Pullup ticket #3778 - requested by obache
multimedia/adobe-flash-plugin11: security update

Revisions pulled up:
- multimedia/adobe-flash-plugin11/Makefile                      1.5
- multimedia/adobe-flash-plugin11/distinfo                      1.5

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Wed May  9 11:44:27 UTC 2012

   Modified Files:
   	pkgsrc/multimedia/adobe-flash-plugin11: Makefile distinfo

   Log Message:
   Update adobe-flash-plugin11 to 11.2.202.235, for resolve APSB12-09.
Pullup ticket #3779 - requested by obache
multimedia/adobe-flash-plugin10.1: security update

Revisions pulled up:
- multimedia/adobe-flash-plugin10.1/Makefile                    1.18
- multimedia/adobe-flash-plugin10.1/distinfo                    1.10

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Wed May  9 11:54:15 UTC 2012

   Modified Files:
   	pkgsrc/multimedia/adobe-flash-plugin10.1: Makefile distinfo

   Log Message:
   Update adobe-flash-plugin10.1 to 10.3.183.19, to resolve APSB12-09.
Pullup tickets #3778 and #3779.
Pullup ticket #3780 - requested by obache
www/opera security update

Revisions pulled up:
- www/opera/Makefile                                            1.95
- www/opera/distinfo                                            1.38

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Fri May 11 09:40:12 UTC 2012

   Modified Files:
   	pkgsrc/www/opera: Makefile distinfo

   Log Message:
   Update Opera to 11.64.

   Release date: 2012-05-10

     Opera 11.64 is a recommended upgrade offering security and stability enhancements.

   Fixes and Stability Enhancements since Opera 11.62

   General and User Interface
     * Stability improvements
     * Resolved a handshake failure on https://autoupdate.opera.com
   Network and Site-Specific
     * Fixed an error where an on-demand-plugin placeholder could lower the security
       status of a secure site to insecure
     * Fixed an issue with some secure pages not loading - PayPal, Ebay
     * dojotoolkit.org: Errors when using the dojo amd loader have been resolved
     * rts.rs: A JavaScript error has been resolved
   Security
     * Fixed an issue where certain URL constructs could allow arbitrary code
       execution, as reported by Andrey Stroganov; see our advisory:
         http://www.opera.com/support/kb/view/1016/
Pullup ticket 3780
Pullup ticket #3781 - requested by ryoon
misc/php-orangehrm: security update

Revisions pulled up:
- misc/php-orangehrm/MESSAGE                                    1.2
- misc/php-orangehrm/Makefile                                   1.2
- misc/php-orangehrm/PLIST                                      1.2
- misc/php-orangehrm/distinfo                                   1.2

---
   Module Name:	pkgsrc
   Committed By:	ryoon
   Date:		Fri May 11 10:41:27 UTC 2012

   Modified Files:
   	pkgsrc/misc/php-orangehrm: MESSAGE Makefile PLIST distinfo

   Log Message:
   Update to 2.7

   * Add dependency to php-mysqli

   Changelog:
   2.7
   * Language translation and date format support for all modules.
   * Ability to switch on/off modules.
   * Upgraders up to version 2.6.5.
   * Removal of Benefits module.
   * bugfixes

   2.7-rc.1
   * Language translation and date format support for all modules except
     Benefits module.
   * Ability to switch on/off modules.
   * bugfixes

   2.6.12.1
   * bugfixes

   In detail, see new_changed_features.txt, but no security bug information
   is provided.
Pullup ticket #3782 - requested by taca
security/openssl: security update

Revisions pulled up:
- security/openssl/Makefile                                     1.167
- security/openssl/distinfo                                     1.89

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri May 11 13:27:27 UTC 2012

   Modified Files:
   	pkgsrc/security/openssl: Makefile distinfo

   Log Message:
   Update openssl to 0.9.8x.

    OpenSSL CHANGES
    _______________

    Changes between 0.9.8w and 0.9.8x [10 May 2012]

     *) Sanity check record length before skipping explicit IV in DTLS
        to fix DoS attack.

        Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
        fuzzing as a service testing platform.
        (CVE-2012-2333)
        [Steve Henson]

     *) Initialise tkeylen properly when encrypting CMS messages.
        Thanks to Solar Designer of Openwall for reporting this issue.
        [Steve Henson]
Pullup tickets #3781 and #3782.
Pullup ticket #3783 - requested by dholland
net/netatalk: quota support fix

Revisions pulled up:
- net/netatalk/Makefile                                         1.83
- net/netatalk/distinfo                                         1.45
- net/netatalk/patches/patch-aa                                 1.24
- net/netatalk/patches/patch-etc_afpd_quota_c                   1.2
- net/netatalk/patches/patch-macros_quota-check.m4              1.2

---
   Module Name:	pkgsrc
   Committed By:	dholland
   Date:		Sat May 12 21:53:20 UTC 2012

   Modified Files:
   	pkgsrc/net/netatalk: Makefile distinfo
   	pkgsrc/net/netatalk/patches: patch-aa patch-etc_afpd_quota_c
   	    patch-macros_quota-check.m4

   Log Message:
   PR 46072: netatalk broken with netbsd-6 quotas

   Add support for the new libquota. Drop support for the proplib
   libquota; it's not worth the configure-time hassle.

   Fix some moderately serious bugs in the original/previous libquota
   patches; it's clear for example they were never tested with group
   quotas.
Pullup ticket #3784 - requested by dholland
sysutils/ruby-quota: build fix

Revisions pulled up:
- sysutils/ruby-quota/distinfo                                  1.15
- sysutils/ruby-quota/patches/patch-aa                          1.3
- sysutils/ruby-quota/patches/patch-ab                          1.10

---
   Module Name:	pkgsrc
   Committed By:	dholland
   Date:		Sat May 12 23:10:30 UTC 2012

   Modified Files:
   	pkgsrc/sysutils/ruby-quota: distinfo
   	pkgsrc/sysutils/ruby-quota/patches: patch-aa patch-ab

   Log Message:
   Fix build on netbsd-6 and up.
Pullup ticket #3785 - requested by dholland
sysutils/setquota: mark as broken for NetBSD 6.0 and newer

Revisions pulled up:
- sysutils/setquota/Makefile                                    1.14

---
   Module Name:	pkgsrc
   Committed By:	dholland
   Date:		Sat May 12 22:08:24 UTC 2012

   Modified Files:
   	pkgsrc/sysutils/setquota: Makefile

   Log Message:
   Mark this as NOT_FOR_PLATFORM on netbsd-6 and up. It is based on the
   historical quota API and has no internal abstractions, so it would
   require pretty much a total rewrite for the new quota API. This could
   be done, of course. Contact me if there's any interest.
Pullup tickets #3783, #3784 and #785.
Pullup ticket #3787 - requested by taca
databases/mysql55-client: security update
databases/mysql55-server: security update

Revisions pulled up:
- databases/mysql55-client/Makefile.common                      1.16-1.18
- databases/mysql55-client/distinfo                             1.13-1.15
- databases/mysql55-server/PLIST                                1.14-1.16

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Sun Apr  8 18:30:27 UTC 2012

   Modified Files:
   	pkgsrc/databases/mysql55-client: Makefile.common distinfo
   	pkgsrc/databases/mysql55-server: PLIST

   Log Message:
   Changes 5.5.22:
   * InnoDB Storage Engine: A deprecation warning is now issued when
     --ignore-builtin-innodb is used.
   * yaSSL was upgraded from version 1.7.2 to 2.2.0.
   * Security Fix: Bug 13510739 and Bug 63775 were fixed.
   * Important Change: InnoDB Storage Engine: When a row grew in size due to an
     UPDATE operation, other (non-updated) columns could be moved to off-page
     storage so that information about the row still fit within the constraints of
     the InnoDB page size. The pointer to the new allocated off-page data was not
     set up until the pages were allocated and written, potentially leading to
     lost data if the system crashed while the column was being moved out of the
     page. The problem was more common with tables using ROW_FORMAT=DYNAMIC or
     ROW_FORMAT=COMPRESSED along with the Barracuda file format, particularly with
     the innodb_file_per_table setting enabled, because page allocation operations
     are more common as the .ibd tablespace files are extended. Still, the problem
     could occur with any combination of InnoDB version, file format, and row
     format.
   * InnoDB Storage Engine: An erroneous assertion could occur, in debug builds
     only, when creating an index on a column containing zero-length values (that
     is, '').
   * InnoDB Storage Engine: A DDL operation such as ALTER TABLE ... ADD COLUMN
     could stall, eventually timing out with an Error 1005: Can't create table
     message referring to fil_rename_tablespace.
   * InnoDB Storage Engine: A DDL operation for an InnoDB table could cause a busy
     MySQL server to halt with an assertion error:
   More...

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Sat Apr 14 12:10:05 UTC 2012

   Modified Files:
   	pkgsrc/databases/mysql55-client: Makefile.common distinfo
   	pkgsrc/databases/mysql55-server: PLIST

   Log Message:
   Changes 5.5.23:
   Bugs Fixed
   * Security Fix: Bug 59533 was fixed.
   * Performance: Partitioning: InnoDB Storage Engine: The statistics used by the
     optimizer for queries against partitioned InnoDB tables were based only on the
     first partition of each such table, leading to use of the wrong execution
     plan.
   * References: This bug was introduced by Bug 11756867.
   * Performance: InnoDB Storage Engine: Improved the performance of the DROP TABLE
     statement for InnoDB tables, especially on systems with a large buffer pool.
     The fix speeds up the processing for freeing entries in the adaptive hash
     index.
   * InnoDB Storage Engine: Deleting a huge amount of data from InnoDB tables
     within a short time could cause the purge operation that flushes data from the
     buffer pool to stall. If this issue occurs, restart the server to work around
     it. This issue is only likely to occur on 32-bit platforms.
   * InnoDB Storage Engine: If the server crashed during a TRUNCATE TABLE or CREATE
     INDEX statement for an InnoDB table, or a DROP DATABASE statement for
     a database containing InnoDB tables, an index could be corrupted, causing an
     error message when accessing the table after restart:
     InnoDB: Error: trying to load index index_name for table table_name
     InnoDB: but the index tree has been freed!
     In MySQL 5.1, this fix applies to the InnoDB Plugin, but not the built-in
     InnoDB storage engine.
   * InnoDB Storage Engine: When data was removed from an InnoDB table, newly
     inserted data might not reuse the freed disk blocks, leading to an unexpected
     size increase for the system tablespace or .ibd file (depending on the
     setting of innodb_file_per_table. The OPTIMIZE TABLE could compact a .ibd file
     in some cases but not others. The freed disk blocks would eventually be
     reused as additional data was inserted.
   More...

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun May 13 13:05:33 UTC 2012

   Modified Files:
   	pkgsrc/databases/mysql55-client: Makefile.common distinfo
   	pkgsrc/databases/mysql55-server: PLIST

   Log Message:
   Update mysql55-{client,server} to 5.55.24.

   Changes (http://dev.mysql.com/doc/refman/5.5/en/news-5-5-24.html):

   Functionality Added or Changed

       * Important Change: Replication: INSERT ON DUPLICATE KEY UPDATE is now
         marked as unsafe for statement-based replication if the target table has
         more than one primary or unique key. For more information, see Section
         16.1.2.3, "Determination of Safe and Unsafe Statements in Binary
         Logging".

   Bugs Fixed

       * Security Fix: Bug #64884 was fixed.

       * InnoDB: Replication: When binary log statements were replayed on the
         slave, the Com_insert, Com_update, and Com_delete counters were
         incremented by BEGIN statements initiating transactions affecting InnoDB
         tables but not by COMMIT statements ending such transactions. This
         affected these statements whether they were replicated or they were run
         using mysqlbinlog. (Bug #12662190)

       * If the --bind-address option was given a host name value and the host
         name resolved to more than one IP address, the server failed to
         start. For example, with --bind-address=localhost, if localhost resolved
         to both 127.0.0.1 and ::1, startup failed. Now the server prefers the
         IPv4 address in such cases. (Bug #61713, Bug #12762885)

       * mysql_store_result() and mysql_use_result() are not for use with
         prepared statements and are not intended to be called following
         mysql_stmt_execute(), but failed to return an error when invoked that
         way in libmysqld. (Bug #62136, Bug #13738989)

         References: See also Bug #47485.

       * On Windows, mysqlslap crashed for attempts to connect using shared
         memory. (Bug #31173, Bug #11747181, Bug #59107, Bug #11766072)
Pullup ticket #3787.
Pullup ticket #3786 - requested by taca
databases/mysql51-client: security update
databases/mysql51-server: security update

Revisions pulled up:
- databases/mysql51-client/Makefile.common                      1.24-1.25
- databases/mysql51-client/distinfo                             1.21-1.22
- databases/mysql51-server/Makefile                             1.11
- databases/mysql51-server/PLIST                                1.19-1.20
- databases/mysql51-server/distinfo                             1.24-1.25

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Sun Apr  8 19:10:59 UTC 2012

   Modified Files:
   	pkgsrc/databases/mysql51-client: Makefile.common distinfo
   	pkgsrc/databases/mysql51-server: Makefile PLIST distinfo

   Log Message:
   Changes 5.1.62:
   * New utf8_general_mysql500_ci and ucs2_general_mysql500_ci collations have
     been added that preserve the behavior of utf8_general_ci and ucs2_general_ci
     from versions of MySQL previous to 5.1.24. Bug 27877 corrected an error in
     the original collations but introduced an incompatibility for columns that
     contain German 'ß' LATIN SMALL LETTER SHARP S. (As a result of the fix, that
     character compares equal to characters with which it previously compared
     different.) A symptom of the problem after upgrading to MySQL 5.1.24 or newer
     from a version older than 5.1.24 is that CHECK TABLE produces this error:
   * yaSSL was upgraded from version 1.7.2 to 2.2.0.
   * Bugs Fixed

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun May 13 12:59:39 UTC 2012

   Modified Files:
   	pkgsrc/databases/mysql51-client: Makefile.common distinfo
   	pkgsrc/databases/mysql51-server: PLIST distinfo

   Log Message:
   Update mysql51-{client,server} to 5.1.63 (MySQL 5.1.63).

   Changes (http://dev.mysql.com/doc/refman/5.1/en/news-5-1-63.html):

        * Security Fix: Bug #64884 was fixed.

        * Security Fix: Bug #59387 was fixed.

        * InnoDB: Deleting a huge amount of data from InnoDB tables
          within a short time could cause the purge operation that
          flushes data from the buffer pool to stall. If this issue
          occurs, restart the server to work around it. This issue is
          only likely to occur on 32-bit platforms. (Bug #13847885)

        * InnoDB: If the server crashed during a TRUNCATE TABLE or
          CREATE INDEX statement for an InnoDB table, or a DROP DATABASE
          statement for a database containing InnoDB tables, an index
          could be corrupted, causing an error message when accessing
          the table after restart:
          InnoDB: Error: trying to load index index_name for table
          table_name
          InnoDB: but the index tree has been freed!
          In MySQL 5.1, this fix applies to the InnoDB Plugin, but not
          the built-in InnoDB storage engine. (Bug #12861864, Bug
          #11766019)

        * InnoDB: When data was removed from an InnoDB table, newly
          inserted data might not reuse the freed disk blocks, leading
          to an unexpected size increase for the system tablespace or
          .ibd file (depending on the setting of innodb_file_per_table.
          The OPTIMIZE TABLE could compact a .ibd file in some cases but
          not others. The freed disk blocks would eventually be reused
          as additional data was inserted. (Bug #11766634, Bug #59783)

        * Partitioning: After updating a row of a partitioned table and
          selecting that row within the same transaction with the query
          cache enabled, then performing a ROLLBACK, the same result was
          returned by an identical SELECT issued in a new transaction.
          (Bug #11761296, Bug #53775)

        * Replication: The --relay-log-space-limit option was sometimes
          ignored.
          More specifically, when the SQL thread went to sleep, it
          allowed the I/O thread to queue additional events in such a
          way that the relay log space limit was bypassed, and the
          number of events in the queue could grow well past the point
          where the relay logs needed to be rotated. Now in such cases,
          the SQL thread checks to see whether the I/O thread should
          rotate and provide the SQL thread a chance to purge the logs
          (thus freeing space).
          Note that, when the SQL thread is in the middle of a
          transaction, it cannot purge the logs; it can only ask for
          more events until the transaction is complete. Once the
          transaction is finished, the SQL thread can immediately
          instruct the I/O thread to rotate. (Bug #12400313, Bug #64503)
          References: See also Bug #13806492.

        * Mishandling of NO_BACKSLASH_ESCAPES SQL mode within stored
          procedures on slave servers could cause replication failures.
          (Bug #12601974)

        * If the system time was adjusted backward during query
          execution, the apparent execution time could be negative. But
          in some cases these queries would be written to the slow query
          log, with the negative execution time written as a large
          unsigned number. Now statements with apparent negative
          execution time are not written to the slow query log. (Bug
          #63524, Bug #13454045) References: See also Bug #27208.

        * mysql_store_result() and mysql_use_result() are not for use
          with prepared statements and are not intended to be called
          following mysql_stmt_execute(), but failed to return an error
          when invoked that way in libmysqld. (Bug #62136, Bug
          #13738989) References: See also Bug #47485.

        * SHOW statements treated stored procedure, stored function, and
          event names as case sensitive. (Bug #56224, Bug #11763507)

        * On Windows, mysqlslap crashed for attempts to connect using
          shared memory. (Bug #31173, Bug #11747181, Bug #59107, Bug
          #11766072)
Pullup ticket #3788 - requested by taca
lang/php5: security patch

Revisions pulled up:
- lang/php5/Makefile                                            1.88
- lang/php5/distinfo                                            1.94
- lang/php5/patches/patch-sapi_cgi_cgi__main.c                  1.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun May 13 16:09:52 UTC 2012

   Modified Files:
   	pkgsrc/lang/php5: Makefile distinfo
   Added Files:
   	pkgsrc/lang/php5/patches: patch-sapi_cgi_cgi__main.c

   Log Message:
   Add fix for CVE-2012-1823.

   Bump PKGREVISION.
Pullup tickets #3786 and #3788.
Merge remote-tracking branch 'upstream/pkgsrc_2012Q1' into pkgsrc_2012Q1