summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-02-18Pullup ticket #4617 - requested by sevantron5-2/+101
lang/php55: security patch Revisions pulled up: - lang/php55/Makefile 1.18 - lang/php55/distinfo 1.34 - lang/php55/patches/patch-ext_date_php_date.c 1.1 - lang/php55/patches/patch-ext_date_tests_bug68942.phpt 1.1 - lang/php55/patches/patch-ext_date_tests_bug68942_2.phpt 1.1 --- Module Name: pkgsrc Committed By: sevan Date: Wed Feb 18 11:14:16 UTC 2015 Modified Files: pkgsrc/lang/php55: Makefile distinfo Added Files: pkgsrc/lang/php55/patches: patch-ext_date_php_date.c patch-ext_date_tests_bug68942.phpt patch-ext_date_tests_bug68942_2.phpt Log Message: Fix CVE-2015-0273 php: #68942 Use after free vulnerability in unserialize() with DateTimeZone Reviewed by wiz@
2015-02-18Pullup ticket #4617 - requested by sevantron4-2/+51
lang/php54: security patch Revisions pulled up: - lang/php54/Makefile 1.26 - lang/php54/distinfo 1.52 - lang/php54/patches/patch-ext_date_php_date.c 1.1 - lang/php54/patches/patch-ext_date_tests_bug68942_2.phpt 1.1 --- Module Name: pkgsrc Committed By: sevan Date: Wed Feb 18 11:04:04 UTC 2015 Modified Files: pkgsrc/lang/php54: Makefile distinfo Added Files: pkgsrc/lang/php54/patches: patch-ext_date_php_date.c patch-ext_date_tests_bug68942_2.phpt Log Message: Fix CVE-2015-0273 php: #68942 Use after free vulnerability in unserialize() with DateTimeZone Reviewed by wiz@
2015-02-18Pullup ticket #4616 - requested by sevantron2-6/+6
devel/patch: security update Revisions pulled up: - devel/patch/Makefile 1.41 - devel/patch/distinfo 1.9 --- Module Name: pkgsrc Committed By: mef Date: Sun Feb 8 09:29:43 UTC 2015 Modified Files: pkgsrc/devel/patch: Makefile distinfo Log Message: Update 2.7.1 to 2.7.4 --------------------- Changes until version 2.7.4: * When a file isn't being deleted because the file contents don't match the patch, the resulting message is now "Not deleting file ... as content differs from patch" instead of "File ... is not empty after patch; not deleting". * Function names in hunks (from diff -p) are now preserved in reject files. * Patch no longer follows symbolic links to input and output files. This ensures that symbolic links created by git-style patches cannot cause patch to write outside the working directory (CVE-2015-1196). * Various fixes.
2015-02-15Pullup tickes #4613 and #4614.tron1-1/+5
2015-02-15Pullup ticket #4614 - requested by tnntron3-8/+7
multimedia/ffmpeg1: security update Revisions pulled up: - multimedia/ffmpeg1/Makefile 1.4 - multimedia/ffmpeg1/Makefile.common 1.5-1.6 - multimedia/ffmpeg1/distinfo 1.6-1.7 --- Module Name: pkgsrc Committed By: wiz Date: Tue Dec 30 13:47:58 UTC 2014 Modified Files: pkgsrc/multimedia/ffmpeg1: Makefile Makefile.common distinfo Log Message: Update to 1.2.11: 1.2.11 was released on 2014-12-19. It is the latest stable FFmpeg release from the 1.2 release branch, which was cut from master on 2013-03-07. Amongst lots of other changes, it includes all changes from ffmpeg-mt, libav master of 2013-03-07, libav 9 as of 2013-03-07. --- Module Name: pkgsrc Committed By: tnn Date: Sun Feb 15 10:50:01 UTC 2015 Modified Files: pkgsrc/multimedia/ffmpeg1: Makefile.common distinfo Log Message: Update to ffmpeg1-1.2.12. Security update for: CVE-2014-9317 out-of-bounds access in PNG decoder CVE-2014-9316 out-of-bounds access in MJPEG decoder CVE-2014-9603 out-of-bounds access in Sierra VMD decoder CVE-2014-9604 out-of-bounds access in Ut Video decoder and other small bugfixes
2015-02-15Pullup ticket #4613 - requested by tnntron3-15/+15
multimedia/ffmpeg2: security update Revisions pulled up: - multimedia/ffmpeg2/Makefile.common 1.27-1.29 - multimedia/ffmpeg2/distinfo 1.26-1.28 - multimedia/ffmpeg2/patches/patch-configure 1.6 --- Module Name: pkgsrc Committed By: adam Date: Tue Dec 30 06:40:46 UTC 2014 Modified Files: pkgsrc/multimedia/ffmpeg2: Makefile.common distinfo Log Message: Changes 2.5.2: * Makefile: add dependencies which require ffversion.h * Add FFMPEG_VERSION into the binary libs * mmvideo: check frame dimensions * jvdec: check frame dimensions * avcodec/indeo3: ensure offsets are non negative * avcodec/h264: Check *log2_weight_denom * avcodec/hevc_ps: Check diff_cu_qp_delta_depth * avcodec/h264: Clear delayed_pic on deallocation * avcodec/hevc: clear filter_slice_edges() on allocation * avcodec/dcadec: Check that the added xch channel isnt already there * avcodec/indeo3: use signed variables to avoid underflow * avcodec/h264: make the first field of H264Context an AVClass * swscale: increase yuv2rgb table headroom * avformat/mov: fix integer overflow of size * avformat/mov: check atom nesting depth * avcodec/utvideodec: Fix handling of slice_height=0 * avcodec/xface: Add asserts to limit nb_words from becoming too large * avcodec/xface: correct the XFACE_MAX_* values * avcodec/vmdvideo: Check len before using it in method 3 * avformat/flvdec: Use av_freep() avoid leaving stale pointers in memory * avformat/hdsenc: Use av_freep() avoid leaving stale pointers in memory * configure: create the tests directory like the doc directory --- Module Name: pkgsrc Committed By: adam Date: Sat Jan 10 19:10:20 UTC 2015 Modified Files: pkgsrc/multimedia/ffmpeg2: Makefile.common distinfo Log Message: Changes 2.5.3: * doc/examples: fix lib math dep for decoding_encoding * avformat/movenc: workaround bug in "PathScale EKOPath(tm) Compiler Suite Version 4.0.12.1" --- Module Name: pkgsrc Committed By: adam Date: Sat Feb 14 15:41:43 UTC 2015 Modified Files: pkgsrc/multimedia/ffmpeg2: Makefile.common distinfo pkgsrc/multimedia/ffmpeg2/patches: patch-configure Log Message: Changes 2.5.4: * avfilter/dctdnoiz: fix slice_h computation * x86/lossless_audiodsp: fix compilation with --disable-yasm * avutil/opencl: don't include config.h * x86/swr: add missing alignment check to pack_6ch functions
2015-02-14Pullup tickes #4609, #4610 and #4611.tron1-1/+7
2015-02-14Pullup ticket #4611 - requested by tacatron5-2/+143
www/contao33: security patch Revisions pulled up: - www/contao33/Makefile patch - www/contao33/distinfo patch - www/contao33/patches/patch-system_modules_core_classes_Backend.php new file - www/contao33/patches/patch-system_modules_core_dca_tl__templates.php new file - www/contao33/patches/patch-system_modules_core_library_Contao_Validator.php new file --- Apply patch to fix directory traversal security problem.
2015-02-14Pullup ticket #4610 - requested by tacatron3-9/+9
www/contao34: security update Revisions pulled up: - www/contao/Makefile.common patch - www/contao34/Makefile 1.3-1.4 - www/contao34/distinfo 1.2-1.4 --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 23 16:16:23 UTC 2015 Modified Files: pkgsrc/www/contao: Makefile.common pkgsrc/www/contao34: Makefile distinfo Log Message: Update to contao34 to 3.4.2. Version 3.4.2 (2015-01-22) -------------------------- ### Fixed Fix an infinite recursion problem in the `FilesModel` class (see #7588). Version 3.4.1 (2015-01-22) -------------------------- ### Fixed Fix the position of the input field hints (see #7561). ### Fixed Do not apply the GDlib maximum dimensions to SVG images (see #7435). ### Fixed Do not show the diff icon if a record has been deleted (see #7429). ### Fixed Remove a left-over headline from the `ce_text.xhtml` template (see #7502). ### Fixed Preserve comments when exporting CSS files (see #7482). ### Fixed Fix the LESS import path in the Combiner (see #7533). ### Fixed Hide the width and height attributes if there is a sizes attribute (see #7500). ### Fixed Remove the hardcoded figcaption width (see #7549). ### Fixed Only load the model in the file/page picker if the class exists (see #7490). ### Fixed Romanize style sheet names (see #7526). ### Fixed Add the username to the "account has been locked" log entry (see #7551). ### Fixed Consider the suhosin.memory_limit when raising the PHP limits (see #7035). ### Fixed Added two missing `exclude` flags in the `tl_page` data container (see #7522). ### Fixed Send an UTF-8 charset header in the `die_nicely()` function (see #7519). ### Fixed Correctly validate dates in the `Widget` class (see #7498). ### Fixed Back port the fixes from #7475 and #7473. ### Fixed Send the same cache headers for cached and uncached pages (see #7455). ### Fixed Fix the `current() expects parameter 1 to be array` issue (see #6739). ### Fixed Correctly replace the `*_teaser` insert tags (see #7488). ### Fixed Adjust the last and previous login labels (see #7426). ### Fixed Unset the `postUnsafeRaw` cache in `Input::setPost()` (see #7481). --- Module Name: pkgsrc Committed By: taca Date: Sun Feb 1 04:51:34 UTC 2015 Modified Files: pkgsrc/www/contao: Makefile.common pkgsrc/www/contao34: Makefile distinfo Log Message: Update contao34 to 3.4.3 (Contao 3.4.3). * pkgsrc change: change config directory's permission. Version 3.4.3 (2015-01-30) -------------------------- ### Fixed Consider the error reporting level in the install tool (see #7593). ### Fixed Handle variables and functions when importing style sheets (see #7448). --- Module Name: pkgsrc Committed By: taca Date: Fri Feb 13 03:03:57 UTC 2015 Modified Files: pkgsrc/www/contao: Makefile.common pkgsrc/www/contao34: distinfo Log Message: Update contao34 package to 3.4.4 (Contao 3.4.4). Version 3.4.4 (2015-02-12) -------------------------- ### Fixed Fixed a directory traversal vulnerability discovered by Arnaud Buchoux. See CVE-2015-0269 for more information.
2015-02-14Pullup ticket #4609 - requested by tacatron3-13/+9
www/contao32: security update Revisions pulled up: - www/contao/Makefile.common patch - www/contao32/Makefile 1.8-1.9 - www/contao32/distinfo 1.18-1.20 --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 23 16:14:35 UTC 2015 Modified Files: pkgsrc/www/contao: Makefile.common pkgsrc/www/contao32: Makefile distinfo Log Message: Update contao32 pacakge to 3.2.17. Version 3.2.17 (2015-01-22) --------------------------- ### Fixed Romanize style sheet names (see #7526). ### Fixed Add the username to the "account has been locked" log entry (see #7551). ### Fixed Consider the suhosin.memory_limit when raising the PHP limits (see #7035). ### Fixed Added two missing `exclude` flags in the `tl_page` data container (see #7522). ### Fixed Send an UTF-8 charset header in the `die_nicely()` function (see #7519). ### Fixed Correctly validate dates in the `Widget` class (see #7498). ### Fixed Back port the fixes from #7475 and #7473. ### Fixed Send the same cache headers for cached and uncached pages (see #7455). ### Fixed Fix the `current() expects parameter 1 to be array` issue (see #6739). ### Fixed Correctly replace the `*_teaser` insert tags (see #7488). ### Fixed Adjust the last and previous login labels (see #7426). ### Fixed Unset the `postUnsafeRaw` cache in `Input::setPost()` (see #7481). --- Module Name: pkgsrc Committed By: taca Date: Sun Feb 1 04:49:39 UTC 2015 Modified Files: pkgsrc/www/contao: Makefile.common pkgsrc/www/contao32: Makefile distinfo Log Message: Update contao32 to 3.2.18 (Contao 3.2.18). * pkgsrc change: change config directory's permission. Version 3.2.18 (2015-01-30) --------------------------- ### Fixed Handle variables and functions when importing style sheets (see #7448). ### Fixed Fix an infinite recursion problem in the `FilesModel` class (see #7588). --- Module Name: pkgsrc Committed By: taca Date: Fri Feb 13 03:02:53 UTC 2015 Modified Files: pkgsrc/www/contao: Makefile.common pkgsrc/www/contao32: distinfo Log Message: Update contao32 package to 3.2.19 (Contao 3.2.19). Version 3.2.19 (2015-02-12) --------------------------- ### Fixed Fixed a directory traversal vulnerability discovered by Arnaud Buchoux. See CVE-2015-0269 for more information.
2015-02-14Pullup ticket #4612.tron1-1/+3
2015-02-14Pullup ticket #4612 - requested by spztron2-6/+6
security/sudo: security update Revisions pulled up: - security/sudo/Makefile 1.145 - security/sudo/distinfo 1.82 --- Module Name: pkgsrc Committed By: spz Date: Wed Feb 11 09:11:59 UTC 2015 Modified Files: pkgsrc/security/sudo: Makefile distinfo Log Message: update of sudo to the next upstream patch version (1.7.10p8 to 1.7.10p9) Upstream Changelog: + The TZ environment variable is now checked for safety instead of simply being copied to the environment of the command. This fixes a potential security issue. + Sudo now only builds Position Independent Executables (PIE) by default on Linux systems and verifies that a trivial test program builds and runs. + On Solaris 11.1 and higher, sudo binaries will now have the ASLR tag enabled if supported by the linker.
2015-02-12Pullup ticket #4608.tron1-1/+3
2015-02-12Pullup ticket #4608 - requested by tnntron2-6/+6
archivers/cabextract: security update Revisions pulled up: - archivers/cabextract/Makefile 1.26 - archivers/cabextract/distinfo 1.14 --- Module Name: pkgsrc Committed By: wiz Date: Thu Jan 29 13:28:28 UTC 2015 Modified Files: pkgsrc/archivers/cabextract: Makefile distinfo Log Message: Update to 1.5: New in 1.5 * cabextract replaces bad Unicode characters in filenames with the standard Unicode replacement character * wince_rename now puts files under the correct installation path * Several crashes and hangs were found by Debian project members using the afl (American fuzzy lop) tool to generate corrupt cabinet files. These crashes and hangs have been fixed.
2015-02-11Pullup tickes #4606 and #4607.tron1-1/+5
2015-02-11Pullup ticket #4607 - requested by istron1-2/+2
lang/erlang: build fix Revisions pulled up: - lang/erlang/Makefile 1.63 --- Module Name: pkgsrc Committed By: is Date: Wed Feb 11 15:11:48 UTC 2015 Modified Files: pkgsrc/lang/erlang: Makefile Log Message: make Erlang compile on netbsd-6*/shark.
2015-02-11Pullup ticket #4606 - requested by wiztron3-3/+144
x11/modular-xorg-server: security patch Revisions pulled up: - x11/modular-xorg-server/Makefile 1.87 - x11/modular-xorg-server/distinfo 1.56 - x11/modular-xorg-server/patches/patch-xkb_xkb.c 1.1 --- Module Name: pkgsrc Committed By: wiz Date: Wed Feb 11 09:43:39 UTC 2015 Modified Files: pkgsrc/x11/modular-xorg-server: Makefile distinfo Added Files: pkgsrc/x11/modular-xorg-server/patches: patch-xkb_xkb.c Log Message: Fix http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/ Bump PKGREVISION.
2015-02-05Pullup ticket #4604.tron1-1/+4
2015-02-05Pullup ticket #4604 - requested by sptron4-12/+11
devel/libevent: security update devel/py-libevent-rpcgen: security update Revisions pulled up: - devel/libevent/Makefile 1.46 - devel/libevent/Makefile.common 1.2 - devel/libevent/distinfo 1.30 - devel/py-libevent-rpcgen/distinfo 1.2 --- Module Name: pkgsrc Committed By: spz Date: Wed Feb 4 08:04:34 UTC 2015 Modified Files: pkgsrc/devel/libevent: Makefile Makefile.common distinfo pkgsrc/devel/py-libevent-rpcgen: distinfo Log Message: update libevent to version 2.0.22 (which also updates py-libevent-rpcgen) Upstream ChangeLog: Changes in version 2.0.22-stable (5 Jan 2015) SECURITY FIXES (evbuffers) o Avoid integer overflow bugs in evbuffer_add() and related functions. See CVE-2014-6272 advisory for more information. (20d6d4458bee5d88bda1511c225c25b2d3198d6c) BUGFIXES (evhttp) o fix #73 and fix http_connection_fail_test to catch it (crash fix) (b618204 Greg Hazel) o Avoid racy bufferevent activation (5eb1788 Nate Rosenblum) BUGFIXES (compilation and portability) o Fix compilation with WIN32_HAVE_CONDITION_VARIABLES enabled (7e45739) o Fix missing AC_PROG_SED on older Autoconfs (9ab2b3f Tay Ray Chuan) o Backport libevent to vanilla Autoconf 2.59 (as used in RHEL5) (74d4c44 Kevin Bowling) o Use AC_CONFIG_HEADERS in place of AM_CONFIG_HEADERS for automake 1.13 compat (817ea36) o Rename configure.in to configure.ac to appease newer autoconfs (0c79787) o Avoid using top_srcdir in TESTS: new automakes do not like this (a55514e) o Use windows vsnprintf fixup logic on all windows environments (e826f19) o Fix a compiler warning when checking for arc4random_buf linker breakage. (5cb3865) o Fix another arc4random_buf-related warning (e64a2b0) o Add -Qunused-arguments for clang on macos (b56611d Trond Norbye) BUGFIXES (resource leaks/lock errors on error) o Avoid leaking fds on evconnlistener with no callback set (69db261) o Avoid double-close on getsockname error in evutil_ersatz_socketpair (0a822a6) o Fix a locking error in bufferevent_socket_get_dns_error. (0a5eb2e) o libevent/win32_dealloc() : fix sizeof(pointer) vs sizeof(*pointer) (b8f5980 Frank Denis) BUGFIXES: (other stability) o bufferevent_pair: don't call downcast(NULL) (f2428a2) o Consistently check for failure from evbuffer_pullup() (60f8f72) o Fix race caused by event_active (3c7d6fc vjpai) BUGFIXES (miscellaneous) o Avoid redundant invocations of init_extension_functions for IOCP (3b77d62) o Typo fixes from Linus Nordberg (cec62cb, 8cd695b) o Add a few files created by "make verify" to .gitignore. (1a8295a Pierre Phaneuf) o regress_buffer: fix 'memcmp' compare size (79800df Maks Naumov) o Fix bufferevent setwatermark suspend_read (b34e4ac ufo2243) o Fix evbuffer_peek() with len==-1 and start_at non-NULL. (fb7e76a) BUFGIXES (evdns) o Checking request nameserver for NULL, before using it. (5c710c0 Belobrov Andrey) o Fix SEGFAULT after evdns_base_resume if no nameservers installed. (f8d7df8 Azat Khuzhin) o Fix a crash in evdns related to shutting down evdns (9f39c88,e8fe749) BUGFIXES (epoll) o Check does arch have the epoll_create and __NR_epoll_wait syscalls. (dfe1e52 Marcin Juszkiewicz) BUGFIXES (evutil_secure_random) o Avoid other RNG initialization FS reads when urandom file is specified (9695e9c, bb52471) o When we seed from /proc/sys/kernel/random/uuid, count it as success (e35b540) o Document that arc4random is not a great cryptographic PRNG. (6e49696) o Add evutil_secure_rng_set_urandom_device_file (2bbb5d7) o Really remove RNG seeds from the stack (f5ced88) DOCUMENTATION FIXES o Fix a mistake in evbuffer_remove() arguments in example http server code (c322c20 Gyepi Sam) o Fix a typo in a comment in buffer.h. Spotted by Alt_F4 (773b0a5) o Clarify event_base_loop exit conditions (031a803) o Use FindClose for handle from FindFirstFile in http-server.c (6466e88) o Fix a typo in a doxygen comment. Reported by 亦得. (be1aeff)
2015-02-05Pullup tickes #4601, #4602 and #4603.tron1-1/+7
2015-02-05Pullup ticket #4603 - requested by dhollandtron1-2/+2
lang/smalltalk: build fix Revisions pulled up: - lang/smalltalk/options.mk 1.2 --- Module Name: pkgsrc Committed By: dholland Date: Thu Feb 5 17:32:20 UTC 2015 Modified Files: pkgsrc/lang/smalltalk: options.mk Log Message: fix fatal typo
2015-02-05Pullup ticket #4602 - requested by snjtron3-2/+23
shells/zsh: bug fix patch Revisions pulled up: - shells/zsh/Makefile 1.68 - shells/zsh/distinfo 1.50 - shells/zsh/patches/patch-Completion_Base_Utility__call__program 1.1 --- Module Name: pkgsrc Committed By: snj Date: Wed Feb 4 09:22:34 UTC 2015 Modified Files: pkgsrc/shells/zsh: Makefile distinfo Added Files: pkgsrc/shells/zsh/patches: patch-Completion_Base_Utility__call__program Log Message: Apply upstream revision 22c4ea424ce2e8febce04d324c5ec9898f5d534b. Thix fixes, at the very least, issues with cvs command/filename completion. Bump PKGREVISION to 1.
2015-02-05Pullup ticket #4601 - requested by tacatron2-7/+6
mail/roundcube: security update Revisions pulled up: - mail/roundcube/Makefile 1.66 - mail/roundcube/distinfo 1.39 --- Module Name: pkgsrc Committed By: taca Date: Sat Jan 24 16:36:29 UTC 2015 Modified Files: pkgsrc/mail/roundcube: Makefile distinfo Log Message: Update roundcube to 1.0.5. RELEASE 1.0.5 ------------- - Fix bug where some valid text in a message was handled as uuencoded attachment - Fix wrong icon for download button in classic skin - Fix bug where sent message was saved in Sent folder even if disabled by user (#1490208) - Fix checks based on window.ActiveXObject in IE > 10 - Fix XSS issue in style attribute handling (#1490227) - Fix bug where Drafts list wasn't updated on draft-save action in new window (#1490225) - Fix so "set as default" option is hidden if identities_level > 1 (#1490226) - Fix bug where search was reset after returning from compose visited for reply - Fix javascript error in "IE 8.0/Tablet PC" browser (#1490210) - Fix bug where empty fieldmap config entries caused empty results of ldap search (#1490229)
2015-01-28Pullup ticket #4600.tron1-1/+3
2015-01-28Pullup ticket #4600 - requested by wiztron2-15/+12
mail/dovecot: build fix Revisions pulled up: - mail/dovecot/distinfo 1.120 - mail/dovecot/patches/patch-ab 1.31 --- Module Name: pkgsrc Committed By: wiz Date: Mon Jan 26 23:26:48 UTC 2015 Modified Files: pkgsrc/mail/dovecot: distinfo pkgsrc/mail/dovecot/patches: patch-ab Log Message: unregen patch-ab, since the patch context was manually reduced so that the managesieve patch applies cleanly together with this. Noted by Edgar Fuß in PR 49599.
2015-01-27Pullup tickets #4596, #4597, #4598 and #4599.tron1-1/+9
2015-01-27Pullup ticket #4599 - requested by tacatron2-6/+6
lang/php56: security update Revisions pulled up: - lang/php/phpversion.mk 1.85 - lang/php56/distinfo 1.4 --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 23 16:11:38 UTC 2015 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php56: distinfo Log Message: Update php56 to 5.6.5. 22 Jan 2015, PHP 5.6.5 - Core: . Upgraded crypt_blowfish to version 1.3. (Leigh) . Fixed bug #60704 (unlink() bug with some files path). . Fixed bug #65419 (Inside trait, self::class !=3D __CLASS__). (Julie= n) . Fixed bug #68536 (pack for 64bits integer is broken on bigendian). = (Remi) . Fixed bug #55541 (errors spawn MessageBox, which blocks test automa= tion). (Anatol) . Fixed bug #68297 (Application Popup provides too few information). = (Anatol) . Fixed bug #65769 (localeconv() broken in TS builds). (Anatol) . Fixed bug #65230 (setting locale randomly broken). (Anatol) . Fixed bug #66764 (configure doesn't define EXPANDED_DATADIR / PHP_D= ATADIR correctly). (Ferenc) . Fixed bug #68583 (Crash in timeout thread). (Anatol) . Fixed bug #65576 (Constructor from trait conflicts with inherited constructor). (dunglas at gmail dot com) . Fixed bug #68676 (Explicit Double Free). (Kalle) . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize= ()). (CVE-2015-0231) (Stefan Esser) - CGI: . Fixed bug #68618 (out of bounds read crashes php-cgi). (CVE-2014-94= 27) (Stas) - CLI server: . Fixed bug #68745 (Invalid HTTP requests make web server segfault). = (Adam) - cURL: . Fixed bug #67643 (curl_multi_getcontent returns '' when CURLOPT_RETURNTRANSFER isn't set). (Jille Timmermans) - Date: . Implemented FR #68268 (DatePeriod: Getter for start date, end date = and interval). (Marc Bennewitz) - EXIF: . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-023= 2) (Stas) - Fileinfo: . Fixed bug #68398 (msooxml matches too many archives). (Anatol) . Fixed bug #68665 (invalid free in libmagic). (Joshua Rogers, Anatol= Belski) . Fixed bug #68671 (incorrect expression in libmagic). (Joshua Rogers, Anatol Belski) . Removed readelf.c and related code from libmagic sources (Remi, Anatol) . Fixed bug #68735 (fileinfo out-of-bounds memory access). (Anatol) - FPM: . Fixed request #68526 (Implement POSIX Access Control List for UDS).= (Remi) . Fixed bug #68751 (listen.allowed_clients is broken). (Remi) - GD: . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Jan Bee, R= emi) . Fixed request #68656 (Report gd library version). (Remi) - mbstring: . Fixed bug #68504 (--with-libmbfl configure option not present on Wi= ndows). (Ashesh Vashi) - Opcache: . Fixed bug #68644 (strlen incorrect : mbstring + func_overload=3D2 += UTF-8 + Opcache). (Laruence) . Fixed bug #67111 (Memory leak when using "continue 2" inside two fo= reach loops). (Nikita) - OpenSSL: . Improved handling of OPENSSL_KEYTYPE_EC keys. (Dominic Luechinger) - pcntl: . Fixed bug #60509 (pcntl_signal doesn't decrease ref-count of old ha= ndler when setting SIG_DFL). (Julien) - PCRE: . Fixed bug #66679 (Alignment Bug in PCRE 8.34 upstream). (Rainer Jung, Anatol Belski) - pgsql: . Fixed bug #68697 (lo_export return -1 on failure). (Ond=F8ej Sur=FD= ) - PDO: . Fixed bug #68371 (PDO#getAttribute() cannot be called with platform= -specifi attribute names). (Matteo) - PDO_mysql: . Fixed bug #68424 (Add new PDO mysql connection attr to control mult= i statements option). (peter dot wolanin at acquia dot com) - SPL: . Fixed bug #66405 (RecursiveDirectoryIterator::CURRENT_AS_PATHNAME breaks the RecursiveIterator). (Paul Garvin) . Fixed bug #68479 (Added escape parameter to SplFileObject::fputcsv)= . (Salathe) - SQLite: . Fixed bug #68120 (Update bundled libsqlite to 3.8.7.2). (Anatol) - Streams: . Fixed bug #68532 (convert.base64-encode omits padding bytes). (blaesius at krumedia dot de)
2015-01-27Pullup ticket #4598 - requested by tacatron2-6/+6
lang/php55: security update Revisions pulled up: - lang/php/phpversion.mk 1.84 - lang/php55/distinfo 1.33 --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 23 16:10:34 UTC 2015 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php55: distinfo Log Message: Update php55 to 5.5.21. 22 Jan 2014, PHP 5.5.21 - Core: . Upgraded crypt_blowfish to version 1.3. (Leigh) . Fixed bug #60704 (unlink() bug with some files path). . Fixed bug #65419 (Inside trait, self::class !=3D __CLASS__). (Julie= n) . Fixed bug #65576 (Constructor from trait conflicts with inherited constructor). (dunglas at gmail dot com) . Fixed bug #55541 (errors spawn MessageBox, which blocks test automa= tion). (Anatol) . Fixed bug #68297 (Application Popup provides too few information). = (Anatol) . Fixed bug #65769 (localeconv() broken in TS builds). (Anatol) . Fixed bug #65230 (setting locale randomly broken). (Anatol) . Fixed bug #66764 (configure doesn't define EXPANDED_DATADIR / PHP_D= ATADIR correctly). (Ferenc) . Fixed bug #68583 (Crash in timeout thread). (Anatol) . Fixed bug #68594 (Use after free vulnerability in unserialize()). (CVE-2014-8142) (Stefan Esser) . Fixed bug #68676 (Explicit Double Free). (Kalle) . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize= ()). (CVE-2015-0231) (Stefan Esser) - CGI: . Fixed bug #68618 (out of bounds read crashes php-cgi).(CVE-2014-942= 7) (Stas) - CLI server: . Fixed bug #68745 (Invalid HTTP requests make web server segfault). = (Adam) - cURL: . Fixed bug #67643 (curl_multi_getcontent returns '' when CURLOPT_RETURNTRANSFER isn't set). (Jille Timmermans) - EXIF: . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-023= 2) (Stas) - Fileinfo: . Fixed bug #68671 (incorrect expression in libmagic). (Joshua Rogers, Anatol Belski) . Removed readelf.c and related code from libmagic sources (Remi, Anatol) . Fixed bug #68735 (fileinfo out-of-bounds memory access). (Anatol) - FPM: . Fixed bug #68751 (listen.allowed_clients is broken). (Remi) - GD: . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Jan Bee, R= emi) - Mbstring: . Fixed bug #68504 (--with-libmbfl configure option not present on Wi= ndows). (Ashesh Vashi) - Mcrypt: . Fixed possible read after end of buffer and use after free. (Dmitry= ) - Opcache: . Fixed bug #67111 (Memory leak when using "continue 2" inside two fo= reach loops). (Nikita) - OpenSSL: . Fixed bug #55618 (use case-insensitive cert name matching). (Daniel= Lowrey) - Pcntl: . Fixed bug #60509 (pcntl_signal doesn't decrease ref-count of old ha= ndler when setting SIG_DFL). (Julien) - PCRE: . Fixed bug #66679 (Alignment Bug in PCRE 8.34 upstream). (Rainer Jung, Anatol Belski) - pgsql: . Fixed bug #68697 (lo_export return -1 on failure). (Ond=F8ej Sur=FD= ) - PDO: . Fixed bug #68371 (PDO#getAttribute() cannot be called with platform= -specific attribute names). (Matteo) - PDO_mysql: . Fixed bug #68424 (Add new PDO mysql connection attr to control mult= i statements option). (peter dot wolanin at acquia dot com) - SPL: . Fixed bug #66405 (RecursiveDirectoryIterator::CURRENT_AS_PATHNAME breaks the RecursiveIterator). (Paul Garvin) . Fixed bug #65213 (cannot cast SplFileInfo to boolean) (Tjerk) . Fixed bug #68479 (Added escape parameter to SplFileObject::fputcsv)= . (Salathe) - SQLite: . Fixed bug #68120 (Update bundled libsqlite to 3.8.7.2). (Anatol) - Streams: . Fixed bug #68532 (convert.base64-encode omits padding bytes). (blaesius at krumedia dot de)
2015-01-27Pullup ticket #4596 - requested by tacatron1-2/+3
www/contao34: bug fix patch Revisions pulled up: - www/contao34/Makefile 1.2 --- Module Name: pkgsrc Committed By: taca Date: Wed Jan 7 10:39:02 UTC 2015 Modified Files: pkgsrc/www/contao34: Makefile Log Message: Add mimetypes.php as one of the configuration files. Bump PKGREVISION.
2015-01-27Pullup ticket #4597 - requested by tacatron2-9/+9
lang/php54: security update Revisions pulled up: - lang/php/phpversion.mk 1.82-1.83 - lang/php54/distinfo 1.51 --- Module Name: pkgsrc Committed By: dholland Date: Thu Jan 1 11:51:41 UTC 2015 Modified Files: pkgsrc/lang/php: phpversion.mk Log Message: Use PKG_FAIL_REASON for errors. --- Module Name: pkgsrc Committed By: taca Date: Fri Jan 23 16:09:26 UTC 2015 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php54: distinfo Log Message: Update to php54 to 5.4.37. 22 Jan 2015 PHP 5.4.37 - Core: . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()). (CVE-2015-0231) (Stefan Esser) - CGI: . Fixed bug #68618 (out of bounds read crashes php-cgi). (CVE-2014-9427) (Stas) - EXIF: . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-0232) (Stas) - Fileinfo: . Removed readelf.c and related code from libmagic sources (Remi, Anatol) . Fixed bug #68735 (fileinfo out-of-bounds memory access). (Anatol) - OpenSSL: . Fixed bug #55618 (use case-insensitive cert name matching). (Daniel Lowrey)
2015-01-26tickets 4585 and 4593spz1-1/+5
2015-01-26Pullup ticket #4593 - requested by tronspz3-3/+91
www/apache24: security patch Revisions pulled up: - www/apache24/Makefile 1.33 - www/apache24/distinfo 1.17 - www/apache24/patches/patch-modules_lua_mod_lua.c 1.1 ------------------------------------------------------------------- Module Name: pkgsrc Committed By: tron Date: Thu Jan 22 20:02:37 UTC 2015 Modified Files: pkgsrc/www/apache24: Makefile distinfo Added Files: pkgsrc/www/apache24/patches: patch-modules_lua_mod_lua.c Log Message: Add fix for CVE-2014-8109 taken for Apache SVN repository. To generate a diff of this commit: cvs rdiff -u -r1.32 -r1.33 pkgsrc/www/apache24/Makefile cvs rdiff -u -r1.16 -r1.17 pkgsrc/www/apache24/distinfo cvs rdiff -u -r0 -r1.1 \ pkgsrc/www/apache24/patches/patch-modules_lua_mod_lua.c
2015-01-26Pullup ticket #4585 - requested by tronspz2-6/+6
net/wireshark: security update Revisions pulled up: - net/wireshark/Makefile 1.128 - net/wireshark/distinfo 1.79 ------------------------------------------------------------------- Module Name: pkgsrc Committed By: tron Date: Thu Jan 8 18:51:44 UTC 2015 Modified Files: pkgsrc/net/wireshark: Makefile distinfo Log Message: Update "wireshark" package to version 1.10.12. Changes since 1.10.11: - Bug Fixes The following vulnerabilities have been fixed. * wnpa-sec-2014-20 SigComp UDVM buffer overflow. (Bug 10662) CVE-2014-8710 * wnpa-sec-2014-21 AMQP crash. (Bug 10582) CVE-2014-8711 * wnpa-sec-2014-22 NCP crashes. (Bug 10552, Bug 10628) CVE-2014-8712 CVE-2014-8713 * wnpa-sec-2014-23 TN5250 infinite loops. (Bug 10596) CVE-2014-8714 The following bugs have been fixed: * 6LoWPAN Mesh headers not treated as encapsulating address. (Bug 10462) * UCP dissector bug of operation 31 - PID 0639 not recognized. (Bug 10463) * iSCSI dissector rejects PDUs with "expected data transfer length" > 16M. (Bug 10469) * GTPv2: trigging_tree under Trace information has wrong length. (Bug 10470) * Attempt to render an SMS-DELIVER-REPORT instead of an SMS-DELIVER. (Bug 10547) * IPv6 Mobility Option IPv6 Address/Prefix marks too many bytes for the address/prefix field. (Bug 10576) * IPv6 Mobility Option Binding Authorization Data for FMIPv6 Authenticator field is read beyond the option data. (Bug 10577) * IPv6 Mobility Option Mobile Node Link Layer Identifier Link-layer Identifier field is read beyond the option data. (Bug 10578) * Malformed PTPoE announce packet. (Bug 10611) * IPv6 Permanent Home Keygen Token mobility option includes too many bytes for the token field. (Bug 10619) * IPv6 Redirect Mobility Option K and N bits are parsed incorrectly. (Bug 10622) * IPv6 Care Of Test mobility option includes too many bytes for the Keygen Token field. (Bug 10624) * IPv6 MESG-ID mobility option is parsed incorrectly. (Bug 10625) * IPv6 AUTH mobility option parses Mobility SPI and Authentication Data incorrectly. (Bug 10626) * IPv6 DNS-UPDATE-TYPE mobility option includes too many bytes for the MD identity field. (Bug 10629) * IPv6 Local Mobility Anchor Address mobility option's code and reserved fields are parsed as 2 bytes instead of 1. (Bug 10630) * TShark crashes when running with PDML on a specific packet. (Bug 10651) * IPv6 Mobility Option Context Request reads an extra request. (Bug 10676) - Updated Protocol Support 6LoWPAN, AMQP, GSM MAP, GTPv2, H.223, IEEE 802.11, iSCSI, MIH, Mobile IPv6, PTPoE, TN5250, and UCP - New and Updated Capture File Support Catapult DCT2000, HP-UX nettl, pcap-ng, and Sniffer (DOS) To generate a diff of this commit: cvs rdiff -u -r1.127 -r1.128 pkgsrc/net/wireshark/Makefile cvs rdiff -u -r1.78 -r1.79 pkgsrc/net/wireshark/distinfo
2015-01-25Pullup ticket #4595.tron1-1/+3
2015-01-25Pullup ticket #4595 - requested by gdttron4-3/+21
editors/emacs24: build fix Revisions pulled up: - editors/emacs24-nox11/Makefile 1.8 - editors/emacs24/Makefile 1.31 - editors/emacs24/distinfo 1.15 - editors/emacs24/patches/patch-gnu_readlinkat.c 1.1 --- Module Name: pkgsrc Committed By: gdt Date: Sat Jan 10 16:15:30 UTC 2015 Modified Files: pkgsrc/editors/emacs24: Makefile distinfo pkgsrc/editors/emacs24-nox11: Makefile Added Files: pkgsrc/editors/emacs24/patches: patch-gnu_readlinkat.c Log Message: Copy gnulib readlinkat patch from archivers/gtar-base. This undefines readlink so that the twisty maze of symlinks builds, and fixes the build on netbsd-5. Confirmed to work on netbsd-5/amd64 and netbsd-6/i386. Thanks to obache@ for pointing out the problem. I will request a pullup to 2014Q4 soon if there are no objections.
2015-01-24Pullup ticket #4594.tron1-1/+3
2015-01-24Pullup ticket #4594 - requested by wiztron8-14/+109
mail/dovecot: security patch Revisions pulled up: - mail/dovecot/Makefile 1.175 - mail/dovecot/distinfo 1.119 - mail/dovecot/patches/patch-ab 1.30 - mail/dovecot/patches/patch-src_imap-login_client.c 1.1 - mail/dovecot/patches/patch-src_login-common_ssl-proxy-openssl.c 1.1 - mail/dovecot/patches/patch-src_login-common_ssl-proxy.c 1.1 - mail/dovecot/patches/patch-src_login-common_ssl-proxy.h 1.1 - mail/dovecot/patches/patch-src_pop3-login_client.c 1.1 --- Module Name: pkgsrc Committed By: wiz Date: Fri Jan 23 12:17:47 UTC 2015 Modified Files: pkgsrc/mail/dovecot: Makefile distinfo pkgsrc/mail/dovecot/patches: patch-ab Added Files: pkgsrc/mail/dovecot/patches: patch-src_imap-login_client.c patch-src_login-common_ssl-proxy-openssl.c patch-src_login-common_ssl-proxy.c patch-src_login-common_ssl-proxy.h patch-src_pop3-login_client.c Log Message: Fix for CVE-2014-3430. Based on http://hg.dovecot.org/dovecot-1.2/raw-rev/8ba4253adc9b adapted to pkgsrc by Edgar Fuß in PR 49599. Bump PKGREVISION. regen patch-ab while here
2015-01-22Pullup ticket #4592.tron1-1/+3
2015-01-22Pullup ticket #4592 - requested by bouyertron3-8/+20
mail/sympa: security update Revisions pulled up: - mail/sympa/Makefile 1.57 - mail/sympa/PLIST 1.13 - mail/sympa/distinfo 1.16 --- Module Name: pkgsrc Committed By: bouyer Date: Thu Jan 22 12:04:36 UTC 2015 Modified Files: pkgsrc/mail/sympa: Makefile PLIST distinfo Log Message: Update to 6.1.24. Changes since 6.1.22: - wwsympa/wwsympa.fcgi.in: Preventing faulty newsletter sending (security fix) - src/sympa.pl.in: [Submitted by B. Marchal, univ. Lorraine] the loop_prevention_regex parameter was never taken into account. - New scenarios to check DKIM signature - When the user requests change of password via WWSympa or SympaSOAP, new password may be checked its strength. - src/lib/Scenario.pm: Now CustomCondition can set the action to take (do_it, reject ...) by setting $_, this allows for complex, single-module CustomConditions. and various bug fixes
2015-01-20Pullup ticket #4591.tron1-1/+3
2015-01-20Pullup ticket #4591 - requested by hetron3-2/+25
www/curl: security patch Add a fix for the security bypass vulnerability reported in CVE-2014-8150.
2015-01-14Pullup tickets #4588 and #4589.tron1-1/+5
2015-01-14Pullup ticket #4589 - requested by hetron4-19/+37
misc/screen: portability patch Revisions pulled up: - misc/screen/Makefile 1.91-1.92 - misc/screen/distinfo 1.35-1.36 - misc/screen/patches/patch-as deleted - misc/screen/patches/patch-tty.sh 1.1 --- Module Name: pkgsrc Committed By: he Date: Mon Jan 12 14:24:40 UTC 2015 Modified Files: pkgsrc/misc/screen: Makefile distinfo Added Files: pkgsrc/misc/screen/patches: patch-tty.c Log Message: The NetBSD -5 branch's version of realpath() insists on a non-NULL second argument, so make the usage cater for that. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: he Date: Tue Jan 13 08:27:28 UTC 2015 Modified Files: pkgsrc/misc/screen: Makefile distinfo Added Files: pkgsrc/misc/screen/patches: patch-tty.sh Removed Files: pkgsrc/misc/screen/patches: patch-as patch-tty.c Log Message: Remove patch for a generated(!) file. Remove the old-style-named patch which already tweaked the tty.sh file, name it according to the new rules. This is to actually get the netbsd-5 branch working with this, since realpath() insists on a non-NULL second argument.
2015-01-14Pullup ticket #4588 - requested by istron1-2/+3
graphics/netpbm: bug fix patch Revisions pulled up: - graphics/netpbm/Makefile 1.199-1.200 --- Module Name: pkgsrc Committed By: is Date: Mon Jan 12 11:44:09 UTC 2015 Modified Files: pkgsrc/graphics/netpbm: Makefile Log Message: new rgb.txt location finding code requires new SUBST. This is incomplete in that the X11 locations should probably be patched, too; OTOH, the netpbm rgb.txt is found now, and the environment variable RGBDEF works also. --- Module Name: pkgsrc Committed By: is Date: Mon Jan 12 11:47:59 UTC 2015 Modified Files: pkgsrc/graphics/netpbm: Makefile Log Message: forgot to bump revision
2015-01-11Pullup ticket #4586.tron1-1/+3
2015-01-11Pullup ticket #4586 - requested by wiztron3-22/+6
security/openssl: security update Revisions pulled up: - security/openssl/Makefile 1.201 - security/openssl/distinfo 1.110 - security/openssl/patches/patch-crypto_dso_dso__dlfcn.c deleted --- Module Name: pkgsrc Committed By: wiz Date: Thu Jan 8 16:58:25 UTC 2015 Modified Files: pkgsrc/security/openssl: Makefile distinfo Removed Files: pkgsrc/security/openssl/patches: patch-crypto_dso_dso__dlfcn.c Log Message: Update to 1.0.1k: Changes between 1.0.1j and 1.0.1k [8 Jan 2015] *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS message can cause a segmentation fault in OpenSSL due to a NULL pointer dereference. This could lead to a Denial Of Service attack. Thanks to Markus Stenberg of Cisco Systems, Inc. for reporting this issue. (CVE-2014-3571) [Steve Henson] *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion. Thanks to Chris Mueller for reporting this issue. (CVE-2015-0206) [Matt Caswell] *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl method would be set to NULL which could later result in a NULL pointer dereference. Thanks to Frank Schmirler for reporting this issue. (CVE-2014-3569) [Kurt Roeckx] *) Abort handshake if server key exchange message is omitted for ephemeral ECDH ciphersuites. Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for reporting this issue. (CVE-2014-3572) [Steve Henson] *) Remove non-export ephemeral RSA code on client and server. This code violated the TLS standard by allowing the use of temporary RSA keys in non-export ciphersuites and could be used by a server to effectively downgrade the RSA key length used to a value smaller than the server certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting this issue. (CVE-2015-0204) [Steve Henson] *) Fixed issue where DH client certificates are accepted without verification. An OpenSSL server will accept a DH certificate for client authentication without the certificate verify message. This effectively allows a client to authenticate without the use of a private key. This only affects servers which trust a client certificate authority which issues certificates containing DH keys: these are extremely rare and hardly ever encountered. Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting this issue. (CVE-2015-0205) [Steve Henson] *) Ensure that the session ID context of an SSL is updated when its SSL_CTX is updated via SSL_set_SSL_CTX. The session ID context is typically set from the parent SSL_CTX, and can vary with the CTX. [Adam Langley] *) Fix various certificate fingerprint issues. By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. Thanks to Konrad Kraszewski from Google for reporting this issue. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). Further analysis was conducted and fixes were developed by Stephen Henson of the OpenSSL core team. (CVE-2014-8275) [Steve Henson] *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. This bug occurs at random with a very low probability, and is not known to be exploitable in any way, though its exact impact is difficult to determine. Thanks to Pieter Wuille (Blockstream) who reported this issue and also suggested an initial fix. Further analysis was conducted by the OpenSSL development team and Adam Langley of Google. The final fix was developed by Andy Polyakov of the OpenSSL core team. (CVE-2014-3570) [Andy Polyakov] *) Do not resume sessions on the server if the negotiated protocol version does not match the session's version. Resuming with a different version, while not strictly forbidden by the RFC, is of questionable sanity and breaks all known clients. [David Benjamin, Emilia K?sper] *) Tighten handling of the ChangeCipherSpec (CCS) message: reject early CCS messages during renegotiation. (Note that because renegotiation is encrypted, this early CCS was not exploitable.) [Emilia K?sper] *) Tighten client-side session ticket handling during renegotiation: ensure that the client only accepts a session ticket if the server sends the extension anew in the ServerHello. Previously, a TLS client would reuse the old extension state and thus accept a session ticket if one was announced in the initial ServerHello. Similarly, ensure that the client requires a session ticket if one was advertised in the ServerHello. Previously, a TLS client would ignore a missing NewSessionTicket message. [Emilia K?sper]
2015-01-08Pullup ticket #4584.tron1-1/+3
2015-01-08Pullup ticket #4584 - requested by ryoontron2-7/+5
www/php-basercms: dependence fix Revisions pulled up: - www/php-basercms/Makefile 1.3 - www/php-basercms/options.mk 1.2 --- Module Name: pkgsrc Committed By: ryoon Date: Thu Jan 8 13:35:03 UTC 2015 Modified Files: pkgsrc/www/php-basercms: Makefile options.mk Log Message: Bump PKGREVISION. * Fix DEPENDS. Recent version of baserCMS requires PDO database drivers. * Remove obsolete commented-out lines.
2015-01-07Pullup ticket #4583.tron1-1/+3
2015-01-07Pullup ticket #4583 - requested by bouyertron1-2/+3
print/cups-filters: dependence fix Revisions pulled up: - print/cups-filters/Makefile 1.11 --- Module Name: pkgsrc Committed By: bouyer Date: Tue Jan 6 14:56:04 UTC 2015 Modified Files: pkgsrc/print/cups-filters: Makefile Log Message: Make this depend on print/poppler-utils for the pdftops filter; if configure finds a pdftops binary it will use its full path, otherwise it defaults to /usr/bin/pdftops which doesn't exists Bump PKGREVISION
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-14 09:59:41 +0000