gitweb.dragonflybsd.org Git - pkgsrcv2.git/log

Fixup fromcvs/togit conversion

Pullup ticket 3243 - requested by tron
security update

Revisions pulled up:
- pkgsrc/devel/apr-util/Makefile 1.17
- pkgsrc/devel/apr-util/distinfo 1.9
- pkgsrc/devel/apr-util/patches/patch-aa 1.3

Files removed:
- pkgsrc/devel/apr-util/patches/patch-ab

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Wed Oct 13 19:21:16 UTC 2010

   Modified Files:
           pkgsrc/devel/apr-util: Makefile distinfo
           pkgsrc/devel/apr-util/patches: patch-aa
   Removed Files:
           pkgsrc/devel/apr-util/patches: patch-ab

   Log Message:
   Update "apr-util" package to version 1.3.10. Changes since 1.3.9:
   - SECURITY: CVE-2010-1623 (cve.mitre.org)
     Fix a denial of service attack against apr_brigade_split_line().
     [Stefan Fritsch]
   - SECURITY: CVE-2009-3560, CVE-2009-3720 (cve.mitre.org)
     Fix two buffer over-read flaws in the bundled copy of expat which
     could cause applications to crash while parsing specially-crafted
     XML documents.  [Joe Orton]
   - Upgrade bundled copy of expat library to 1.95.7.  [Joe Orton]
   - apr_thread_pool: Fix some potential deadlock situations.  Bug 49709.
     [Joe Mudd <Joe.Mudd sas.com>]
   - apr_thread_pool_create: Fix pool corruption caused by multithreaded
     use of the pool when multiple initial threads are created.  Bug 47843.
     [Alex Korobka <akorobka fxcm.com>]
   - apr_thread_pool_create(): Only set the output thread pool handle on
     success.  [Paul Querna]
   - DBD ODBC support: Fix memory corruption using apr_dbd_datum_get() with
     several different data types, including APR_DBD_TYPE_TIME.  Bug 49645.
     [<kappa psilambda.com>]
   - Add support for Berkeley DB 4.8 and 5.0.  Bug 49866, Bug 49179.
     [Bernhard Rosenkraenzer <br blankpage.ch>,
      Arfrever Frehtes Taifersar Arahesis <arfrever.fta gmail.com>]
   - Make bundled expat compatible with libtool 2.x.  Bug 49053.
     [Rainer Jung]
   - Prefer libtool 1.x when searching for libtool in
     bundled expat release process. [Rainer Jung, Jim Jagielski]
   - Improve platform detection for bundled expat by updating
     config.guess and config.sub. [Rainer Jung]

   Patch supplied by Mihai Chelaru, approved by Alistair Crooks.

   To generate a diff of this commit:
   cvs rdiff -u -r1.16 -r1.17 pkgsrc/devel/apr-util/Makefile
   cvs rdiff -u -r1.8 -r1.9 pkgsrc/devel/apr-util/distinfo
   cvs rdiff -u -r1.2 -r1.3 pkgsrc/devel/apr-util/patches/patch-aa
   cvs rdiff -u -r1.2 -r0 pkgsrc/devel/apr-util/patches/patch-ab

Pullup ticket #3236 - requested by taca
www/typo3: security update

Revisions pulled up:
- www/typo3/Makefile patch
- www/typo3/distinfo patch
----
Update typo3 package to 4.3.7, security fix.

Dear TYPO3 community,

The TYPO3 core team has just released TYPO3 versions 4.2.15,
4.3.7 and 4.4.4, which are now ready for you to download. All versions
are maintenance releases and contain bugfixes and security fixes.

IMPORTANT:
These versions include important security fixes to the TYPO3 core. A
security announcement has just been released:
http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-020

pullup 3232

Pullup ticket 3232 - requested by tron
security update

Revisions pulled up:
- pkgsrc/net/wireshark/Makefile 1.52
- pkgsrc/net/wireshark/PLIST 1.19
- pkgsrc/net/wireshark/distinfo 1.34
- pkgsrc/net/wireshark/patches/patch-ad 1.6

Files added:
- pkgsrc/net/wireshark/patches/patch-ae

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Sep 25 11:19:10 UTC 2010

   Modified Files:
           pkgsrc/net/wireshark: Makefile PLIST distinfo
           pkgsrc/net/wireshark/patches: patch-ad
   Added Files:
           pkgsrc/net/wireshark/patches: patch-ae

   Log Message:
   Update "wireshark" package to version 1.4.0. Change since version 1.2.10:
   - The following bugs have been fixed:
     - Update time display in background. (Bug 1275)
     - Tshark returns 0 even with an invalid interface or capture
       filter. (Bug 4735)
   - The following features are new (or have been significantly
     updated) since version 1.2:
     - The packet list internals have been rewritten and are now more
       efficient.
     - Columns are easier to use. You can add a protocol field as a
       column by right-clicking on its packet detail item, and you
       can adjust some column preferences by right-clicking the
       column header.
     - Preliminary Python scripting support has been added.
     - Many memory leaks have been fixed.
     - Packets can now be ignored (excluded from dissection), similar
       to the way they can be marked.
     - Manual IP address resolution is now supported.
     - Columns with seconds can now be displayed as hours, minutes
       and seconds.
     - You can now set the capture buffer size on UNIX and Linux if
       you have libpcap 1.0.0 or greater.
     - TShark no longer needs elevated privileges on UNIX or Linux to
       list interfaces. Only dumpcap requires privileges now.
     - Wireshark and TShark can enable 802.11 monitor mode directly
       if you have libpcap 1.0.0 or greater.
     - You can play RTP streams directly from the RTP Analysis
       window.
     - Capinfos and editcap now respectively support time order
       checking and forcing.
     - Wireshark now has a "jump to timestamp" command-line option.
     - You can open JPEG files directly in Wireshark.
   - New Protocol Support
     3GPP Nb Interface RTP Multiplex, Access Node Control Protocol,
     Apple Network-MIDI Session Protocol, ARUBA encapsulated remote
     mirroring, Assa Abloy R3, Asynchronous Transfer Mode, B.A.T.M.A.N.
     Advanced Protocol, Bluetooth AMP Packet, Bluetooth OBEX, Bundle
     Protocol, CIP Class Generic, CIP Connection Configuration Object,
     CIP Connection Manager, CIP Message Router, collectd network data,
     Control And Provisioning of Wireless Access Points, Controller
     Area Network, Device Level Ring, DOCSIS Bonded Initial Ranging
     Message, Dropbox LAN sync Discovery Protocol, Dropbox LAN sync
     Protocol, DTN TCP Convergence Layer Protocol, EtherCAT Switch
     Link, Fibre Channel Delimiters, File Replication Service DFS-R,
     Gateway Load Balancing Protocol, Gigamon Header, GigE Vision
     Control Protocol, Git Smart Protocol, GSM over IP ip.access CCM
     sub-protocol, GSM over IP protocol as used by ip.access, GSM
     Radiotap, HI2Operations, Host Identity Protocol, HP encapsulated
     remote mirroring, HP NIC Teaming Heartbeat, IEC61850 Sampled
     Values, IEEE 1722 Protocol, InfiniBand Link, Interlink Protocol,
     IPv6 over IEEE 802.15.4, ISO 10035-1 OSI Connectionless
     Association Control Service, ISO 9548-1 OSI Connectionless Session
     Protocol, ISO 9576-1 OSI Connectionless Presentation Protocol,
     ITU-T Q.708 ISPC Analysis, Juniper Packet Mirror, Licklider
     Transmission Protocol, MPLS PW ATM AAL5 CPCS-SDU mode
     encapsulation, MPLS PW ATM Cell Header, MPLS PW ATM Control Word,
     MPLS PW ATM N-to-One encapsulation, no CW, MPLS PW ATM N-to-One
     encapsulation, with CW, MPLS PW ATM One-to-One or AAL5 PDU
     encapsulation, Multiple Stream Reservation Protocol, NetPerfMeter
     Protocol, NetScaler Trace, NexusWare C7 MTP, NSN FLIP, OMRON FINS
     Protocol, packetbb Protocol, Peer Network Resolution Protocol,
     PKIX Attribute Certificate, Pseudowire Padding, Server/Application
     State Protocol, Solaris IPNET, TN3270 Protocol, TN5250 Protocol,
     TRILL, Twisted Banana, UMTS FP Hint, UMTS MAC, UMTS Metadata, UMTS
     RLC, USB HID, USB HUB, UTRAN Iuh interface HNBAP signalling, UTRAN
     Iuh interface RUA signalling, V5.2, Vendor Specific Control
     Protocol, Vendor Specific Network Protocol, VMware Lab Manager,
     VXI-11 Asynchronous Abort, VXI-11 Core Protocol, VXI-11 Interrupt,
     X.411 Message Access Service, ZigBee Cluster Library
   - Updated Protocol Support
     There are too many to list here.
   - New and Updated Capture File Support
     Accellent 5Views, ASN.1 Basic Encoding Rules, Catapult DCT2000,
     Daintree SNA, Endace ERF, EyeSDN, Gammu DCT3 trace, IBM iSeries,
     JPEG/JFIF, libpcap, Lucent/Ascend access server trace, NetScaler,
     PacketLogger, pcapng, Shomiti/Finisar Surveyor, Sun snoop, Symbian
     OS btsnoop, Visual Networks

   Pkgsrc changes:
   A fix for the security vulnerability reported in SA41535 has been
   integrated from the Wireshark SVN repository.

   To generate a diff of this commit:
   cvs rdiff -u -r1.51 -r1.52 pkgsrc/net/wireshark/Makefile
   cvs rdiff -u -r1.18 -r1.19 pkgsrc/net/wireshark/PLIST
   cvs rdiff -u -r1.33 -r1.34 pkgsrc/net/wireshark/distinfo
   cvs rdiff -u -r1.5 -r1.6 pkgsrc/net/wireshark/patches/patch-ad
   cvs rdiff -u -r0 -r1.1 pkgsrc/net/wireshark/patches/patch-ae

Pullup ticket #3231.

Pullup ticket #3231 - requested by spz
apache-tomcat6: security update

Revisions pulled up:
- www/apache-tomcat6/Makefile 1.7
- www/apache-tomcat6/PLIST 1.4
- www/apache-tomcat6/distinfo 1.4
---
Module Name: pkgsrc
Committed By: spz
Date: Sun Sep 19 14:32:04 UTC 2010

Modified Files:
pkgsrc/www/apache-tomcat6: Makefile PLIST distinfo

Log Message:
Update of apache-tomcat to version 6.0.29
(and a little Makefile cosmetics)
fixes two of the currently known security issues

Upstream changelog:
Tomcat 6.0.29 (jfclere) released 2010-07-22

Catalina

add 48960: Add a new option to the SSI Servlet and SSI Filter to
allow the disabling of the exec command. This is now disabled
by default. Based on a patch by Yair Lenga. (markt)
fix 49551: Allow default context.xml location to be specified using
an absolute path. (markt)
fix 49598: When session is changed and the session cookie is
replaced, ensure that the new Set-Cookie header overwrites the
old Set-Cookie header. (markt)
fix Fix order when listing Webapp loader search URLs. (rjung)
add Add support for *.jar pattern in VirtualWebappLoader. (kkolinko)

Tomcat 6.0.28 (jfclere) released 2010-07-09

Catalina

fix Arrange filter logic. (jfclere)
fix 49230: Enhance JRE leak prevention listener with protection for
the keep-alive thread started by sun.net.www.http.HttpClient.
Patch provided by Rob Kooper. (markt)
fix 49351: Fix possible NPe when embedding and no name is specified
for the Service. (markt)
fix 49424: Avoid NPE if client provides no data with a chunked
POST request. (markt)
fix 49414: Differentiate between request threads and application
created threads when warning about still running threads when
an application stops. (markt)
fix 49443: Use remoteIpHeader rather than remoteIPHeader
consistently. (markt)
add Add property searchExternalFirst to WebappLoader. If set,
the external repositories will be searched before the WEB-INF
ones. (rjung)

Cluster

fix 49445: When session ID is changed after authentication, ensure
the DeltaManager replicates the change in ID to the other nodes
in the cluster. (kfujino)

Webapps

fix 49213: Grant permissions required by manager application when
running under a security manager. (markt/kkolinko)
fix 49436: Correct documented default for readonly attribute of
the UserDatabase component. (markt)

Tomcat 6.0.27 (jfclere) not released

General

update Update DBCP to 1.3. (markt)

Catalina

fix Fix CVE-2010-1157. Prevent possible disclosure of host name
or IP address via the HTTP WWW-Authenticate header when using
BASIC or DIGEST authentication. (markt)
add Include context name when reporting memory leaks to aid root
cause identification. (markt)
fix Improve exception handling on session de-serialization to
assist in identifying the root cause of 48007. (kkolinko)
add 48379: Make session cookie name, domain and path configurable
per context. (markt)
fix 48589: Make JNDIRealm easier to extend. Based on a patch by
Candid Dauth. (markt/kkolinko)
fix 48629: Allow user names as well as DNs to be used with the
nested role search. Add roleNested to the documentation.
Patch provided by Felix Schumacher. (markt)
fix 48661: Make error page behavior consistent, regardless of how
the error page is defined. If a response has been committed,
always include the error page. (markt)
fix 48729: Return roles defined by both userRoleName and roleName
mechanisms. Patch provided by 'eric'. Also make user's role
list immutable.(markt)
fix 48760: Fix potential multi-threading issue in static resource
serving where multiple threads could try to use the the same
InputStream. (markt)
fix 48790: Fix thread safety issue in the count of the maximum
number of active session. (markt/kkolinko)
fix 48793: Make catalina.sh more robust to different return values
on different platforms. Patch provided by Thomas GL. (markt)
fix 48840: Swallow output (if any) from use of cd when determining
$CATALINA_HOME in catalina.sh and tool-wrapper.sh scripts.
Based on patch provided by mdietze. (markt/kkolinko)
fix 48895: Make clearing of ThreadLocals that are causing memory
leaks on web application stop, reload or undeploy configurable
since the process of clearing them is not thread-safe. (markt)
fix 48903: Fix deadlock in webapp class loader. (rjung)
fix 48971: Make stopping of leaking Timer threads optional and
disabled by default. (markt)
fix 48976: Document JAVA_ENDORSED_DIRS in start-up scripts.
Patch provided by Laurent Vaills. (markt)
fix 48983: Improve debug logging for situations when RemoteIpValve
is bypassed. Patch provided by Cyrille Le Clerc. (markt)
fix 49018: Fix processing of time argument in the Expire sessions
action in the Manager web application. (kkolinko)
fix 49116: If session is already invalid, expire session to prevent
memory leak. (kfujino)
fix 49158: Ensure only one session cookie is returned for a single
request. (markt/fhanik)
fix 49245: Fix session expiration check in cross-context requests.
(markt)
fix 49398: ByteChunk.indexOf(String, int, int, int) could not find
a string of length 1. (kkolinko)
fix Fix possible overflows when calculating session statistics.
(kkolinko)
add Log unexpected exceptions when providing access to web
application resources in ApplicationContext. (kkolinko)
fix Improve exception handling in CatalinaShutdownHook. (kkolinko)
add Expose properties of VirtualWebappLoader and WebappClassLoader
via JMX. (rjung)

Coyote

fix 48839: Correctly handle HTTP header folding in the NIO connector.
Patch suggested by Richa Baronia. (markt)
fix 48843: Prevent possible deadlock for worker allocation in
connectors. (kkolinko)
fix 48843: Fix handling of add queues in AprEndpoint.Poller and
AprEndpoint.Sendfile. Do not miss wakeups. (kkolinko)
add 48862: Add support for the backlog parameter to the AJP
connector. (pero/markt)
fix 48917: Correct name of mod_jk module in ApacheConfig.
Patch provided by Todd Hicks. (markt)
fix 49095: AprEndpoint did not wakeup acceptors during shutdown
when deferAccept option was enabled. Based on a patch provided
by Ruediger Pluem. (kkolinko)
add Use chunked encoding for http 1.1 requests with no
content-length (regardless of keep-alive) so client can
differentiate between complete and partial responses. (markt)
fix Correct the SSL session timeout attribute name so the code
agrees with the documentation. (markt)
add CoyotePrincipal now implements Serializable. (fhanik)
fix Enable the BIO AJP connector to run under a security manager.
(markt)

Jasper

fix 45015: Correct a regression in quote handling caused by the
re-factoring of attribute parsing. (markt)
fix 48701: Add a system property to allow disabling enforcement
of JSP.5.3. The specification recommends, but does not require,
this enforcement. (kkolinko)
fix 48737: Don't assume paths that start with /META-INF/... are
always in JARs. This is not true for some IDEs.
Patch provided by Fabrizio Giustina. (markt)
fix 49081: Correctly handle EL expressions of the form #${...}. (markt)
fix 49196: Avoid NullPointerException in PageContext.getErrorData()
if an error-handling JSP page is called directly. (markt)

Cluster

fix 48717: When a node joins a cluster and it receives all the
current sessions, ensure the sessionCreated event is fired
if the Manager is configured to replicate session events. (markt)
fix 48934: Previous fix to handle dropped connections incorrectly
permanently disabled session replication. (fhanik)
fix 49051: memberAlive is not called if member has not already
existed in membership. (kfujino)
fix 49151: Avoid ClassCastException in BackupManager#stop. (kfujino)
fix 49170: Do not send duplicated session. (kfujino)
fix Add missing messages and ensure cluster listeners log messages
to correct logger. (markt)

Webapps

add Use underscores instead of spaces in anchor names in Tomcat
documentation. (kkolinko)
add Add support for displaying the Spring Security user name
(if present) in the Manager application. (markt)
update Improve the ChatServlet Comet example (/examples/jsp/chat/).
(kkolinko)

Other

update Update to Commons Daemon 1.0.2. Use service launcher (procrun)
from the Commons Daemon release. Do not keep a copy of it in
our source tree. (mturk/kkolinko)
update Update to NSIS 2.46. (kkolinko)
fix 48990: Fix the skip.installer build property so if set, only
the Windows installer is skipped. (markt)
fix 49178: Provide in catalina.policy an example of additional
permissions that might be needed for code located in
$CATALINA_BASE/lib. (markt)
fix 49236: Do not use indexing when packing Tomcat JARs. (kkolinko)
fix Remove unused code from org.apache.tomcat.util.buf classes.
(kkolinko)
update Rearrange tomcat-juli.jar permissions and wrap long lines in
the conf/catalina.policy file, to make the text more readable
when cited in documentation. (kkolinko)
fix Do not evaluate the execute.installer property when building
a release. The skip.installer property is used instead. (kkolinko)

Tomcat 6.0.26 (jfclere) released 2010-03-11

Catalina

fix Close security hole in unreleased 6.0.25 by ensuring new find
leaks functionality is protected by a security constraint.
(kkolinko)
fix 48831: Improve logging shutdown behaviour. Use Catalina's
shutdown hook to shutdown JULI. This enables them to be shutdown
in the correct order. Do not shutdown global handlers several
times. (markt/kkolinko)

Coyote

fix 48584: Prevent the APR connector logging an error if the
acceptor fails during shutdown since this is expected. (mturk)
fix 48660: Using compression should not overwrite any Vary header
set by a web application. (markt)

Jasper

fix 48371: Ensure generated servlet mappings are inserted at the
correct location when using JspC and allow the option that
controls this to be configured on the command line.
Also allow the encoding of web.xml to be configured when using
JspC and deprecate some unused JspC methods. (markt/kkolinko)
fix 48498: Avoid ArrayIndexOutOfBoundsException triggered by a
Java 6/7 XML parser bug. (markt/kkolinko)
fix 48668: Additional fixes to ensure deferred syntax is handled
correctly. (kkolinko)
fix 48827: Correct a regression in the fix for 47977 that caused
an incorrect non-empty body error to be reported for valid
JSP documents. (markt)

Webapps

add Make changelog.xml be directly rendered as HTML by certain
browsers. (kkolinko)
add Add support for automated generation of TOC tables and for
links to svn revisions to tomcat-docs.xsl in documentation.
(kkolinko/fhanik)
add Move Manager application JSPs that are not intended to be
accessed directly under the WEB-INF directory. (kkolinko)
fix Improve the messages displayed by the find leaks diagnostic
in the Manager application. (kkolinko)

Other

fix Encode all property files using ascii escaped UTF-8. Also
fixes deployment problem when using French locale. (jfclere/rjung)

Tomcat 6.0.25 (jfclere) not released

Catalina

fix 48039: Return immediately if start() is called on an already
started StandardService. (markt)
fix 48109: Ensure InputStream is closed on error condition in web
application class loader. (markt)
fix 48179: Clean up dead code that was used to read tldCache file.
(kkolinko)
fix 48318: Handle case where WebDAV resource is in directory
listing but is not accessible. (markt)
add 48384: Add a per context xslt option for directory listings.
Make the fallback options work as described in the
documentation. (markt)
fix 48577: Filter URL when displaying missing included page. (markt)
fix 48612: Prevent exception on shutdown if the address attribute
is specified for a connector. (markt)
fix 48613: Further fixes to ensure APRLifecycleListener is only
used if defined in server.xml. (fhanik)
fix 48614: Correct JULI log file buffering so default behaviour
is no buffering. (fhanik)
fix 48625: Provide an option to exit if an error occurs during
the initialization phase. (fhanik)
fix 48645: Use specified encoding rather than null in calls to
RequestUtil.URLDecode(byte[] bytes, String enc) (markt)
fix 48653: Force request.secure and request.scheme to false and
http if the X-Forwarded-Proto header has the value http.
Patch provided by Cyrille Le Clerc. (markt)
fix 48678: Remove duplicate server field from
org.apache.catalina.startup.Catalina. (markt)
fix 48694: Remove potential deadlock in web application class
loader. (markt)
add 48716: Provide additional configuration options for JULI. (markt)
fix 48726: Prevent OOME when uploading large WAR files with the
deployer. Patch provided by adam. (markt)
add Improve memory leak protection by safely stopping threads
started via java.util.Timer that an application starts but
fails to stop and by clearing references retained due to the
use of java.util.ResourceBundle. (markt)
update Modify ThreadLocal memory leak detection to not report false
positives and to simplify implementation. (markt/kkolinko)
add Basic memory leak detection was added to the standard Host
implementation and exposed via JMX to detect memory leaks on
web application reload. (markt/kkolinko)

Coyote

update Update the native/APR library version bundled with Tomcat to
1.1.20. (kkolinko)

Jasper

add Add some debug logging to the compiler where exceptions were
previously swallowed. (markt)
fix 48170: Remove unnecessary synchronization that is causing
issues under load. (markt)
fix 48580: Prevent AccessControlException if first access is to
a JSP that uses a FunctionMapper. (markt)
fix 48582: Avoid NPE on background compilation failure. (markt)
fix 48616: Don't declare or synchronize scripting variables for
JSP fragments since they are scriptless. This is an alternative
fix for 42390 that avoids both the original problem and the
regression in the first fix. (kkolinko)
fix 48627: Fix regression in re-factored EL parsing. Keep literals
as literals and handle deferredSyntaxAllowedAsLiteral. (kkolinko)
fix 48668: When parsing JSPs only parse EL as EL if EL is enabled
else strings such as ${ will be silently dropped. (markt)
fix Various EL TCK failures. (markt)

Cluster

fix Force a disconnect if an error occurs during replication such
as a firewall dropping the connection. (fhanik)

Webapps

add Add new "Find leaks" command to the Manager application.
It allows to detect web applications that have caused memory
leaks on stop, reload or undeploy. (markt/kkolinko)

Other

fix Ensure files in conf directory have CRLF line endings when
using the Windows installer. (kkolinko)
fix Allow special characters recognized by the Windows command-line
shell to be present in the names of CATALINA_HOME/_BASE and
the current directory used to call the Tomcat scripts. (kkolinko)
fix Don't use @Deprecated annotations in javax.servlet.jsp.JspContext
since the specification does not include them in the API
definition. (markt)
add Improve the information in the JAR manifest files. (markt)

Pullup tickets #3229 and #3230.

Pullup ticket #3230 - requested by adam
mail/clamav: security update

Revisions pulled up:
- mail/clamav/Makefile 1.104-1.105
- mail/clamav/buildlink3.mk 1.24
- mail/clamav/distinfo 1.65-1.67
- mail/clamav/patches/patch-ac 1.9
---
Module Name: pkgsrc
Committed By: adam
Date: Thu Aug 26 05:49:30 UTC 2010

Modified Files:
pkgsrc/mail/clamav: Makefile distinfo
pkgsrc/mail/clamav/patches: patch-ac

Log Message:
Changes 0.96.2:
* contrib: add safe_clamd from Luca
* freshclam: uses private symbol which changed proto, change name to prevent
crash
* libclamav: fix callback_sigload
* clamdscan: fix parsing of virus names in extended mode and --stream
* libclamav/c++/detect.cpp: Mac OS X can run 64-bit apps on 32-bit kernel
* libclamav/others.h: bump f-level
* sigtool/sigtool.c: fix handling of --datadir
* libclamav/matcher-ac.c: improve offset handling
* libclamav/7z/Archive/7z/7zDecode.c: shut up a warning
* libclamav/autoit.c: properly resume from empty files regression introduced
in ac867aad
* libclamav/elf.c: fix zero mem alloc warning
* win32: fix libclamav's triple and fix GetVersion
* libclamav/bytecode.c: save lsig counts/offsets
* libclamav/{bytecode,matcher}.c: matchicon API
* libclamav/pe_icons.c: BE fixes
* more...
---
Module Name: pkgsrc
Committed By: adam
Date: Thu Aug 26 06:02:07 UTC 2010

Modified Files:
pkgsrc/mail/clamav: distinfo

Log Message:
patch-ac has been changed
---
Module Name: pkgsrc
Committed By: adam
Date: Tue Sep 21 07:47:26 UTC 2010

Modified Files:
pkgsrc/mail/clamav: Makefile buildlink3.mk distinfo

Log Message:
Changes 0.96.3:
This release fixes problems with the PDF parser and the internal bzip2 library.
A complete list of changes is available in the Changelog file.

Pullup ticket #3229 - requested by taca
mail/mailman: security patch

Revisions pulled up:
- mail/mailman/Makefile 1.62
- mail/mailman/distinfo 1.19
- mail/mailman/patches/patch-ak 1.1
- mail/mailman/patches/patch-al 1.1
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Sep 24 23:24:31 UTC 2010

Modified Files:
pkgsrc/mail/mailman: Makefile distinfo
Added Files:
pkgsrc/mail/mailman/patches: patch-ak patch-al

Log Message:
Add patches to fix XSS (CVE-2010-3089).

Bump PKGREVISION.

Pullup ticket #3228 - requested by joerg
archivers/bzip2: security update

Revisions pulled up:
- archivers/bzip2/files/LICENSE 1.3
- archivers/bzip2/files/blocksort.c 1.3
- archivers/bzip2/files/bzip2.1 1.3
- archivers/bzip2/files/bzip2.c 1.3
- archivers/bzip2/files/bzip2recover.c 1.3
- archivers/bzip2/files/bzlib.c 1.3
- archivers/bzip2/files/bzlib.h 1.3
- archivers/bzip2/files/bzlib_private.h 1.3
- archivers/bzip2/files/compress.c 1.3
- archivers/bzip2/files/crctable.c 1.3
- archivers/bzip2/files/huffman.c 1.3
- archivers/bzip2/files/randtable.c 1.3
---
Module Name: pkgsrc
Committed By: joerg
Date: Thu Sep 23 11:03:36 UTC 2010

Modified Files:
pkgsrc/archivers/bzip2/files: LICENSE blocksort.c bzip2.1 bzip2.c
bzip2recover.c bzlib.c bzlib.h bzlib_private.h compress.c
crctable.c huffman.c randtable.c

Log Message:
Forcefully merge the branch back. This updates the included version
numbers.

Pullup ticket #3228.

Pullup ticket #3228 - requested by joerg
archivers/bzip2: security update

Revisions pulled up:
- archivers/bzip2/Makefile 1.50
- archivers/bzip2/PLIST 1.4
- archivers/bzip2/files/CHANGES 1.3
- archivers/bzip2/files/README 1.3
- archivers/bzip2/files/bzdiff new file
- archivers/bzip2/files/bzdiff.1 new file
- archivers/bzip2/files/bzgrep new file
- archivers/bzip2/files/bzgrep.1 new file
- archivers/bzip2/files/decompress.c 1.3
---
Module Name: pkgsrc
Committed By: joerg
Date: Wed Sep 22 14:32:18 UTC 2010

Update of /cvsroot/pkgsrc/archivers/bzip2/files
In directory ivanova.netbsd.org:/tmp/cvs-serv13227

Log Message:
Import stripped down bzip2-1.0.6.
---
Module Name: pkgsrc
Committed By: joerg
Date: Wed Sep 22 14:48:41 UTC 2010

Modified Files:
pkgsrc/archivers/bzip2/files: CHANGES README decompress.c

Log Message:
Update to bzip2-1.0.6: Fix for CVE-2010-0405
---
Module Name: pkgsrc
Committed By: joerg
Date: Wed Sep 22 14:53:22 UTC 2010

Modified Files:
pkgsrc/archivers/bzip2: Makefile PLIST

Log Message:
Update to bzip2-1.0.6: Fix for CVE-2010-0405. Also install various
helper scripts.

Pullup ticket #3224.

Pullup ticket #3224 - requested by taca
www/mediawiki: security update

Revisions pulled up:
- www/mediawiki/Makefile 1.13
- www/mediawiki/distinfo 1.9
- www/mediawiki/patches/patch-aa 1.1
---
Module Name: pkgsrc
Committed By: taca
Date: Thu Sep 16 14:52:02 UTC 2010

Modified Files:
pkgsrc/www/mediawiki: Makefile distinfo
Added Files:
pkgsrc/www/mediawiki/patches: patch-aa

Log Message:
Update mediawiki to 1.15.5.

== MediaWiki 1.15.5 ==

2010-07-28

This is a security and maintenance release.

MediaWiki is now using a "continuous integration" development model with
quarterly snapshot releases. The latest development code is always kept
"ready to run", and in fact runs our own sites on Wikipedia.

Release branches will continue to receive security updates for about a year
from first release, but nonessential bugfixes and feature developments
will be made on the development trunk and appear in the next quarterly release.

Those wishing to use the latest code instead of a branch release can obtain
it from source control: http://www.mediawiki.org/wiki/Download_from_SVN

Pullup ticket #3223.

Pullup ticket #3223 - requested by taca
net/samba33: security update

Revisions pulled up:
- net/samba33/Makefile 1.11
- net/samba33/distinfo 1.5
---
Module Name: pkgsrc
Committed By: taca
Date: Tue Sep 14 13:08:23 UTC 2010

Modified Files:
pkgsrc/net/samba33: Makefile distinfo

Log Message:
Update samba33 package to 3.3.14.

                   ==============================
                   Release Notes for Samba 3.3.14
         September 14, 2010
                   ==============================

This is a security release in order to address CVE-2010-3069.

o  CVE-2010-3069:
   All current released versions of Samba are vulnerable to
   a buffer overrun vulnerability. The sid_parse() function
   (and related dom_sid_parse() function in the source4 code)
   do not correctly check their input lengths when reading a
   binary representation of a Windows SID (Security ID). This
   allows a malicious client to send a sid that can overflow
   the stack variable that is being used to store the SID in the
   Samba smbd server.

Pullup ticket #3220.

Pullup ticket #3220 - requested by spz
security/sudo: security update

Revisions pulled up:
- security/sudo/Makefile 1.122-1.123
- security/sudo/PLIST 1.5
- security/sudo/distinfo 1.64-1.65
- security/sudo/patches/patch-aa 1.24
- security/sudo/patches/patch-af 1.24-1.25
- security/sudo/patches/patch-ag 1.15-1.16
---
Module Name: pkgsrc
Committed By: taca
Date: Mon Jul 5 03:08:10 UTC 2010

Modified Files:
pkgsrc/security/sudo: Makefile distinfo
pkgsrc/security/sudo/patches: patch-af patch-ag

Log Message:
Update sudo package to 1.7.2p8.

Major changes between sudo 1.7.2p7 and 1.7.2p8:

* Fixed a crash on AIX when LDAP support is in use.

* Fixed problems with the QAS non-Unix group support
---
Module Name: pkgsrc
Committed By: spz
Date: Fri Sep 10 17:11:27 UTC 2010

Modified Files:
pkgsrc/security/sudo: Makefile PLIST distinfo
pkgsrc/security/sudo/patches: patch-aa patch-af patch-ag

Log Message:
updating to the latest and greatest (and less a bunch of security
relevant bugs) version:

Major changes between version 1.7.4p3 and 1.7.4p4:

    * A potential security issue has been fixed with respect to the
      handling of sudo's -g command line option when -u is also
      specified. The flaw may allow an attacker to run commands as a
      user that is not authorized by the sudoers file.
    * A bug has been fixed where "sudo -l" output was incomplete if
      multiple sudoers sources were defined in nsswitch.conf and there
      was an error querying one of the sources.
    * The log_input, log_output, and use_pty sudoers options now work
      correctly on AIX. Previously, sudo would hang if they were
      enabled.
    * Fixed "make install" when sudo is built in a directory other
      than the directory that holds the sources.
    * The runas_default sudoers setting now works properly in a
      per-command Defaults line.
    * Suspending and resuming the bash shell when PAM is in use now
      works properly. The SIGCONT signal was not being propagated to
      the child process.

Major changes between version 1.7.4p2 and 1.7.4p3:

    * A bug has been fixed where duplicate HOME environment variables
      could be set when the env_reset setting was disabled and the
      always_set_home setting was enabled in sudoers.
    * The value of sysconfdir is now substituted into the path to the
      sudoers.d directory in the installed sudoers file.
    * Fixed compilation problems on Irix and other platforms.
    * If multiple PAM "auth" actions are specified and the user enters
      ^C at the password prompt, sudo will now abort any subsequent
      "auth" actions. Previously it was necessary to enter ^C once for
      each "auth" action.

Major changes between version 1.7.4p1 and 1.7.4p2:

    * Fixed a bug where sudo could spin in a cpu loop waiting for the
      child process.
    * Packaging fixes for sudo.pp to better handle patchlevels.

Major changes between version 1.7.4 and 1.7.4p1:

    * Fix a bug introduced in sudo 1.7.3 that prevented the -k and -K
      options from functioning when the tty_tickets sudoers option was
      enabled.
    * Sudo no longer prints a warning when the -k or -K options are
      specified and the ticket file does not exist.
    * Changes to the configure script to enable cross-compilation of
      Sudo.

Major changes between version 1.7.3 and 1.7.4:

    * Sudoedit will now preserve the file extension in the name of the
      temporary file being edited. The extension is used by some
      editors (such as emacs) to choose the editing mode.
    * Time stamp files have moved from /var/run/sudo to either
      /var/db/sudo, /var/lib/sudo or /var/adm/sudo. The directories
      are checked for existence in that order. This prevents users
      from receiving the sudo lecture every time the system reboots.
      Time stamp files older than the boot time are ignored on systems
      where it is possible to determine this.
    * Ancillary documentation (README files, LICENSE, etc) is now
      installed in a sudo documentation directory.
    * Sudo now recognizes "tls_cacert" as an alias for "tls_cacertfile"
      in ldap.conf.
    * Defaults settings that are tied to a user, host or command may
      now include the negation operator. For example:
  Defaults:!millert lecture
      will match any user but millert.
    * The default PATH environment variable, used when no PATH variable
      exists, now includes /usr/sbin and /sbin.
    * Sudo now uses polypkg for cross-platform packing.
    * On Linux, sudo will now restore the nproc resource limit before
      executing a command, unless the limit appears to have been
      modified by pam_limits. This avoids a problem with bash scripts
      that open more than 32 descriptors on SuSE Linux, where
      sysconf(_SC_CHILD_MAX) will return -1 when RLIMIT_NPROC is set
      to RLIMIT_UNLIMITED (-1).
    * Visudo will now treat an unrecognized Defaults entry as a parse
      error (sudo will warn but still run).
    * The HOME and MAIL environment variables are now reset based on
      the target user's password database entry when the env_reset
      sudoers option is enabled (which is the case in the default
      configuration). Users wishing to preserve the original values
      should use a sudoers entry like:
  Defaults env_keep += HOME
      to preserve the old value of HOME and
  Defaults env_keep += MAIL
      to preserve the old value of MAIL.
    * The tty_tickets option is now on by default.
    * Fixed a problem in the restoration of the AIX authdb registry
      setting.
    * If PAM is in use, wait until the process has finished before
      closing the PAM session.
    * Fixed "sudo -i -u user" where user has no shell listed in the
      password database.
    * When logging I/O, sudo now handles pty read/write returning ENXIO,
      as seen on FreeBSD when the login session has been killed.
    * Sudo now performs I/O logging in the C locale. This avoids
      locale-related issues when parsing floating point numbers in the
      timing file.
    * Added support for Ubuntu-style admin flag dot files.

Major changes between version 1.7.2p8 and 1.7.3:

    * Support for logging a command's input and output as well as the
      ability to replay sessions. For more information, see the
      documentation for the log_input and log_output Defaults options
      in the sudoers manual. Also see the sudoreplay manual for
      information on replaying I/O log sessions.
    * The use_pty sudoers option can be used to force a command to be
      run in a pseudo-pty, even when I/O logging is not enabled.
    * On some systems, sudo can now detect when a user has logged out
      and back in again when tty-based time stamps are in use.
      Supported systems include Solaris systems with the devices file
      system, Mac OS X, and Linux systems with the devpts filesystem
      (pseudo-ttys only).
    * On AIX systems, the registry setting in /etc/security/user is
      now taken into account when looking up users and groups.
      Sudo now applies the correct the user and group ids when running
      a command as a user whose account details come from a different
      source (e.g. LDAP or DCE vs. local files).
    * Support for multiple sudoers_base and uri entries in ldap.conf.
      When multiple entries are listed, sudo will try each one in the
      order in which they are specified.
    * Sudo's SELinux support should now function correctly when running
      commands as a non-root user and when one of stdin, stdout or stderr
      is not a terminal.
    * Sudo will now use the Linux audit system with configure with the
      --with-linux-audit flag.
    * Sudo now uses mbr_check_membership() on systems that support it
      to determine group membership. Currently, only Darwin (Mac OS X)
      supports this.
    * When the tty_tickets sudoers option is enabled but there is no
      terminal device, sudo will no longer use or create a tty-based
      ticket file. Previously, sudo would use a tty name of "unknown".
      As a consequence, if a user has no terminal device, sudo will now
      always prompt for a password.
    * The passwd_timeout and timestamp_timeout options may now be
      specified as floating point numbers for more granular timeout
      values.
    * Negating the fqdn option in sudoers now works correctly when sudo
      is configured with the --with-fqdn option. In previous versions
      of sudo the fqdn was set before sudoers was parsed.

pullups 3218 + 3219

Pullup ticket 3218 - requested by tnn
security update

Revisions pulled up:
- pkgsrc/www/seamonkey/Makefile 1.39
- pkgsrc/www/seamonkey/distinfo 1.55
- pkgsrc/www/seamonkey/patches/patch-ap 1.8
- pkgsrc/www/seamonkey/patches/patch-mm 1.2

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tnn
   Date:           Thu Sep  9 11:12:27 UTC 2010

   Modified Files:
           pkgsrc/www/seamonkey: Makefile distinfo
           pkgsrc/www/seamonkey/patches: patch-ap patch-mm

   Log Message:
   Update to seamonkey-2.0.7.

   * Message-ID searches on Google Groups work again
   * Add-ons preferences button for Lightning should work now
   * Security fixes:
   MFSA 2010-63 Information leak via XMLHttpRequest statusText
   MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS
   MFSA 2010-61 UTF-7 XSS by overriding document charset using <object> type
                attribute
   MFSA 2010-60 XSS using SJOW scripted function
   MFSA 2010-58 Crash on Mac using fuzzed font in data: URL
   MFSA 2010-57 Crash and remote code execution in normalizeDocument
   MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView
   MFSA 2010-55 XUL tree removal crash and remote code execution
   MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection
   MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText
   MFSA 2010-52 Windows XP DLL loading vulnerability
   MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array
   MFSA 2010-50 Frameset integer overflow vulnerability
   MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)

   To generate a diff of this commit:
   cvs rdiff -u -r1.38 -r1.39 pkgsrc/www/seamonkey/Makefile
   cvs rdiff -u -r1.54 -r1.55 pkgsrc/www/seamonkey/distinfo
   cvs rdiff -u -r1.7 -r1.8 pkgsrc/www/seamonkey/patches/patch-ap
   cvs rdiff -u -r1.1 -r1.2 pkgsrc/www/seamonkey/patches/patch-mm

Pullup ticket 3219 - requested by tnn
security update

Revisions pulled up:
- pkgsrc/devel/nspr/Makefile 1.37
- pkgsrc/devel/nspr/PLIST 1.11
- pkgsrc/devel/nss/Makefile 1.38
- pkgsrc/devel/xulrunner/PLIST 1.24
- pkgsrc/devel/xulrunner/dist.mk 1.14
- pkgsrc/devel/xulrunner/distinfo 1.36
- pkgsrc/devel/xulrunner/mozilla-common.mk 1.16
- pkgsrc/devel/xulrunner/patches/patch-ag 1.2
- pkgsrc/devel/xulrunner/patches/patch-al 1.2
- pkgsrc/devel/xulrunner/patches/patch-ap 1.4
- pkgsrc/devel/xulrunner/patches/patch-mc 1.2
- pkgsrc/devel/xulrunner/patches/patch-mm 1.3
- pkgsrc/devel/xulrunner/patches/patch-mn 1.3

-------------------------------------------------------------------------
   Modified Files:
           pkgsrc/devel/nspr: Makefile PLIST

   Log Message:
   Update to nspr-4.8.6 (via firefox-3.6.9). Changes unknown.

   To generate a diff of this commit:
   cvs rdiff -u -r1.36 -r1.37 pkgsrc/devel/nspr/Makefile
   cvs rdiff -u -r1.10 -r1.11 pkgsrc/devel/nspr/PLIST

-------------------------------------------------------------------------
   Modified Files:
           pkgsrc/devel/nss: Makefile

   Log Message:
   Update to nss-3.12.7.0 (via firefox-3.6.9). Changes unknown.

   To generate a diff of this commit:
   cvs rdiff -u -r1.37 -r1.38 pkgsrc/devel/nss/Makefile

-------------------------------------------------------------------------
   Modified Files:
           pkgsrc/devel/xulrunner: PLIST dist.mk distinfo mozilla-common.mk
           pkgsrc/devel/xulrunner/patches: patch-ag patch-al patch-ap
   patch-mc patch-mm patch-mn

   Log Message:
   Update to firefox-3.6.9 (xulrunner-1.9.2.9)

   MFSA 2010-63 Information leak via XMLHttpRequest statusText
   MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS
   MFSA 2010-61 UTF-7 XSS by overriding document charset using <object> type
                attribute
   MFSA 2010-59 SJOW creates scope chains ending in outer object
   MFSA 2010-58 Crash on Mac using fuzzed font in data: URL
   MFSA 2010-57 Crash and remote code execution in normalizeDocument
   MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView
   MFSA 2010-55 XUL tree removal crash and remote code execution
   MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection
   MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText
   MFSA 2010-52 Windows XP DLL loading vulnerability
   MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array
   MFSA 2010-50 Frameset integer overflow vulnerability
   MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)

   To generate a diff of this commit:
   cvs rdiff -u -r1.23 -r1.24 pkgsrc/devel/xulrunner/PLIST
   cvs rdiff -u -r1.13 -r1.14 pkgsrc/devel/xulrunner/dist.mk
   cvs rdiff -u -r1.35 -r1.36 pkgsrc/devel/xulrunner/distinfo
   cvs rdiff -u -r1.15 -r1.16 pkgsrc/devel/xulrunner/mozilla-common.mk
   cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/devel/xulrunner/patches/patch-ag \
       pkgsrc/devel/xulrunner/patches/patch-al
   cvs rdiff -u -r1.3 -r1.4 pkgsrc/devel/xulrunner/patches/patch-ap
   cvs rdiff -u -r1.1 -r1.2 pkgsrc/devel/xulrunner/patches/patch-mc
   cvs rdiff -u -r1.2 -r1.3 pkgsrc/devel/xulrunner/patches/patch-mm \
       pkgsrc/devel/xulrunner/patches/patch-mn

pullup #3216

Pullup ticket 3216 - requested by tron
security update

Revisions pulled up:
- pkgsrc/www/squid/options.mk 1.20
- pkgsrc/www/squid31/Makefile 1.26
- pkgsrc/www/squid31/distinfo 1.24

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Wed Jul 28 10:16:14 UTC 2010

   Modified Files:
           pkgsrc/www/squid: options.mk
           pkgsrc/www/squid31: Makefile distinfo

   Log Message:
   Changes 3.1.5.1:
   * SourceFormat Enforcement
   * Replace most USE_IPV6 with run-time support probing
   * Translations: sync with 3.HEAD language updates
   * Split-Stack enable DNS and http(s)_port sockets.
   * Bug: --with-valgrind-debug failures ignored
   * Fixed comm.cc:377: "fd_table[fd].halfClosedReader !=3D NULL" assertion
   * Kludge: try to detect system acinclude path, to fix libtool brokenness.
   * Bug: search scope for digest_ldap_auth didn't work
   * Update libtool autoconf macros to libtool2 style
   * Correction documentation of QoS disable-preserve-miss
   * Remove .so from SASL build checks
   * Bug: AIX support: c only c++ style comments test case
   * Bug: AIX support: check libm for log()
   * Do not stop accepting just because we got COMM_NOMESSAGE.
   * Bug: AIX support: uchar is already define (more)
   * Bug: AIX support: uchar is already define
   * Bug: crash handling NULL write callback
   * Correct Joomla DB auth handling
   * Fixed memory leak related to retried requests.
   * Prevent memory leaks when cloning Range requests.
   * Fixed memory leaks related to Range requests.

   Changes 3.1.5:
   * Bug: Fix context leak in HttpStateData::processReplyHeader
   * Bug: raw-IPv6 address URL with append_domain broken
   * Bug: does not send indirect X-Client-Ip in ICAP respmod
   * Fix free memory corruption and off-by-on error when comparing SNMP OIDs
   * Restart DNS retransmission count when restarting the query as an A lookup
   * Bug: HTTP responses with no Date, L-M or Expires can now be cached
   * Maintenance: Formater skip libltdl dirs
   * SourceFormat Enforcement
   * Bug: Fails to detect chunked encoding if not given in all lower case
   * Port from 2.7: max_filedescriptor config option
   * persistent_connection_after_error is meant to be on by default
   * kFreeBSD does not have linux headers. Wrap properly.
   * Maintenance: Use system MD5 instead of hard-coded python paths
   * Bug: ICAP tokens not logged when using multiple access
   * SourceFormat Enforcement
   * OpenBSD: Fix build mem.cc warning: converting of negative value

   To generate a diff of this commit:
   cvs rdiff -u -r1.19 -r1.20 pkgsrc/www/squid/options.mk
   cvs rdiff -u -r1.22 -r1.23 pkgsrc/www/squid31/Makefile
   cvs rdiff -u -r1.20 -r1.21 pkgsrc/www/squid31/distinfo

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Wed Aug  4 11:36:08 UTC 2010

   Modified Files:
           pkgsrc/www/squid31: Makefile distinfo

   Log Message:
   Update "squid31" package to version 3.1.6. Changes since 3.1.5.1:
   - Bug 2994, 2995: IPv4-only regressions
   - Bug 2991: Wrong parameters to fcntl() in commSetCloseOnExec()
   - Bug 2975: chunked requests not supported after regular ones
   - Fix: 32-bit overflow in reported bytes received from next hop
   - Fix Libtool build regressions
   - Limited split-stack IPv6 support.
   - squid_db_auth support MD5 encrypted passwords

   To generate a diff of this commit:
   cvs rdiff -u -r1.23 -r1.24 pkgsrc/www/squid31/Makefile
   cvs rdiff -u -r1.21 -r1.22 pkgsrc/www/squid31/distinfo

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Wed Aug 25 17:53:44 UTC 2010

   Modified Files:
           pkgsrc/www/squid31: Makefile distinfo

   Log Message:
   Update "squid31" package to version 3.1.7. Change since 3.1.6:
   - Regression Bug 3021: Large DNS reply causes crash
   - Regression Bug 3011: ICAP, HTTPS, cache_peer probe IPv4-only port fixes
   - Regression Bug 2997: visible_hostname directive no longer matches docs
   - Bug 3012: deprecate sslBump and support ssl-bump spelling in http_port
   - Bug 3006: handle IPV6_V6ONLY definition missing
   - Bug 3004: Solaris 9 SunStudio 12 build failure
   - Bug 3003: inconsistent concepts in documentation of cache_dir
   - Bug 3001: dnsserver link issues
   - HTTP/1.1: default keep-alive for 1.1 clients (bug 3016)
   - HTTP/1.1: Improved Range header field validation
   - HTTP/1.1: Forward multiple unknown Cache-Control directives
   - HTTP/1.1: Stop sending Proxy-Connection header
   - Fix 32-bit wrap in refresh_pattern min/max values
   - ... and several documentation corrections.

   To generate a diff of this commit:
   cvs rdiff -u -r1.24 -r1.25 pkgsrc/www/squid31/Makefile
   cvs rdiff -u -r1.22 -r1.23 pkgsrc/www/squid31/distinfo

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Tue Sep  7 19:55:17 UTC 2010

   Modified Files:
           pkgsrc/www/squid31: Makefile distinfo

   Log Message:
   Update "squid31" package to version 3.1.8. Changes since 3.1.7:
   - Security fixes:
    - Fixes for the request processing vulnerability tagged SQUID-2010:3.
      http://www.squid-cache.org/Advisories/SQUID-2010_3.txt
    - A hardening of the DNS client against packet queueing approaches
      used to enable attacks. This completes the protection against attacks
      published by Yamaguchi late in 2009.
    - An HTTP request-line parser hardened against several categories of
      request attack. This greatly increasing the speed of detection and
      reducing resources used to detect these categories of attack.
   - Fixes for the following bugs:
     - Bug 3020: Segmentation fault: nameservers[vc->ns].vc =3D NULL
     - Bug 3005,2972: Locate LTDL headers correctly (again)
     - Bug 2872: leaking file descriptors
     - Bug 2583: pure virtual method called

   To generate a diff of this commit:
   cvs rdiff -u -r1.25 -r1.26 pkgsrc/www/squid31/Makefile
   cvs rdiff -u -r1.23 -r1.24 pkgsrc/www/squid31/distinfo

Pullup ticket #3215.

Pullup ticket #3215 - requested by drochner
graphics/dia: package list fix

Revisions pulled up:
- graphics/dia/PLIST 1.19
---
Module Name:    pkgsrc
Committed By:   drochner
Date:           Tue Aug 31 18:25:29 UTC 2010

Modified Files:
        pkgsrc/graphics/dia: PLIST

Log Message:
add conditionals to PLIST to fix the non-gnome case, should fix
PR pkg/43812 by Matthew Mondor
The DIA_HELPDIR variable looks unnecessary now, it might make sense
to not install the xml documentation in the non-gnome case because
there is no tool to read it anyway.

Pullup ticket #3214.

Pullup ticket #3214 - requested by gdt
net/quagga-devel: security update

Revisions pulled up:
- net/quagga-devel/Makefile 1.16
- net/quagga-devel/distinfo 1.11
---
Module Name: pkgsrc
Committed By: gdt
Date: Wed Aug 25 17:52:24 UTC 2010

Modified Files:
pkgsrc/net/quagga-devel: Makefile distinfo

Log Message:
Update to 0.99.17.

The most important change is in correcting handling of malformed data
in BGP sessions.

bgpd:
    fix handling of AS path data
    tighten bounds checking in RR ORF msg reader

ospfd:
    Only refresh external default route once.
    Make sure ospf_distribute_list_update_timer() eventually runs.
    Make sure all external routes are updated.

zebra:
    fix infinite loop when deleting an interface

ospf6d:
    Fix crash when '[no] ipv6 ospf6 advertise prefix-list' is in startup-config

isisd:
    change ISIS_METHOD to use C preprocessor

other:
    build: ignore mkinstalldirs and texinfo.tex
    build: Add QuaggaId to README.NetBSD
    build/extra: Enhance README.NetBSD make/gmake decision.
    git: add pointers to out-of-tree work
    git: add (generated) m4 files to .gitignore
    Update for git and emphasize asking for good reports.
    doc: fixed spelling in bgpd.texi

Pullup ticket #3213.

Pullup ticket #3213 - requested by obache
graphics/pear-Image_Color: build fix

Revisions pulled up:
- lang/php/pear.mk 1.19
---
Module Name: pkgsrc
Committed By: obache
Date: Wed Aug 25 06:37:20 UTC 2010

Modified Files:
pkgsrc/lang/php: pear.mk

Log Message:
Always install pear with `-n', or failed to install if extension is required
but not loaded in php.ini.

pullup #3211 & #3212

Pullup ticket 3212 - requested by tron
security update

Revisions pulled up:
- pkgsrc/databases/phpmyadmin/Makefile 1.83
- pkgsrc/databases/phpmyadmin/distinfo 1.44

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Aug 21 07:50:02 UTC 2010

   Modified Files:
           pkgsrc/databases/phpmyadmin: Makefile distinfo

   Log Message:
   Update "phpmyadmin" package to version 2.11.10.1.
   Changes since version 2.11.10:
   - [setup] Fixed output sanitizing in setup script, see PMASA-2010-4 for
     more details.
   - [core] Fixed various XSS issues, see PMASA-2010-5 for more details.

   To generate a diff of this commit:
   cvs rdiff -u -r1.82 -r1.83 pkgsrc/databases/phpmyadmin/Makefile
   cvs rdiff -u -r1.43 -r1.44 pkgsrc/databases/phpmyadmin/distinfo

Pullup ticket 3211 - requested by tez
build fix for Solaris

Revisions pulled up:
- pkgsrc/devel/glib2/Makefile 1.176

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tez
   Date:           Fri Aug 20 16:33:10 UTC 2010

   Modified Files:
           pkgsrc/devel/glib2: Makefile

   Log Message:
   Fix build on Solaris per pkg/43707 -  no revision bump since other
   platforms are unaffected and Solaris did not build before

   To generate a diff of this commit:
   cvs rdiff -u -r1.175 -r1.176 pkgsrc/devel/glib2/Makefile

Pullup tickets #3208, #3209 and #3210.

Pullup ticket #3210 - requested by obache
x11/wxGTK24: build fix

Revisions pulled up:
- x11/wxGTK24/Makefile.common 1.7
- x11/wxGTK24/distinfo 1.12
- x11/wxGTK24/patches/patch-aa 1.6
---
Module Name: pkgsrc
Committed By: obache
Date: Wed Aug 18 10:05:08 UTC 2010

Modified Files:
pkgsrc/x11/wxGTK24: Makefile.common distinfo
pkgsrc/x11/wxGTK24/patches: patch-aa

Log Message:
Let to use BUILDLINK_DIR first for find header/library files.
It should fixes PR#43215.

Pullup ticket #3209 - requested by wiz
sysutils/dbus-glib: security update

Revisions pulled up:
- sysutils/dbus-glib/Makefile 1.24
- sysutils/dbus-glib/PLIST 1.11
- sysutils/dbus-glib/distinfo 1.12
---
Module Name: pkgsrc
Committed By: wiz
Date: Tue Aug 17 13:33:40 UTC 2010

Modified Files:
pkgsrc/sysutils/dbus-glib: Makefile PLIST distinfo

Log Message:
Update to 0.88:

0.88:
Astone Lin (1):
       Allow duplicate object path registrations for different connections

Christian Dywan (1):
       Refer to dbus_g_connection_flush rather than the plain dbus call

Colin Walters (3):
       Disable test-profile on win32 for now
       Respect property access flags for writing, allow disabling for reads
       configure: Release 0.88

Dan Williams (2):
       core: don't pass malformed error interface to dbus (rh#581794)
       Fix lookup of regular properties when shadow properties are used

Danielle Madeley (6):
       Bumping required GLib to 2.24 for GVariant
       fd.o #28715: Add dbus_g_value_build_g_variant()
       Tests for GValue-to-GVariant
       Write a recursive equivalence function for testing the
equivalence of GVariants
       Test test_g_variant_equivalent itself
       Support DBUS_TYPE_G_SIGNATURE

Fridrich Strba (2):
       Use AC_CANONICAL_HOST, not _TARGET
       Don't use the identifier "interface" in public headers

Fridrich Strba (3):
       Use EXEEXT so that we satisfy dependencies when cross-compiling
       Fix linking of tests. On windows, undefined symbols are not
allowed and symbol lookup is sequencial
       Put the G_OS_WIN32 check where it can be defined.

Guillaume Desmottes (1):
       add mising DBUS_TYPE_G_* to the doc

Simon McVittie (6):
       Bug 14579: remove pending call from hash table before cancelling it
       Merge branch '14579-remove-before-cancel'
       fd.o #27958: dbus_g_error_domain_register: rewrite the documentation
       Add Libtool m4 to .gitignore
       Add various tests etc. to .gitignore
       Consolidate LDADD variables in tests/examples and make them more complete

Will Thompson (1):
       Merge remote branch 'danni/gvalue-to-gvariant'

0.86:
Colin Walters (8):
       Squash underscores and dashes in errors when converting to DBus errors
       Remove dbus-glib-undocumented.txt from git
       Revert "Squash underscores and dashes in errors when converting
to DBus errors"
       Fix hyphenated error codes correctly
       [configure.ac] Use AM_SILENT_RULES if available
       Remove dbus-glib-undeclared.txt from git; it's a generated file
       [dbus-gobject.c] Trivial compiler warning fixes
       [configure] Release 0.86

Dan Williams (2):
       core: allow duplicate property names on GInterfaces
       core: performance optimization for object info lookup

Sven Herzberg (1):
       turn the gtk-doc documentation into buildable shape

Will Thompson (1):
       Free errors returned by method implementations

Pullup ticket #3208 - requested by taca
databases/mysql51-client: security update
databases/mysql51-server: security update

Revisions pulled up:
- databases/mysql51-client/Makefile.common 1.10
- databases/mysql51-client/distinfo 1.6
- databases/mysql51-client/patches/patch-ap 1.2
- databases/mysql51-server/PLIST 1.7
- databases/mysql51-server/Makefile 1.6
- databases/mysql51-server/distinfo 1.8-1.9
- databases/mysql51-server/patches/patch-ae 1.2
- databases/mysql51-server/patches/patch-aj 1.2
- databases/mysql51-server/patches/patch-ak 1.2
- databases/mysql51-server/patches/patch-ay 1.3
- databases/mysql51-server/patches/patch-az 1.1
- databases/mysql51-server/patches/patch-ba 1.1
- databases/mysql51-server/patches/patch-bb 1.1
---
Module Name: pkgsrc
Committed By: taca
Date: Wed Aug 11 23:18:04 UTC 2010

Modified Files:
pkgsrc/databases/mysql51-client: Makefile.common distinfo
pkgsrc/databases/mysql51-client/patches: patch-ap
pkgsrc/databases/mysql51-server: PLIST distinfo
pkgsrc/databases/mysql51-server/patches: patch-aj patch-ak
Removed Files:
pkgsrc/databases/mysql51-server/patches: patch-ay

Log Message:
Update mysql51-client and mysql51-server to 5.1.49.

Please refer http://dev.mysql.com/doc/refman/5.1/en/news-5-1-49.html
for full changes.

* InnoDB Plugin has been upgraded to version 1.0.10. This version is
  considered of General Availability (GA) quality.

  In this release, the InnoDB Plugin is included in source and binary
  distributions, except RHEL3, RHEL4, SuSE 9 (x86, x86_64, ia64), and
  generic Linux RPM packages. It also does not work for FreeBSD 6 and
  HP-UX or for Linux on generic ia64.

Bugs fixed:

* Security Fix: After changing the values of the innodb_file_format or
  innodb_file_per_table configuration parameters, DDL statements could
  cause a server crash. (Bug#55039)

* Security Fix: Joins involving a table with with a unique SET column
  could cause a server crash. (Bug#54575)

* Security Fix: Incorrect handling of NULL arguments could lead to a
  crash for IN() or CASE operations when NULL arguments were either
  passed explicitly as arguments (for IN()) or implicitly generated by
  the WITH ROLLUP modifier (for IN() and CASE). (Bug#54477)

* Security Fix: A malformed argument to the BINLOG statement could
  result in Valgrind warnings or a server crash. (Bug#54393)

* Security Fix: Use of TEMPORARY InnoDB tables with nullable columns
  could cause a server crash. (Bug#54044)

* Security Fix: The server could crash if there were alternate reads
  from two indexes on a table using the HANDLER interface. (Bug#54007)

* Security Fix: Using EXPLAIN with queries of the form SELECT
  ... UNION ... ORDER BY (SELECT ... WHERE ...) could cause a server
  crash. (Bug#52711)

* Security Fix: LOAD DATA INFILE did not check for SQL errors and sent
  an OK packet even when errors were already reported. Also, an assert
  related to client-server protocol checking in debug servers
  sometimes was raised when it should not have been. (Bug#52512)
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Aug 13 14:25:35 UTC 2010

Modified Files:
pkgsrc/databases/mysql51-server: Makefile distinfo
pkgsrc/databases/mysql51-server/patches: patch-ae
Added Files:
pkgsrc/databases/mysql51-server/patches: patch-ay patch-az patch-ba
    patch-bb

Log Message:
Fix some my_time_t (long) v.s. time_t problem introduced MySQL 5.1.49.
This problem results mysqld to exit on start up.

5.1/i386 5.1/amd64 5.99.38/i386 5.99.38/amd64
my_time_t int32_t int64_t int32_t int64_t
time_t int32_t int32_t int64_t int64_t

I confirmed to mysqld running on these four case except 5.99.38/i386.

Bump PKG_REVISION.

Pullup ticket #3207.

Pullup ticket #3207 - requested by taca
lang/ruby18-base: security patch

Revisions pulled up:
- lang/ruby18-base/Makefile 1.56
- lang/ruby18-base/distinfo 1.44
- lang/ruby18-base/patches/patch-ea 1.1
---
Module Name: pkgsrc
Committed By: taca
Date: Mon Aug 16 07:08:13 UTC 2010

Modified Files:
pkgsrc/lang/ruby18-base: Makefile distinfo
Added Files:
pkgsrc/lang/ruby18-base/patches: patch-ea

Log Message:
Add a patch to fix for possible cross-site scripting (CVE-2010-0541)
from r29002 in Ruby's repository. (Sadly, Ruby 1.8.7 pl301 missed
this change...)

Bump PKGREVISION.

Pullup ticket #3206.

Pullup ticket #3206 - requested by tron
net/socat: security update

Revisions pulled up:
- net/socat/Makefile 1.24
- net/socat/distinfo 1.15
---
Module Name: pkgsrc
Committed By: zafer
Date: Thu Aug 12 17:54:14 UTC 2010

Modified Files:
pkgsrc/net/socat: Makefile distinfo

Log Message:
Update socat to 1.7.1.3

Changelog:

security:
fixed a stack overflow vulnerability that occurred when command
line arguments (whole addresses, host names, file names) were longer
than 512 bytes.
Note that this could only be exploited when an attacker was able to
inject data into socat's command line.
Full credits to Felix Grobert, Google Security Team, for finding and
reporting this issue

Pullup ticket #3205.

Pullup ticket #3205 - requested by taca
www/drupal6: security update

Revisions pulled up:
- www/drupal6/Makefile 1.22
- www/drupal6/distinfo 1.17
---
Module Name: pkgsrc
Committed By: taca
Date: Wed Aug 11 21:56:28 UTC 2010

Modified Files:
pkgsrc/www/drupal6: Makefile distinfo

Log Message:
Update drupal6 package to 6.18.

Drupal 6.18, 2010-08-11
----------------------
- Fixed security issues (OpenID authentication bypass, File download access
bypass, Comment unpublishing bypass, Actions cross site scripting),
see SA-CORE-2010-002.

Pullup ticket #3204.

Pullup ticket #3204 - requested by taca
www/typolight27: security patch

Revisions pulled up:
- www/typolight27/Makefile patch
- www/typolight27/distinfo patch
- www/typolight27/patches/patch-ab new file
---
Apply patch to fix XSS vulnerability.

Pullup ticket #3203.

Pullup ticket #3203 - requested by taca
www/typolight28: security update

Revisions pulled up:
- www/typolight28/Makefile 1.10-1.11
- www/typolight28/Makefile.version 1.7
- www/typolight28/distinfo 1.8-1.9
- www/typolight28/patches/patch-ad 1.1
---
Module Name: pkgsrc
Committed By: taca
Date: Sat Jul 3 04:00:09 UTC 2010

Modified Files:
pkgsrc/www/typolight28: Makefile Makefile.version distinfo

Log Message:
Update typolight28 to 2.8.4.

Version 2.8.4 (2010-06-30)
--------------------------
- Back-ported the Safe Mode Hack improvements from version 2.9
---
Module Name: pkgsrc
Committed By: taca
Date: Wed Jul 28 16:24:20 UTC 2010

Modified Files:
pkgsrc/www/typolight28: Makefile distinfo
Added Files:
pkgsrc/www/typolight28/patches: patch-ad

Log Message:
Add a patch from Contao(TYPOlight) repository to fix possible
XSS problem on frontend module.

Bump PKGREVISION.

Pullup ticket #3201.

Pulluped ticket #3201 - requested by gls
archivers/cabextract: security update

Revisions pulled up:
- archivers/cabextract/Makefile 1.21
- archivers/cabextract/distinfo 1.10
---
Module Name: pkgsrc
Committed By: wiz
Date: Sat Jul 24 08:45:14 UTC 2010

Modified Files:
pkgsrc/archivers/cabextract: Makefile distinfo

Log Message:
Update to 1.3, set LICENSE.

New in 1.3:
* Bugs in the MS-ZIP and Quantum decompressors have been fixed.
* MS-ZIP recovery has been improved.
* cabextract should now compile with MinGW

pullup 3200

Pullup ticket 3200 - requested by tnn
security update

Revisions pulled up:
- pkgsrc/graphics/freetype2/Makefile 1.74
- pkgsrc/graphics/freetype2/distinfo 1.36

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tnn
   Date:           Sun Aug  8 16:06:02 UTC 2010

   Modified Files:
           pkgsrc/graphics/freetype2: Makefile distinfo

   Log Message:
   Update to freetype2-2.4.2:

   CHANGES BETWEEN 2.4.1 and 2.4.2
     I. IMPORTANT BUG FIXES
       - A stack overflow in CFF Type2 CharStrings interpreter is fixed.
       - Handling Type 42 font deallocation was broken; additionally, the
         library is now more robust against malformed Type 42 fonts.
     II. MISCELLANEOUS
       - Two new functions,  `FT_Reference_Library' (in FT_MODULE_H)  and
         `FT_Reference_Face'  (in  FT_FREETYPE_H),  have  been  added  to
         simplify life-cycle management.  A counter gets initialized to 1
         at the  time an  FT_Library (or  FT_Face) structure  is created.
         The  two  new   functions  increment  the  respective   counter.
         `FT_Done_Library' and `FT_Done_Face' then only destroy a library
         or face if the counter is 1, otherwise they simply decrement the
         counter.

   To generate a diff of this commit:
   cvs rdiff -u -r1.73 -r1.74 pkgsrc/graphics/freetype2/Makefile
   cvs rdiff -u -r1.35 -r1.36 pkgsrc/graphics/freetype2/distinfo

pullup #3199

Pullup ticket 3199 - requested by gls
security patch

Revisions pulled up:
- pkgsrc/security/gnupg2/Makefile 1.30
- pkgsrc/security/gnupg2/distinfo 1.18

Files added:
pkgsrc/security/gnupg2/patches/patch-an

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Tue Aug  3 19:14:42 UTC 2010

   Modified Files:
           pkgsrc/security/gnupg2: Makefile distinfo
   Added Files:
           pkgsrc/security/gnupg2/patches: patch-an

   Log Message:
   add patch from upstream to fix a possible use-after-free problem
   (CVE-2010-2547), bump PKGREVISION

   To generate a diff of this commit:
   cvs rdiff -u -r1.29 -r1.30 pkgsrc/security/gnupg2/Makefile
   cvs rdiff -u -r1.17 -r1.18 pkgsrc/security/gnupg2/distinfo
   cvs rdiff -u -r0 -r1.1 pkgsrc/security/gnupg2/patches/patch-an

Pullup ticket #3198 - requested by gls
net/lftp: security update

Revisions pulled up:
- net/lftp/Makefile 1.92-1.93
- net/lftp/distinfo 1.53-1.54
- net/lftp/PLIST 1.17
- net/lftp/patches/patch-ab 1.4
- net/lftp/patches/patch-af delete
- net/lftp/patches/patch-ag delete
---
Module Name: pkgsrc
Committed By: pettai
Date: Mon Jul 19 13:12:00 UTC 2010

Modified Files:
pkgsrc/net/lftp: Makefile distinfo
Removed Files:
pkgsrc/net/lftp/patches: patch-af patch-ag

Log Message:
Update to 4.0.4:

* added dnssec support.
* new setting cmd:stifle-rl-history to limit command history size.
* fixed exit code of mget/mput.
* fixed compilation on some systems.
* fixed crash of `cls -s' on MacOS X x64.
* torrent: don't try to connect back to peers which connected to us.
---
Module Name: pkgsrc
Committed By: pettai
Date: Sun Jul 25 21:38:34 UTC 2010

Modified Files:
pkgsrc/net/lftp: Makefile PLIST distinfo
pkgsrc/net/lftp/patches: patch-ab

Log Message:
Version 4.0.9 - 2010-06-10

* torrent: don't try to re-download invalid piece from the same peer.
* added a short lftp.conf(5) man page.
* fixed a problem with zeroed errno.
* fixed status of mget from file: schema.
* fixed a compilation problem on AIX.

Version 4.0.8 - 2010-05-24

* fixed get/mget -c when xfer:clobber is off.
* fixed file verification in pget.
* fixed ftp encoding for servers with LANG but without UTF8 feature.

Version 4.0.7 - 2010-04-29

* make xfer:clobber off by default.
* limit number of attempts to upload a file (net:max-retries).
* handle 426 ftp reply to STOR specially.
* retry FEAT after login even after non-standard 5xx reply.

Version 4.0.6 - 2010-03-25

* use O_EXCL flag when xfer:clobber is off.
* better validation of server-provided file name (CVE-2010-2251).
* new setting xfer:auto-rename (off by default).
* new setting ftp:ssl-copy-sid (for some broken servers).
* fixed CCC ftp command to shutdown SSL connection properly.
* fixed `pget -c' on complete files.

Version 4.0.5 - 2009-12-21

* added support for lighttpd listings.
* fixed sftp rename.
* fixed a core dump on `kill all' with pget.
* fixed interrupting of a torrent with unresponsive tracker.
* Czech translation updated

Pullup ticket #3198.

pullups 3196 + 3197

Pullup ticket 3197 - requested by tron
security patches

Revisions pulled up:
- pkgsrc/graphics/tiff/Makefile 1.97
- pkgsrc/graphics/tiff/distinfo 1.49

Files added:
pkgsrc/graphics/tiff/patches/patch-aa
pkgsrc/graphics/tiff/patches/patch-ab
pkgsrc/graphics/tiff/patches/patch-ac
pkgsrc/graphics/tiff/patches/patch-ad
pkgsrc/graphics/tiff/patches/patch-ae

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Wed Aug  4 17:48:22 UTC 2010

   Modified Files:
           pkgsrc/graphics/tiff: Makefile distinfo
   Added Files:
           pkgsrc/graphics/tiff/patches: patch-aa patch-ab patch-ac patch-ad
               patch-ae

   Log Message:
   Add patches from either libtiff's or Red Hat's Bugzilla which fix the
   following vulnerabilities:
   - CVE-2010-2233
   - CVE-2010-2482
   - CVE-2010-2483
   - CVE-2010-2595
   - CVE-2010-2597
   There is no patch for CVE-2010-2596 yet. But it is low risk (an assertion
   gets triggered) and cannot be exploited after the above vulnerabilities
   are fixed (at least if I understood correctly).

   No butcher was involved in fixing this package.

   To generate a diff of this commit:
   cvs rdiff -u -r1.96 -r1.97 pkgsrc/graphics/tiff/Makefile
   cvs rdiff -u -r1.48 -r1.49 pkgsrc/graphics/tiff/distinfo
   cvs rdiff -u -r0 -r1.19 pkgsrc/graphics/tiff/patches/patch-aa
   cvs rdiff -u -r0 -r1.20 pkgsrc/graphics/tiff/patches/patch-ab
   cvs rdiff -u -r0 -r1.22 pkgsrc/graphics/tiff/patches/patch-ac
   cvs rdiff -u -r0 -r1.16 pkgsrc/graphics/tiff/patches/patch-ad
   cvs rdiff -u -r0 -r1.11 pkgsrc/graphics/tiff/patches/patch-ae

Pullup ticket 3196 - requested by tron
security update

Revisions pulled up:
- pkgsrc/net/wireshark/Makefile 1.50
- pkgsrc/net/wireshark/distinfo 1.33

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Tue Aug  3 20:45:50 UTC 2010

   Modified Files:
           pkgsrc/net/wireshark: Makefile distinfo

   Log Message:
   Update "wireshark" package to version 1.2.10. Changes since version 1.2.9:
   - Bug Fixes
     o The SigComp Universal Decompressor Virtual Machine could
       overrun a buffer. (Bug 4867)
       Versions affected: 0.10.8 to 1.0.14, 1.2.0 to 1.2.9
       CVE-2010-2287
     o The GSM A RR dissector could crash. (Bug 4897)
       Versions affected: 1.2.2 to 1.2.9
     o Due to a regression the ASN.1 BER dissector could overrun the stack.
       Versions affected: 0.10.13 to 1.0.14, 1.2.0 to 1.2.9
       CVE-2010-2284
     o The IPMI dissector could go into an infinite loop.
       Versions affected: 1.2.0 to 1.2.9
   - The following bugs have been fixed:
     o Wireshark crashes after configuring new Information column.
       (Bug 4854)
     o Crash triggered when changing display filter from right-mouse
       pop-up menu via packet-list. (Bug 4860)
     o Wireshark crash selecting Inter-Asterisk exchange v2 packet
       data. (Bug 4868)
     o zlib-1.2.5 cause tshark to stop live capture. (Bug 4916)
     o Crash when adding SNMP users. (Bug 4926)
     o Wireshark via ssh -X on ipv6 link-local address fails to allow
       capture. (Bug 4945)
     o OMAPI dissector fails to parse combined initialization
       messages. (Bug 4982)
     o QUERY_FS_INFO for Macintosh level 0x301 - MacSupportFlags
       decodes wrong. (Bug 4993)
     o SCSI dissector misidentifies ATA PASSTHROUGH command as ACCESS
       CONTROL IN. (Bug 5037)
     o Wrong decoding of GTP Prime (GTP') packets. (Bug 5055)
   - Updated Protocol Support
     ASN.1 BER, GSM A RR, GTP, IAX2, IPMI, OMAPI, PRES, SCSI, SMB, UNISTIM

   To generate a diff of this commit:
   cvs rdiff -u -r1.49 -r1.50 pkgsrc/net/wireshark/Makefile
   cvs rdiff -u -r1.32 -r1.33 pkgsrc/net/wireshark/distinfo

Pullup ticket #3194.

Pullup ticket #3194 - requested by taca
www/typo3: security update

Pulled up:
- www/typo3/Makefile patch
- www/typo3/PLIST patch
- www/typo3/distinfo patch
---
Update typo3 package to 4.3.4:

Due to several security issues found in the TYPO3 Core, there was a
combined release of TYPO3 4.1.14, 4.2.14, 4.3.4 and 4.4.1.

Find more details in the security bulletin:
http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-012/

For full change please refer:
http://wiki.typo3.org/index.php/TYPO3_4.3.4#Changelog

Pullup ticket #3193 - requested by obache
print/gv: security update

Revisions pulled up:
- print/gv/Makefile 1.72-1.73
---
Module Name: pkgsrc
Committed By: obache
Date: Mon Jul 26 14:40:22 UTC 2010

Modified Files:
pkgsrc/print/gv: Makefile

Log Message:
* Also need SIGCHLD-fallback for OpenBSD and DragonFly
* using iconv, so buildlink with libiconv
XXX: but failed to link with libiconv from pkgsrc, bad configure test.
---
Module Name: pkgsrc
Committed By: obache
Date: Mon Jul 26 14:57:51 UTC 2010

Modified Files:
pkgsrc/print/gv: Makefile

Log Message:
Skip iconv_open in libiconv check in configure script.
It always failed with libiconv from pkgsrc.

Pullup ticket #3193.

Pullup ticket #3193 - requested by obache
print/gv: security update

Revisions pulled up:
- print/gv/Makefile 1.71
- print/gv/PLIST 1.8
- print/gv/distinfo 1.18
- print/gv/patches/patch-aa 1.15
- print/gv/patches/patch-ab delete
- print/gv/patches/patch-ad delete
- print/gv/patches/patch-ae 1.10
- print/gv/patches/patch-af 1.7
- print/gv/patches/patch-aj 1.1
---
Module Name: pkgsrc
Committed By: obache
Date: Sat Jul 24 08:22:02 UTC 2010

Modified Files:
pkgsrc/print/gv: Makefile PLIST distinfo
pkgsrc/print/gv/patches: patch-aa patch-ae patch-af
Added Files:
pkgsrc/print/gv/patches: patch-aj
Removed Files:
pkgsrc/print/gv/patches: patch-ab patch-ad

Log Message:
Update gv to 3.7.1.

%%%%%%%%%%%%%%%%%%% GV 3.7.1 (June 2010) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# Fix bug [bug #30081] gv 3.7.0: unable to print/save pdf files.

%%%%%%%%%%%%%%%%%%% GV 3.7.0 (June 2010) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

* GV 3.6.91 has been released as GV 3.7.0 with no changes but
   some minor code cleanups.

%%%%%%%%%%%%%%%%%%% GV 3.6.91 (June 2010) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# Support starting ghostscript from a safe directory.

# ghostscript is started with -P- if SAFER is enabled.

# ghostscript is started with -dSAFER and -dDELAYSAFER for "pdf2dsc"
   and "pdf2ps" if safer is enabled

# Minor bugfixes

%%%%%%%%%%%%%%%%%%% GV 3.6.90 (May 2010) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# Fix compiling on Mac OS X

# Support for localised user interfaces

%%%%%%%%%%%%%%%%%%% GV 3.6.9  (April 2010) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# Bugfix in gv-update-userconfig

%%%%%%%%%%%%%%%%%%% GV 3.6.8.91  (March 2010) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# Fixed compiling on Xaw3d 1.5.

%%%%%%%%%%%%%%%%%%% GV 3.6.8.90  (March 2010) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# UTF-8 Support. Read the included file README.I18N for details.

%%%%%%%%%%%%%%%%%%% GV 3.6.8  (December 2009) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# GV 3.6.7.90 has been released as GV 3.6.8 with no changes

? "Fit to window magnification" and "Fit width to window magnification" with
   "Automatic resizing" turned on sometime miss rescaling, especially when
   changing the orientation or resizing the window. You can force
   rescaling by selecting the active "special" scale in the scales menu.

? Interactive prompting for the password of encrypted PDF files do not work
   if and only if DSC is turned off. As a workarouund, you can load the file
   with DSC turned on and then turn DSC off.

%%%%%%%%%%%%%%%%%%% GV 3.6.7.90  (December 2009) %%%%%%%%%%%%%%%%%%%%%%%%%%%

# Compilation fix for Mac OS X: Requires --enable-SIGCHLD-fallback during
   compilation.

# "Fit height to window magnification"  --
   currently works best with "Automatic resizing" turned off.
   With --scale=-1003, you can access the new scale from the command line.

# Improved handling of filename "-" (which means read document from stdin)

%%%%%%%%%%%%%%%%%%% GV 3.6.7  (March 2009) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# GV 3.6.6.92 has been released as GV 3.6.7 with no changes

? "Fit to window magnification" and "Fit width to window magnification" with
   "Automatic resizing" turned on sometime miss rescaling, especially when
   changing the orientation or resizing the window. You can force
   rescaling by selecting the active "special" scale in the scales menu.

? Interactive prompting for the password of encrypted PDF files do not work
   if and only if DSC is turned off. As a workarouund, you can load the file
   with DSC turned on and then turn DSC off.

%%%%%%%%%%%%%% GV 3.6.6.92 (internal release: March 2009) %%%%%%%%%%%%%%

# Fixed debian bug #516995: Misleading error message when .gv file is not
present [and XUSERFILESEARCHPATH is used]

%%%%%%%%%%%%%%%%%%% GV 3.6.6.91 (February 2009) %%%%%%%%%%%%%%%%%%%%%%%%

# Fixed a bug in switching to presentation mode.

# Fixed reset scrolling position in open dialog when changing directories.

%%%%%%%%%%%%%%%%%%% GV 3.6.6.90 (January 2009) %%%%%%%%%%%%%%%%%%%%%%%%

# TOC can now display more than about 2000 pages (fixes bug #24069).

# File open dialog can now display more than about 2000 files
   (fixes ubuntu bug #274767).

# By pressing "Shift-P" or selecting "State/Presentation Mode", you can
   open another instance of GNU gv which is in presentation mode.

%%%%%%%%%%%%%%%%%%% GV 3.6.6  (September 2008) %%%%%%%%%%%%%%%%%%%%%%%%

# Updated maintainer's e-mail address, otherwise no changes

%%%%%%%%%%%%%%%%%%% GV 3.6.5.92  (September 2008) %%%%%%%%%%%%%%%%%%%%%

# libzio is now used if available during compile time

%%%%%%%%%%%%%%%%%%% GV 3.6.5.91  (September 2008) %%%%%%%%%%%%%%%%%%%%%

# gv-update-userconfig now offers the options -n resp. -N to switch to an
   alternative navigation: After each page switch (except if selected by the
   page number) the page is scrolled to   the top (if switching forward) resp.
   the bottom (if switching backward).

# gv-update-userconfig can remove the resources inserted by -n resp. -N with
   the new option -s.

# Support for encrypted PDF files. New command line switch
   "--password=PASSWORD" for opening encrypted PDFs. If the password
   is not supplied via command line, the user will be asked to enter it.

# Support for files > 2GB on file systems with large file support.

? Interactive prompting for the password of encrypted PDF files do not work
   if and only if DSC is turned off. As a workarouund, you can load the file
   with DSC turned on and then turn DSC off.

%%%%%%%%%%%%%%%%%%% GV 3.6.5.90  (August 2008) %%%%%%%%%%%%%%%%%%%%%%%%

# the current coordinate can be saved to a file by the z resp. the u key.
   See gv.info for details.

# The return key now scrolls through the whole document vertically.
   Unlike the space key no horizontal scrolling is performed. The old function
   of the return key is still available through the "Page Down" and the "f" key.

# *.ad and *.dat files are installed to $PREFIX/share/gv

# "ERROR:" and "error:" now also trigger the info popup in error mode

# Xinerama support. It can be configured by the "xinerama"-resource.
   Its values can be "On", "Off" or "Auto". "Auto" is the default.

# New helper Script "gv-update-userconfig", which is a simple script to
   update an .gv config file to the current version of gv.

# Should build on Solaris now using sun studio 11 compiler

%%%%%%%%%%%%%%%%%%% GV 3.6.5  (July 2008) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# GV 3.6.4.91 has been released as GV 3.6.5 with no changes

? "Fit to window magnification" and "Fit width to window magnification" with
   "Automatic resizing" turned on sometime miss rescaling, especially when
   changing the orientation or resizing the window. You can force
   rescaling by selecting the active "special" scale in the scales menu.

%%%%%%%%%%%%%%%%%%% GV 3.6.4.91  (June 2008) %%%%%%%%%%%%%%%%%%%%%%%%%%

# ~/.gv now contains the version that has saved that configuration.

%%%%%%%%%%%%%%%%%%% GV 3.6.4.90  (June 2008) %%%%%%%%%%%%%%%%%%%%%%%%%%

* Build-system ensures that the man-page is always up to date

# Fixed some compiler warnings

# Added new widgetless mode, usable via option "--widgetless"

# --help, --usage and --version now work without having an X11 display

# --spartan and --widgetless now use embedded resources. Before this bugfix,
   you had to use --style=gv_spartan.dat to use the embedded resource.

# --infoSilent, --infoErrors and --infoAll will control, which ghostscript
   messages will lead to an info pop-up window.
   The same effect can be reached via a resource "infoVerbose", which values can
   be "Silent", "Errors" and "All". It can also be edited via the "gv options"
   dialog.

# "Fit to window magnification" and "Fit width to window magnification" --
   currently works best with "Automatic resizing" turned off. With --scale=-1000
   resp. --scale=-1001, you can access these special scales from the command line.

? "Fit to window magnification" and "Fit width to window magnification" with
   "Automatic resizing" turned on sometime miss rescaling, especially when
   changing the orientation or resizing the window. You can force
   rescaling by selecting the active "special" scale in the scales menu.

# Arbitrary scales are now possible - input them in the gv options dialog
   or with --scale=n, where n is a float.

# New fullscreen mode which needs support from the window manager

# New command line switch "--presentation" as a shortcut for
   "--fullscreen --noresize --scale=-1000 --widgetless"

%%%%%%%%%%%%%%%%%%% GV 3.6.4  (June 2008) %%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# GV 3.6.3.90 has been released as GV 3.6.4 with no changes

%%%%%%%%%%%%%%%%%%% GV 3.6.3.90  (May 2008) %%%%%%%%%%%%%%%%%%%%%%%%%%%

# DSC parser now respects the level of BeginDocument/EndDocument

# Possible segfault has been fixed

# Fixed bug #21239: Vlist.c produces garbage if International is set

# Fixed bug #21740: popup windows may partly invisible as not on the screen

# The escape key is now working in more contexts

# The filename can optionally be shown insted of the title

# Fixed bug #23199: No error message for errors in opened file

* Got rid of non-free code.

pullup 3192

Pullup ticket 3192 - requested by obache
security update

Revisions pulled up:
- pkgsrc/net/avahi/Makefile 1.17
- pkgsrc/net/avahi/PLIST 1.5
- pkgsrc/net/avahi/PLIST.pygdbm 1.3
- pkgsrc/net/avahi/PLIST.python 1.4
- pkgsrc/net/avahi/distinfo 1.8
- pkgsrc/net/avahi/options.mk 1.2
- pkgsrc/net/avahi/patches/patch-aa 1.2
- pkgsrc/net/avahi/patches/patch-ab 1.2
- pkgsrc/net/avahi/patches/patch-ac 1.2
- pkgsrc/net/avahi/patches/patch-ad 1.2
- pkgsrc/net/avahi/patches/patch-ae 1.4
- pkgsrc/net/avahi/patches/patch-ag 1.4
- pkgsrc/net/avahi/patches/patch-aj 1.4
- pkgsrc/net/avahi/patches/patch-ah 1.2
- pkgsrc/net/avahi/patches/patch-ai 1.2

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   obache
   Date:           Sat Jul 24 13:42:12 UTC 2010

   Modified Files:
           pkgsrc/net/avahi: Makefile PLIST PLIST.pygdbm PLIST.python distinfo
               options.mk
           pkgsrc/net/avahi/patches: patch-aa patch-ab patch-ac patch-ad patch-ae
               patch-ag patch-ah patch-ai patch-aj

   Log Message:
   Update avahi to 0.6.27.

   0.6.27
   some build fixes

   0.6.26
   This is mostly a bugfix release but also fixes a low risk security issue and
   adds a couple of minor new features.
     * Fix CVE-2010-2244 (Ludwig Nussel)
     * Support for Gtk+ 3 and Gtk+ Introspection
     * Native systemd socket activation support
     * Add systemd service files
     * Add various resource control options, for traffic rate limiting as well
       as cache size and D-Bus client object limits.
     * i18n updates
     * Minor other updates

   To generate a diff of this commit:
   cvs rdiff -u -r1.16 -r1.17 pkgsrc/net/avahi/Makefile
   cvs rdiff -u -r1.4 -r1.5 pkgsrc/net/avahi/PLIST
   cvs rdiff -u -r1.2 -r1.3 pkgsrc/net/avahi/PLIST.pygdbm
   cvs rdiff -u -r1.3 -r1.4 pkgsrc/net/avahi/PLIST.python
   cvs rdiff -u -r1.7 -r1.8 pkgsrc/net/avahi/distinfo
   cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/net/avahi/options.mk
   cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/net/avahi/patches/patch-aa \
        pkgsrc/net/avahi/patches/patch-ab pkgsrc/net/avahi/patches/patch-ac \
        pkgsrc/net/avahi/patches/patch-ad
   cvs rdiff -u -r1.3 -r1.4 pkgsrc/net/avahi/patches/patch-ae \
        pkgsrc/net/avahi/patches/patch-ag pkgsrc/net/avahi/patches/patch-aj
   cvs rdiff -u -r1.1 -r1.2 pkgsrc/net/avahi/patches/patch-ah \
        pkgsrc/net/avahi/patches/patch-ai

Ticket #3190 update the "nspr" package as well.

pullup 3187

Pullup ticket #3190.

Pullup ticket #3190 - requested by obache
www/py-paste: security update

Revisions pulled up:
- www/py-paste/Makefile 1.7
- www/py-paste/PLIST 1.5
- www/py-paste/distinfo 1.3
---
Module Name: pkgsrc
Committed By: obache
Date: Mon Jul 26 12:38:42 UTC 2010

Modified Files:
pkgsrc/www/py-paste: Makefile PLIST distinfo

Log Message:
Update py-Paste to 1.7.4.
While here, set LICENSE=mit.

1.7.4
-----

* Fix XSS bug (security issue) with not found handlers for
   :class:`paste.urlparser.StaticURLParser` and
   :class:`paste.urlmap.URLMap`.  If you ask for a path with
   ``/--><script>...`` that will be inserted in the error page and can
   execute Javascript.  Reported by Tim Wintle.

* Replaced :func:`paste.util.mimeparse.desired_match`

1.7.3.1
-------

* Removed directory name from 404 errors in
   :class:`paste.urlparser.StaticURLParser`.

* Fixed packaging to include Javascript and images for
   :mod:`paste.evalexception`

1.7.3
-----

* I got a fever and the only prescription is more :mod:`paste.cowbell`!

* Fix :mod:`paste.httpserver` on Python 2.6.

* Fix :mod:`paste.auth.cookie`, which would insert newlines for long
   cookies.

* :mod:`paste.util.mimeparse` parses a single ``*`` in Accept headers
   (sent by IE 6).

* Fix some problems with the ``wdg_validate`` middleware.

* Improvements to :mod:`paste.auth.auth_tkt`: add httponly support,
   don't always aggressively set cookies without the
   ``wildcard_cookie`` option.  Also on logout, make cookies expire.

* In :class:`paste.proxy.Proxy` handle Content-Length of -1.

* In :mod:`paste.httpexceptions` avoid some unicode errors.

* In :mod:`paste.httpserver` handle ``.read()`` from 100 Continue
   properly (because of a typo it was doing a readline).

* Update ``paste.util.mimeparse`` from `upstream
   <http://code.google.com/p/mimeparse/>`_.

Pullup ticket 3187 - requested by tron
security update

Revisions pulled up:
- pkgsrc/www/apache22/Makefile 1.61
- pkgsrc/www/apache22/distinfo 1.34

Files deleted:
pkgsrc/www/apache22/patches/patch-af

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Mon Jul 26 21:38:52 UTC 2010

   Modified Files:
           pkgsrc/www/apache22: Makefile distinfo
   Removed Files:
           pkgsrc/www/apache22/patches: patch-af

   Log Message:
   Update "apache22" package to version 2.2.16. Changes since version 2.2.15:
   - SECURITY: CVE-2010-1452 (cve.mitre.org)
     mod_dav, mod_cache: Fix Handling of requests without a path segment.
     PR: 49246 [Mark Drayton, Jeff Trawick]
   - SECURITY: CVE-2010-2068 (cve.mitre.org)
     mod_proxy_ajp, mod_proxy_http, mod_reqtimeout: Fix timeout detection
     for platforms Windows, Netware and OS2.  PR: 49417. [Rainer Jung]
   - core: Filter init functions are now run strictly once per request
     before handler invocation.  The init functions are no longer run
     for connection filters.  PR 49328.  [Joe Orton]
   - mod_filter: enable it to act on non-200 responses.
     PR 48377 [Nick Kew]
   - mod_ldap: LDAP caching was suppressed (and ldap-status handler returns
     title page only) when any mod_ldap directives were used in VirtualHost
     context.  [Eric Covener]
   - mod_ssl: Fix segfault at startup if proxy client certs are shared
     across multiple vhosts.  PR 39915.  [Joe Orton]
   - mod_proxy_http: Log the port of the remote server in various messages.
     PR 48812. [Igor Gali?? <i galic brainsware org>]
   - apxs: Fix -A and -a options to ignore whitespace in httpd.conf
     [Philip M. Gollucci]
   - mod_dir: add FallbackResource directive, to enable admin to specify
     an action to happen when a URL maps to no file, without resorting
     to ErrorDocument or mod_rewrite.  PR 47184 [Nick Kew]
   - mod_rewrite: Allow to set environment variables without explicitely
     giving a value. [Rainer Jung]

   To generate a diff of this commit:
   cvs rdiff -u -r1.60 -r1.61 pkgsrc/www/apache22/Makefile
   cvs rdiff -u -r1.33 -r1.34 pkgsrc/www/apache22/distinfo
   cvs rdiff -u -r1.3 -r0 pkgsrc/www/apache22/patches/patch-af

Pullup ticket #3189.

Pullup ticket #3189 - requested by tnn
devel/xulrunner: security update
www/firefox: security update

Revisions pulled up:
- devel/xulrunner/dist.mk 1.13
- devel/xulrunner/distinfo 1.35
---
Module Name: pkgsrc
Committed By: tnn
Date: Tue Jul 27 07:58:53 UTC 2010

Modified Files:
pkgsrc/devel/xulrunner: dist.mk distinfo

Log Message:
Update to firefox-3.6.8.
Fixes a heap corruption issue due to free() of garbage pointers when
parsing an invalid <object> tag.

Pullup ticket #3185.

Pullup ticket #3185 - requested by ghen
mail/dovecot: security update

Revisions pulled up:
- mail/dovecot/Makefile 1.150
- mail/dovecot/PLIST 1.28
- mail/dovecot/distinfo 1.112
---
Module Name: pkgsrc
Committed By: ghen
Date: Sun Jul 25 22:17:20 UTC 2010

Modified Files:
pkgsrc/mail/dovecot: Makefile PLIST distinfo

Log Message:
Update Dovecot to 1.2.13.

This release fixes a bug in ACL plugin, which could be considered a security
bug: If Maildir is used with default settings (INBOX is same as Maildir root
dir) and user set some ACLs to INBOX, those ACLs were copied to all newly
created mailboxes. This should have been done only for "default ACLs", but with
Maildir the INBOX directory is the same as the default ACL directory, so this
mixup happened. This bug exists only in v1.2.x releases.

Other fixes:

- Fixed iconv() crash when it was processing several kilobytes of broken
  continuous input. This mainly could have caused a problem with IMAP SEARCH.
  Possibly also with some Sieve checks.
- If MIME encoded-words contained line feeds, Dovecot logged cache corruption
  errors.
- mbox: Renaming mailbox under newly created dir didn't move index directory.
- mbox: When generating envelope to From_-line, don't append a second
  @owndomain if username already has one.

pullups 3181, 3182, 3183 + 3184

Pullup ticket 3183 - requested by ghen
security update

Revisions pulled up:
- pkgsrc/databases/openldap/Makefile 1.135
- pkgsrc/databases/openldap/Makefile.common 1.26
- pkgsrc/databases/openldap/distinfo 1.78
- pkgsrc/databases/openldap-client/PLIST 1.8
- pkgsrc/databases/openldap-cloak/Makefile 1.8
- pkgsrc/databases/openldap-doc/Makefile 1.20
- pkgsrc/databases/openldap-nops/Makefile 1.10
- pkgsrc/databases/openldap-server/Makefile 1.26
- pkgsrc/databases/openldap-smbk5pwd/Makefile 1.8

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   ghen
   Date:           Sat Jul 24 11:15:18 UTC 2010

   Modified Files:
           pkgsrc/databases/openldap: Makefile Makefile.common distinfo
           pkgsrc/databases/openldap-client: PLIST
           pkgsrc/databases/openldap-cloak: Makefile
           pkgsrc/databases/openldap-doc: Makefile
           pkgsrc/databases/openldap-nops: Makefile
           pkgsrc/databases/openldap-server: Makefile
           pkgsrc/databases/openldap-smbk5pwd: Makefile

   Log Message:
   Update to OpenLDAP 2.4.23, now the "stable" release.

   OpenLDAP 2.4.23 Release (2010/06/30)
           Fixed libldap to return server's error code (ITS#6569)
           Fixed libldap memleaks (ITS#6568)
           Fixed liblutil off-by-one with delta (ITS#6541)
           Fixed slapd acls with glued databases (ITS#6468)
           Fixed slapd syncrepl rid logging (ITS#6533)
           Fixed slapd modrdn handling of invalid values (ITS#6570)
           Fixed slapd-bdb hasSubordinates computation (ITS#6549)
           Fixed slapd-bdb to use memcpy instead for strcpy (ITS#6474)
           Fixed slapd-bdb entry cache delete failure (ITS#6577)
           Fixed slapd-ldap to return control responses (ITS#6530)
           Fixed slapo-ppolicy to use Debug (ITS#6566)
           Fixed slapo-refint to zero out freed DN vals (ITS#6572)
           Fixed slapo-rwm to use Debug (ITS#6566)
           Fixed slapo-sssvlv to use Debug (ITS#6566)
           Fixed slapo-syncprov lost deletes in refresh phase (ITS#6555)
           Fixed slapo-valsort to use Debug (ITS#6566)
           Fixed contrib/nssov network.c missing patch (ITS#6562)
           Build Environment
                   Fixed test043 attribute sorting (ITS#6553)
           Documentation
                   slapd-config(5) note default rootdn (ITS#6546)

   OpenLDAP 2.4.22 Release (2010/04/24)
           Added slapd SLAP_SCHEMA_EXPOSE flag for hidden schema elements (ITS#6435)
           Added slapd tools selective iterations (ITS#6442)
           Added slapd syncrepl TCP keepalive (ITS#6389)
           Added slapo-ldap idassert-passthru (ITS#6456)
           Added slapo-pbind
           Fixed libldap gmtime re-entrancy (ITS#6262)
           Fixed libldap gssapi off by one error (ITS#6223)
           Fixed libldap GnuTLS serial length (ITS#6460)
           Fixed libldap MozNSS context and PEM support (ITS#6432)
           Fixed libldap referral on bind behavior(ITS#6510)
           Fixed slapd acl non-entry internal searches (ITS#6481)
           Fixed slapd acl attrval style initialization (ITS#6520)
           Fixed slapd certificateListValidate (ITS#6466)
           Fixed slapd empty URI parsing (ITS#6465)
           Fixed slapd glued misplaced entries (ITS#6506)
           Fixed slapd glued paged cookies (ITS#6507)
           Fixed slapd glued paged results (ITS#6504)
           Fixed slapd gmtime re-entrancy (ITS#6262)
           Fixed slapd to ignore controls with unrecognized flags (ITS#6480)
           Fixed slapd entry ownership (ITS#5340)
           Fixed slapd sasl auxprop_lookup (ITS#6441)
           Fixed slapd sasl auxprop ssf (ITS#5195)
           Fixed slapd syncrepl for attributes with no matching rule (ITS#6458)
           Fixed slapd syncrepl for unknown attrs and delta-sync (ITS#6473)
           Fixed slapd syncrepl loop with moddn (ITS#6472)
           Fixed slapo-accesslog to not replicate internal purges (ITS#6519)
           Fixed slapd-bdb contextCSN updates from updatedn (ITS#6469)
           Fixed slapd-bdb lockobj zeroing (ITS#6501)
           Fixed slapd-ldap/meta control criticality (ITS#6523)
           Fixed slapd-ldap/meta with ordered values (ITS#6516)
           Fixed slapo-collect entry ownership (ITS#5340,ITS#6423)
           Fixed slapo-dds with NULL backend (ITS#6490)
           Fixed slapo-dynlist entry ownership (ITS#5340,ITS#6423)
           Fixed slapo-memberof attr count (ITS#6508)
           Fixed slapo-pcache to release its own entries (ITS#6484)
           Fixed slapo-pcache with NULL backend (ITS#6490)
           Fixed slapo-rwm entry release handling (ITS#6484)
           Fixed slapo-rwm memory handling with rewrites (ITS#6526)
           Fixed slapo-rwm olcRwmMap handling (ITS#6436)
           Fixed slapo-rwm entry ownership (ITS#5340,ITS#6423)
           Fixed slapo-syncprov memory leak (ITS#6459)
           Fixed slapo-translucent counter increment (ITS#6497)
           Fixed slapo-valsort entry ownership (ITS#5340,ITS#6423)
           Fixed contrib/sha2 adds mechs for more hashes (ITS#6433)
           Fixed contrib/nssov to use nss-pam-ldapd (ITS#6488)
           Build Environment
                   Added back-ldif, back-null test support (ITS#5810)
           Documentation
                   admin24 avoid explicit moduleload statements (ITS#6486)
                   admin24 broken link fixes (ITS#6493,ITS#6515)
                   slapd.access(5) val.regex explanation (ITS#5804)

   To generate a diff of this commit:
   cvs rdiff -u -r1.134 -r1.135 pkgsrc/databases/openldap/Makefile
   cvs rdiff -u -r1.25 -r1.26 pkgsrc/databases/openldap/Makefile.common
   cvs rdiff -u -r1.77 -r1.78 pkgsrc/databases/openldap/distinfo
   cvs rdiff -u -r1.7 -r1.8 pkgsrc/databases/openldap-client/PLIST
   cvs rdiff -u -r1.7 -r1.8 pkgsrc/databases/openldap-cloak/Makefile
   cvs rdiff -u -r1.19 -r1.20 pkgsrc/databases/openldap-doc/Makefile
   cvs rdiff -u -r1.9 -r1.10 pkgsrc/databases/openldap-nops/Makefile
   cvs rdiff -u -r1.25 -r1.26 pkgsrc/databases/openldap-server/Makefile
   cvs rdiff -u -r1.7 -r1.8 pkgsrc/databases/openldap-smbk5pwd/Makefile

Pullup ticket 3182 - requested by tron
security patch

Revisions pulled up:
- pkgsrc/audio/pulseaudio/Makefile 1.38
- pkgsrc/audio/pulseaudio/distinfo 1.21

Files added:
pkgsrc/audio/pulseaudio/patches/patch-ba
pkgsrc/audio/pulseaudio/patches/patch-bb

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Jul 24 12:51:09 UTC 2010

   Modified Files:
           pkgsrc/audio/pulseaudio: Makefile distinfo
   Added Files:
           pkgsrc/audio/pulseaudio/patches: patch-ba patch-bb

   Log Message:
   Add fix for symlink race reported in CVE-2009-1299 taken from
   Lennart Poettering's GIT repository.

   To generate a diff of this commit:
   cvs rdiff -u -r1.37 -r1.38 pkgsrc/audio/pulseaudio/Makefile
   cvs rdiff -u -r1.20 -r1.21 pkgsrc/audio/pulseaudio/distinfo
   cvs rdiff -u -r0 -r1.6 pkgsrc/audio/pulseaudio/patches/patch-ba
   cvs rdiff -u -r0 -r1.5 pkgsrc/audio/pulseaudio/patches/patch-bb

Pullup ticket 3184 - requested by tron
security updates

Revisions pulled up:
- pkgsrc/lang/php5/Makefile 1.79
- pkgsrc/lang/php5/distinf 1.79
- pkgsrc/lang/php5/Makefile.common 1.42
- pkgsrc/lang/php5/Makefile.ph 1.42
- pkgsrc/lang/php53/Makefile 1.4
- pkgsrc/lang/php53/Makefile.common 1.2
- pkgsrc/lang/php53/Makefile.php 1.3
- pkgsrc/lang/php53/distinfo 1.6
- pkgsrc/lang/php53/patches/patch-ab 1.2
- pkgsrc/converters/php-mbstring/Makefile 1.2
- pkgsrc/devel/php-gmp/Makefile 1.12
- pkgsrc/graphics/php-gd/Makefile 1.24
- pkgsrc/multimedia/php-ming/Makefile 1.11
- pkgsrc/net/php-xmlrpc/Makefile 1.13
- pkgsrc/net/php-yaz/Makefile 1.9
- pkgsrc/print/php-pdflib/Makefile 1.17

Files deleted:
pkgsrc/lang/php5/patches/patch-be
pkgsrc/lang/php53/patches/patch-ak

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Jul 24 22:23:15 UTC 2010

   Modified Files:
           pkgsrc/lang/php5: Makefile Makefile.common Makefile.php distinfo
   Removed Files:
           pkgsrc/lang/php5/patches: patch-be

   Log Message:
   Update "php5" package to version 5.2.14. Changes since version 5.2.13:
   - Reverted bug fix #49521 (PDO fetchObject sets values before calling
     constructor). (Felipe)
   - Updated timezone database to version 2010.5. (Derick)
   - Upgraded bundled PCRE to version 8.02. (Ilia)
   - Rewrote var_export() to use smart_str rather than output buffering, prevents
     data disclosure if a fatal error occurs (CVE-2010-2531). (Scott)
   - Fixed a possible interruption array leak in strrchr(). Reported by
     P??ter Veres. (CVE-2010-2484) (Felipe)
   - Fixed a possible interruption array leak in strchr(), strstr(), substr(),
     chunk_split(), strtok(), addcslashes(), str_repeat(), trim(). (Felipe)
   - Fixed a possible memory corruption in substr_replace() (Dmitry)
   - Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas)
   - Fixed a possible stack exaustion inside fnmatch(). Reporeted by Stefan
     Esser (Ilia)
   - Reset error state in PDO::beginTransaction() reset error state. (Ilia)
   - Fixed a NULL pointer dereference when processing invalid XML-RPC
     requests (Fixes CVE-2010-0397, bug #51288). (Raphael Geissert)
   - Fixed handling of session variable serialization on certain prefix
     characters. Reported by Stefan Esser (Ilia)
   - Fixed a possible arbitrary memory access inside sqlite extension. Reported
     by Mateusz Kocielski. (Ilia)
   - Fixed a crash when calling an inexistent method of a class that inherits
     PDOStatement if instantiated directly instead of doing by the PDO methods.
     (Felipe)
   - Fixed bug #52317 (Segmentation fault when using mail() on a rhel 4.x (only 64
     bit)). (Adam)
   - Fixed bug #52238 (Crash when an Exception occured in iterator_to_array).
     (Johannes)
   - Fixed bug #52237 (Crash when passing the reference of the property of a
     non-object). (Dmitry)
   - Fixed bug #52163 (SplFileObject::fgetss() fails due to parameter that can't
     be set). (Felipe)
   - Fixed bug #52162 (custom request header variables with numbers are removed).
     (Sriram Natarajan)
   - Fixed bug #52160 (Invalid E_STRICT redefined constructor error). (Felipe)
   - Fixed bug #52061 (memory_limit above 2G). (Felipe)
   - Fixed bug #52041 (Memory leak when writing on uninitialized variable returned
     from function). (Dmitry)
   - Fixed bug #52037 (Concurrent builds fail in install-programs). (seanius at
     debian dot org, Kalle)
   - Fixed bug #52019 (make lcov doesn't support TESTS variable anymore). (Patrick)
   - Fixed bug #52010 (open_basedir restrictions mismatch on vacuum command).
     (Ilia, Felipe)
   - Fixed bug #51943 (AIX: Several files are out of ANSI spec). (Kalle,
     coreystup at gmail dot com)
   - Fixed bug #51911 (ReflectionParameter::getDefaultValue() memory leaks with
     constant array). (Felipe)
   - Fixed bug #51905 (ReflectionParameter fails if default value is an array
     with an access to self::). (Felipe)
   - Fixed bug #51822 (Segfault with strange __destruct() for static class
     variables). (Dmitry)
   - Fixed bug #51671 (imagefill does not work correctly for small images).
     (Pierre)
   - Fixed bug #51670 (getColumnMeta causes segfault when re-executing query
     after calling nextRowset). (Pierrick)
   - Fixed bug #51629 (CURLOPT_FOLLOWLOCATION error message is misleading).
     (Pierre)
   - Fixed bug #51617 (PDO PGSQL still broken against PostGreSQL < 7.4).
     (Felipe, wdierkes at 5dollarwhitebox dot org)
   - Fixed bug #51615 (PHP crash with wrong HTML in SimpleXML). (Felipe)
   - Fixed bug #51609 (pg_copy_to: Invalid results when using fourth parameter).
     (Felipe)
   - Fixed bug #51608 (pg_copy_to: WARNING: nonstandard use of \\ in a string
     literal). (cbandy at jbandy dot com)
   - Fixed bug #51607 (pg_copy_from does not allow schema in the tablename
     argument). (cbandy at jbandy dot com)
   - Fixed bug #51604 (newline in end of header is shown in start of message).
     (Daniel Egeberg)
   - Fixed bug #51562 (query timeout in mssql can not be changed per query).
     (ejsmont dot artur at gmail dot com)
   - Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory
     issues). (Dmitry)
   - Fixed bug #51532 (Wrong prototype for SplFileObject::fscanf()). (Etienne)
   - Fixed bug #51445 (var_dump() invalid/slow *RECURSION* detection). (Felipe)
   - Fixed bug #51393 (DateTime::createFromFormat() fails if format string contains
     timezone). (Adam)
   - Fixed bug #51374 (Wrongly initialized object properties). (Etienne)
   - Fixed bug #51338 (URL-Rewriter is still enabled if use_only_cookies is
     on). (Ilia, j dot jeising at gmail dot com)
   - Fixed bug #51273 (Faultstring property does not exist when the faultstring is
     empty) (Ilia, dennis at transip dot nl)
   - Fixed bug #51269 (zlib.output_compression Overwrites Vary Header). (Adam)
   - Fixed bug #51263 (imagettftext and rotated text uses wrong baseline)
     (cschneid at cschneid dot com, Takeshi Abe)
   - Fixed bug #51237 (milter SAPI crash on startup). (igmar at palsenberg dot com)
   - Fixed bug #51213 (pdo_mssql is trimming value of the money column). (Ilia,
     alexr at oplot dot com)
   - Fixed bug #51192 (FILTER_VALIDATE_URL will invalidate a hostname that
     includes '-'). (Adam, solar at azrael dot ws).
   - Fixed bug #51190 (ftp_put() returns false when transfer was successful).
     (Ilia)
   - Fixed bug #51183 (ext/date/php_date.c fails to compile with Sun Studio).
     (Sriram Natarajan)
   - Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when
     an invalid option is provided). (Ilia)
   - Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre)
   - Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)
   - Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries). (Chris
     Jones)
   - Fixed bug #51023 (filter doesn't detect int overflows with GCC 4.4).
     (Raphael Geissert)
   - Fixed bug #50762 (in WSDL mode Soap Header handler function only being called
     if defined in WSDL). (mephius at gmail dot com)
   - Fixed bug #50698 (SoapClient should handle wsdls with some incompatiable
     endpoints). (Justin Dearing)
   - Fixed bug #50383 (Exceptions thrown in __call() / __callStatic() do not
     include file and line in trace). (Felipe)
   - Fixed bug #49730 (Firebird - new PDO() returns NULL). (Felipe)
   - Fixed bug #49723 (LimitIterator with empty SeekableIterator). (Etienne)
   - Fixed bug #49576 (FILTER_VALIDATE_EMAIL filter needs updating) (Rasmus)
   - Fixed bug #49320 (PDO returns null when SQLite connection fails). (Felipe)
   - Fixed bug #49267 (Linking fails for iconv). (Moriyosh)
   - Fixed bug #48601 (xpath() returns FALSE for legitimate query). (Rob)
   - Fixed bug #48289 (iconv_mime_encode() quoted-printable scheme is broken).
     (Adam, patch from hiroaki dot kawai at gmail dot com).
   - Fixed bug #43314 (iconv_mime_encode(), broken Q scheme). (Rasmus)
   - Fixed bug #33210 (getimagesize() fails to detect width/height on certain
     JPEGs). (Ilia)
   - Fixed bug #23229 (syslog() truncates messages). (Adam)

   To generate a diff of this commit:
   cvs rdiff -u -r1.78 -r1.79 pkgsrc/lang/php5/Makefile \
       pkgsrc/lang/php5/distinfo
   cvs rdiff -u -r1.41 -r1.42 pkgsrc/lang/php5/Makefile.common \
       pkgsrc/lang/php5/Makefile.php
   cvs rdiff -u -r1.1 -r0 pkgsrc/lang/php5/patches/patch-be

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Jul 24 22:23:37 UTC 2010

   Modified Files:
           pkgsrc/lang/php53: Makefile Makefile.common Makefile.php distinfo
           pkgsrc/lang/php53/patches: patch-ab
   Removed Files:
           pkgsrc/lang/php53/patches: patch-ak

   Log Message:
   Update "php53" package to version 5.3.3. Changes since version 5.3.2:
   - Rewrote var_export() to use smart_str rather than output buffering,
     prevents data disclosure if a fatal error occurs (CVE-2010-2531).
     (Scott)
   - Fixed a NULL pointer dereference when processing invalid XML-RPC
     requests (Fixes CVE-2010-0397, bug #51288). (Raphael Geissert)
   - Fixed SplObjectStorage unserialization problems (CVE-2010-2225).
     (Stas)
   - A large number of not security related bug fixes

   To generate a diff of this commit:
   cvs rdiff -u -r1.3 -r1.4 pkgsrc/lang/php53/Makefile
   cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/lang/php53/Makefile.common
   cvs rdiff -u -r1.2 -r1.3 pkgsrc/lang/php53/Makefile.php
   cvs rdiff -u -r1.5 -r1.6 pkgsrc/lang/php53/distinfo
   cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/lang/php53/patches/patch-ab
   cvs rdiff -u -r1.1 -r0 pkgsrc/lang/php53/patches/patch-ak

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Jul 24 22:24:22 UTC 2010

   Modified Files:
           pkgsrc/converters/php-mbstring: Makefile
           pkgsrc/devel/php-gmp: Makefile
           pkgsrc/graphics/php-gd: Makefile
           pkgsrc/multimedia/php-ming: Makefile
           pkgsrc/net/php-xmlrpc: Makefile
           pkgsrc/net/php-yaz: Makefile
           pkgsrc/print/php-pdflib: Makefile

   Log Message:
   Revert revision of several PHP extensions after both core PHP packages
   were updated.

   To generate a diff of this commit:
   cvs rdiff -u -r1.1.1.1 -r1.2 pkgsrc/converters/php-mbstring/Makefile
   cvs rdiff -u -r1.11 -r1.12 pkgsrc/devel/php-gmp/Makefile
   cvs rdiff -u -r1.23 -r1.24 pkgsrc/graphics/php-gd/Makefile
   cvs rdiff -u -r1.10 -r1.11 pkgsrc/multimedia/php-ming/Makefile
   cvs rdiff -u -r1.12 -r1.13 pkgsrc/net/php-xmlrpc/Makefile
   cvs rdiff -u -r1.8 -r1.9 pkgsrc/net/php-yaz/Makefile
   cvs rdiff -u -r1.16 -r1.17 pkgsrc/print/php-pdflib/Makefile

Pullup ticket 3181 - requested by tron
security update

Revisions pulled up:
- pkgsrc/mail/squirrelmail/Makefile 1.115
- pkgsrc/mail/squirrelmail/PLIST 1.37
- pkgsrc/mail/squirrelmail/distinfo 1.60

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   tron
   Date:           Sat Jul 24 12:20:34 UTC 2010

   Modified Files:
           pkgsrc/mail/squirrelmail: Makefile PLIST distinfo

   Log Message:
   Update "squirremail" package to version 1.4.21. Changes since 1.4.20:
   - Now allow more than one plugin to control the compose form submit action.
   - When sorting by received date, the received date is now shown on the
     message list.
   - Explicitly disable browser caching for left_main and right_main pages
     (#2983134).
   - Fix error with SpamCop reporting plugin not being able to send report as
     emails (#1795310).
   - Fix typo in SpamCop plugin.
   - Reduced default time security tokens stay valid from 30 days to 2 days
     (reduces chances of session data growing too large)
   - Several speed enhancements for recent fixes regarding the display of
     encoded subjects, including a fix for messages with invalid subject
     encoding (includes #2987016 amongst several other issues reported via
     mailing list, etc.) (Many thanks to Zdenek Pytela for the untiring help
     diagnosing and testing.)
   - Fixed minor vulnerability in Mail Fetch plugin.
     [CVE-2010-1637/TEHTRI-SA-2010-009]
   - Now properly quote personal part of encoded addresses when replying.
   - Now fill in default subject when forwarding as attachment (#2936541).
   - Implement header folding that doesn't add extraneous spaces so unfolding
     is less ambiguous (#1951776).
   - Fixed issues caused by use of PostgreSQL keyword "user" in SquirrelMail's
     default preferences database schema (#2943483).
   - Fixed attachment filename decoding problems (#2994865).
   - Now default search criteria to the TO header when searching the sent fold=
   er.
   - Fixed literal processing of 8-bit usernames/passwords during login.
     [CVE-2010-2813]

   To generate a diff of this commit:
   cvs rdiff -u -r1.114 -r1.115 pkgsrc/mail/squirrelmail/Makefile
   cvs rdiff -u -r1.36 -r1.37 pkgsrc/mail/squirrelmail/PLIST
   cvs rdiff -u -r1.59 -r1.60 pkgsrc/mail/squirrelmail/distinfo

Pullup tickets #3176, #3177, #3178 and #3179.

Pullup ticket #3179 - requested by tnn
mail/thunderbird: security update and build fix

Revisions pulled up:
- mail/thunderbird/Makefile patch
- mail/thunderbird/distinfo patch
- mail/thunderbird/patches/patch-directory_c-sdk_configure.in new file
- mail/thunderbird/patches/patch-directory_c-sdk_ldap_include_portable.h new file
- mail/thunderbird/patches/patch-directory_c-sdk_ldap_libraries_libldap_Makefile.in new file
- mail/thunderbird/patches/patch-mp patch
---
Fix the following security vulnerabilities:

MFSA 2010-47 Cross-origin data leakage from script filename in error messages
MFSA 2010-46 Cross-domain data theft using CSS
MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts
MFSA 2010-41 Remote code execution using malformed PNG image
MFSA 2010-40 nsTreeSelection dangling pointer remote code execution
MFSA 2010-39 nsCSSValue::Array index integer overflow
MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)

Pullup ticket #3178 - requested by tnn
www/seamonkey: security update and build fix

Revisions pulled up:
- www/seamonkey/Makefile 1.38
- www/seamonkey/distinfo 1.51-1.54
- www/seamonkey/patches/patch-directory_c-sdk_configure.in 1.1-1.2
- www/seamonkey/patches/patch-directory_c-sdk_ldap_include_portable.h 1.1-1.3
- www/seamonkey/patches/patch-directory_c-sdk_ldap_libraries_libldap_Makefile.in 1.1-1.2
- www/seamonkey/patches/patch-mp 1.2
---
Module Name: pkgsrc
Committed By: tnn
Date: Mon Jul 12 11:57:00 UTC 2010

Modified Files:
pkgsrc/www/seamonkey: distinfo
Added Files:
pkgsrc/www/seamonkey/patches: patch-directory_c-sdk_configure.in
    patch-directory_c-sdk_ldap_include_portable.h
    patch-directory_c-sdk_ldap_libraries_libldap_Makefile.in

Log Message:
Add some DragonFlyBSD fixes, contributed by Francois Tigeot.
---
Module Name: pkgsrc
Committed By: tnn
Date: Mon Jul 12 13:57:29 UTC 2010

Modified Files:
pkgsrc/www/seamonkey: distinfo
pkgsrc/www/seamonkey/patches: patch-directory_c-sdk_configure.in
    patch-directory_c-sdk_ldap_include_portable.h
    patch-directory_c-sdk_ldap_libraries_libldap_Makefile.in

Log Message:
Add upstream bug ref.
---
Module Name: pkgsrc
Committed By: tnn
Date: Wed Jul 21 11:48:06 UTC 2010

Modified Files:
pkgsrc/www/seamonkey: distinfo
pkgsrc/www/seamonkey/patches:
    patch-directory_c-sdk_ldap_include_portable.h

Log Message:
Fix undefined reference to re_comp/re_exec on dragonfly.
Reported by Francois Tigeot.
---
Module Name: pkgsrc
Committed By: tnn
Date: Wed Jul 21 18:25:06 UTC 2010

Modified Files:
pkgsrc/www/seamonkey: Makefile distinfo
pkgsrc/www/seamonkey/patches: patch-mp

Log Message:
Update to seamonkey-2.0.6

MFSA 2010-47 Cross-origin data leakage from script filename in error messages
MFSA 2010-46 Cross-domain data theft using CSS
MFSA 2010-45 Multiple location bar spoofing vulnerabilities
MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts
MFSA 2010-41 Remote code execution using malformed PNG image
MFSA 2010-40 nsTreeSelection dangling pointer remote code execution
MFSA 2010-39 nsCSSValue::Array index integer overflow
MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution
MFSA 2010-36 Use-after-free error in NodeIterator
MFSA 2010-35 DOM attribute cloning remote code execution vulnerability
MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)

Pullup ticket #3177 - requested by tnn
devel/xulrunner: security update
www/firefox: security update

Revisions pulled up:
- devel/xulrunner/PLIST 1.23
- devel/xulrunner/dist.mk 1.12
- devel/xulrunner/distinfo 1.34
- devel/xulrunner/patches/patch-bc delete
- devel/xulrunner/patches/patch-mp 1.4
---
Module Name: pkgsrc
Committed By: tnn
Date: Wed Jul 21 16:55:34 UTC 2010

Modified Files:
pkgsrc/devel/xulrunner: PLIST dist.mk distinfo
pkgsrc/devel/xulrunner/patches: patch-mp
Removed Files:
pkgsrc/devel/xulrunner/patches: patch-bc

Log Message:
firefox-3.6.7 / xulrunner-1.9.2.7 security update.

MFSA 2010-47 Cross-origin data leakage from script filename in error
messages MFSA 2010-46 Cross-domain data theft using CSS
MFSA 2010-45 Multiple location bar spoofing vulnerabilities
MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause
subsequent character to vanish
MFSA 2010-43 Same-origin bypass using canvas context
MFSA 2010-42 Cross-origin data disclosure via Web Workers and
importScripts MFSA 2010-41 Remote code execution using malformed PNG
image MFSA 2010-40 nsTreeSelection dangling pointer remote code
execution MFSA 2010-39 nsCSSValue::Array index integer overflow
MFSA 2010-38 Arbitrary code execution using SJOW and fast native
function MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays
remote code execution MFSA 2010-36 Use-after-free error in NodeIterator
MFSA 2010-35 DOM attribute cloning remote code execution vulnerability
MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)

Pullup ticket #3176 - requested by sbd
misc/rpm: build fix

Revisions pulled up:
- misc/rpm/Makefile 1.71
---
Module Name: pkgsrc
Committed By: sbd
Date: Wed Jul 21 22:29:36 UTC 2010

Modified Files:
pkgsrc/misc/rpm: Makefile

Log Message:
If db4 is selected as the DBD_TYPE then PTHEADS_LDFLAGS is needed for linking.

pullup #3173

Pullup ticket 3173 - requested by drochner
security update

Revisions pulled up:
- pkgsrc/graphics/freetype2/Makefile 1.73
- pkgsrc/graphics/freetype2/distinfo 1.35

-------------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Tue Jul 20 11:44:15 UTC 2010

   Modified Files:
           pkgsrc/graphics/freetype2: Makefile distinfo

   Log Message:
   update to 2.4.1
   changes:
   - Since May  2010, all  patents  regarding  the TrueType  bytecode
     interpreter have expired worldwide.  Consequently, we now define
     TT_CONFIG_OPTION_BYTECODE_INTERPRETER by  default (and  undefine
     TT_CONFIG_OPTION_UNPATENTED_HINTING).
   - A new function `FT_Library_SetLcdFilterWeights' is available  to
     adjust the filter weights set by `FT_Library_SetLcdFilter'.
   -increased robustness, bugfixes

   pkgsrc note: the "truetype" option was removed, the bytecode interpreter
   is now always enabled

   To generate a diff of this commit:
   cvs rdiff -u -r1.72 -r1.73 pkgsrc/graphics/freetype2/Makefile
   cvs rdiff -u -r1.34 -r1.35 pkgsrc/graphics/freetype2/distinfo

Pullup ticket #3164.

Pullup ticket #3164 - requested by sbd
print/cups: build fix

Revisions pulled up:
- print/cups/Makefile 1.168
- print/cups/distinfo 1.75
- print/cups/patches/patch-bd 1.5
---
Module Name: pkgsrc
Committed By: sbd
Date: Tue Jul 13 10:59:43 UTC 2010

Modified Files:
pkgsrc/print/cups: Makefile distinfo
pkgsrc/print/cups/patches: patch-bd

Log Message:
the st_gen member of stat(2) is a BSD extension

Pullup ticket #3162.