile pkgsrc/devel/ruby-subversion: Makefile pkgsrc/devel/ruby-thrift: Makefile pkgsrc/graphics/ruby-RMagick: Makefile pkgsrc/graphics/ruby-clutter-cairo: Makefile pkgsrc/graphics/ruby-clutter-core: Makefile pkgsrc/graphics/ruby-clutter-gtk: Makefile pkgsrc/graphics/ruby-gd: Makefile pkgsrc/graphics/ruby-gnome2-gdkpixbuf: Makefile pkgsrc/graphics/ruby-gnome2-goocanvas: Makefile pkgsrc/graphics/ruby-gnome2-rsvg: Makefile pkgsrc/graphics/ruby-imlib2: Makefile pkgsrc/graphics/ruby-opengl: Makefile pkgsrc/graphics/ruby-rcairo: Makefile pkgsrc/inputmethod/ruby-zinnia: Makefile pkgsrc/mail/ruby-tmail: Makefile pkgsrc/math/ruby-rb-gsl: Makefile pkgsrc/multimedia/ruby-clutter-gst: Makefile pkgsrc/multimedia/ruby-gnome2-gstreamer: Makefile pkgsrc/multimedia/ruby-ming: Makefile pkgsrc/print/ruby-gnome2-poppler: Makefile pkgsrc/security/ruby-password: Makefile pkgsrc/security/ruby-tcpwrap: Makefile pkgsrc/sysutils/ruby-quota: Makefile pkgsrc/textproc/ruby-bluecloth: Makefile pkgsrc/textproc/ruby-cabocha: Makefile pkgsrc/textproc/ruby-eruby: Makefile pkgsrc/textproc/ruby-ferret: Makefile pkgsrc/textproc/ruby-hpricot: Makefile pkgsrc/textproc/ruby-itex2MML: Makefile pkgsrc/textproc/ruby-json: Makefile pkgsrc/textproc/ruby-libxml: Makefile pkgsrc/textproc/ruby-mecab: Makefile pkgsrc/textproc/ruby-native-hyperestraier: Makefile pkgsrc/textproc/ruby-nokogiri: Makefile pkgsrc/textproc/ruby-oniguruma: Makefile pkgsrc/textproc/ruby-redcloth: Makefile pkgsrc/textproc/ruby-sary: Makefile pkgsrc/textproc/ruby-xmlparser: Makefile pkgsrc/textproc/ruby-xslt: Makefile pkgsrc/textproc/ruby-yamcha: Makefile pkgsrc/www/mongrel: Makefile pkgsrc/www/ruby-clearsilver: Makefile pkgsrc/www/ruby-fcgi: Makefile pkgsrc/www/ruby-gnome2-gtkmozembed: Makefile pkgsrc/www/ruby-patron: Makefile pkgsrc/www/thin: Makefile pkgsrc/x11/ruby-gnome2-gtk: Makefile pkgsrc/x11/ruby-gnome2-gtksourceview2: Makefile pkgsrc/x11/ruby-gnome2-vte: Makefile Log Message: Bump PKGREVISION due to ABI change of ruby18-base.
2011-02-26Add a fix for CVE-2011-0420 (CERT: VU#210829) from PHP's repository, r306449.taca1-0/+26
Bump PKGREVISION.
2011-02-25Ticket #3358.tron1-0/+3
2011-02-25Pullup ticket #3358 - requested by tacatron4-2/+30
devel/ruby-activemodel: security patch www/ruby-actionpack3: security patch Revisions pulled up - devel/ruby-activemodel/Makefile 1.4 - devel/ruby-activemodel/patches/patch-.._activemodel-3.0.4.gemspec 1.1 - www/ruby-actionpack3/Makefile 1.4 - www/ruby-actionpack3/patches/patch-.._actionpack-3.0.4.gemspec 1.1 --- Module Name: pkgsrc Committed By: taca Date: Sun Feb 20 02:12:08 UTC 2011 Modified Files: pkgsrc/devel/ruby-activemodel: Makefile Added Files: pkgsrc/devel/ruby-activemodel/patches: patch-.._activemodel-3.0.4.gemspec Log Message: Add missing patch file, something was wrong since patches/CVS directory existed but patches directory wasn't cvs added... Bump PKGREVISION. --- Module Name: pkgsrc Committed By: taca Date: Sun Feb 20 15:44:17 UTC 2011 Modified Files: pkgsrc/www/ruby-actionpack3: Makefile Added Files: pkgsrc/www/ruby-actionpack3/patches: patch-.._actionpack-3.0.4.gemspec Log Message: Add another missing patch, noted by HIRAMATSU Yoshifumi on tech-pkg-ja@. Bump PKGREVISION.
2011-02-25Pullup ticket #3364.tron1-0/+2
2011-02-25Pullup ticket #3364 - requested by tacatron4-75/+3
misc/rubygems: build fix Revisions pulled up: - misc/rubygems/Makefile 1.36 - misc/rubygems/distinfo 1.27 - misc/rubygems/patches/patch-aq delete - misc/rubygems/patches/patch-ar delete --- Module Name: pkgsrc Committed By: taca Date: Wed Feb 23 10:32:24 UTC 2011 Modified Files: pkgsrc/misc/rubygems: Makefile distinfo Removed Files: pkgsrc/misc/rubygems/patches: patch-aq patch-ar Log Message: Remove patches to make a gemspec file's format compatible as before. Now latest ruby19-base package comes with gem supporting newer format, so no need to keep older. Shouold be fix build problem of newer rails3 related packages with ruby18-base. Bump PKGREVISION.
2011-02-23Pullup ticket #3363.tron1-0/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-26 16:14:09 +0000