Add a file to record changes on the pkgsrc-2004Q3 branch
Pullup ticket 114, requested by Matthias Scheler.

Security fix for apache

	Modified Files:
		pkgsrc/www/apache: Makefile distinfo
	Added Files:
		pkgsrc/www/apache/patches: patch-ap

	Log Message:
	Apply fix for security vulnerability in proxy module reported in
	CAN-2004-0492. Bump package revision package of this.
Pullup ticket 115, requested by Lubomir Sedlacik.

	Modified Files:
		pkgsrc/net/lftp: Makefile distinfo

	Log Message:
	Updated to version 3.0.9.

	Changes:
	- fixed a hang up when filtering output via an external command
	  (the bug appeared in 3.0.8).
	- don't use ftp:port-ipv4 in FXP mode.
Pullup ticket 116 - requested by Eric Gillespie
security fix for subversion

	Modified Files:
		pkgsrc/devel/subversion: Makefile.version distinfo

	Log Message:
	Version 1.0.8
	(22 September 2004, from /branches/1.0.8)
	http://svn.collab.net/repos/svn/tags/1.0.8

	 User-visible-changes:
	 * fixed: mod_authz_svn path and log-message metadata leaks.
		  See CAN-2004-0749, and descriptive advisory at
		  http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt
Pullup ticket 121 - requested by Quentin Garnier
security fix for sox

	Modified Files:
		pkgsrc/audio/sox: Makefile distinfo
	Added Files:
		pkgsrc/audio/sox/patches: patch-aa
	Removed Files:
		pkgsrc/audio/sox/patches: patch-ab

	Log Message:
	Update to version 12.17.6.  Note that this version fixes some
	buffer overflows in the WAV parser that could lead to arbitrary
	code execution.

	sox-12.17.6
	-----------
	  o Changed comment code to always use copies of strings to
	    fix bug in WAV handlering freeing argv[] memory.
	  o Use calloc() to create ft_t structures so that all
	    memory is initialized before being referenced.
	  o Fixed VOC EOF bug were it thought there was an extra
	    block when there wasn't.
	  o Restructured directory layout so that source code is in
	    a seperate directory.
	  o Modified SoX to accept multiple input files.  Concatenates
	    files together in this case.
	  o Removed map effect so that loops and instr could be removed
	    from effects structures.  This makes effects engine stand
	    alone from the rest of the sox package.
	  o Benedikt Zeyen found a bug in synth effect when generating
	    brown noise that could cause clipping.
	  o David Leverton sent another patch to prevent crashes on
	    amd64's when resampling.
	  o Fixed a bug were MP3 files with large ID3v2 tags could
	    cause SoX to stick in a loop forever.  Now, it will
	    abort on IDv3 tags larger then 100k.  Could still be
	    improved to handle any size.
	  o Changed volume option (-v) so that it tracks the file
	    it was specified.  This means that when specified with
	    the input file, it changes volume before effects engine
	    and when specified with output file, its done after effects
	    engine.
	  o Added crossfade_cat.sh script that will concatenate to
	    audio files and do a crossfade between them.
	  o Fixed bug in fade effect were it was impossible to do a
	    fadeout starting from the beginning of the audio file.
	  o Removed rounding error when changing volume of audio with
	    "-v" option.  This error caused doing a "-v -1.0" twice
	    to not result in the original file.
	  o Fixed a possible overflow in lots of effects were MIN
	    value was treated as -MAX instead of -MAX-1.
	  o Modifed sox so its OK for effects to not process any
	    input or output bytes as long as they return ST_EOF.
	  o When effects output data and reported ST_EOF at the
	    same time, that buffer was discarded as well as
	    data from any chained effect.
	  o Added patch from Eric Benson that attempts to do a seek()
	    if the first effect is trim.  This greatly speeds up
	    processing large files.
	  o Daniel Pouzzner implemented a multi-band compander (using
	    the butterworth filters to split the audio into bands).
	  o Donnie Smith updated the silence effect so that its possible
	    to remove silence from the middle of a sound file by
	    using a negative value for stop_periods.
	  o Changed float routines to only work with normalized values
	    from -1:1.
	  o Modifed .au handler to be able to read and write 32-bit
	    and 64-bit float data.  Only tested reading so far.
	  o WAV with GSM data now always pads data to even number of bytes.
	  o Added support for writing 32-bit audio to AIFF.

	sox-12.17.5
	-----------
	  o Thomas Klausner sent in patches to compile audio drivers under
	    NetBSD.
	  o Rahul Powar pointed out a memory leak in the WAV file handler.
	    It wasn't calling the correct close() function when closing
	    input files.
	  o Modified play.1 man page to not use multiple name lines.  This
	    appears to confuse some conversion programs.  Updated sox.1
	    man page for typo in reverb option.
	  o Andrew Church fixed problem with header of stereo 8SVX files.
	  o Jimen Ching added support to scan over garbage data at the
	    beginning of MP3 files to find valid frames.  This is useful
	    to play WAV and AIFF files that have MP3 data in them until
	    those handlers support it directly.  To play those, force
	    sox to use the mp3 handler with the "-t mp3" option.
	  o Added patch from Ulf Harnhammar to wav handler to prevent
	    buffer overflows.
	  o Added patch from Redhat to allow resample to work on certain 64-bit
	    machines (Sam Varshavchik)
	  o Tony Seebregts added a file handler for headerless Dialogic/OKI ADPCM
	    files (VOX files).
	  o Jan Paul Schmidt added a repeat effect to do loops the brute force way.
	    This is also good for file format that don't support loops as well.
	  o Fix for OSS driver in rate tolerance calcs that were off because
	    of type conversion problems.  Guenter Geiger.
	  o Allow reading sphere files with headers greater then 256 bytes.  Jimen
	    Ching.
	  o Fix for vorbis were comments are displayed in KEY=value format always.
	    Stop printing some info to stdout in case output is a pipe. Guenter
	    Geiger.
	  o J Robert Ray submitted fix for AIFF handler to ignore lowercase
	    chunks that are unknown.
	  o Bugfix for 8-bit voc files.  Jimen Ching
	  o General warning cleanups (cbagwell)
	  o Memory leaks in reading WAV files (Ufuk Kayserilioglu)
	  o Rearrange link order of ogg vorbis libraries so that they
	    can be compiled as static. (Christian Weisgerbr)
Pullup ticket 122 - requested by Matthias Scheler
security fix for tiff

	Modified Files:
		pkgsrc/graphics/tiff: Makefile

	Log Message:
	Derive "PKGNAME" from "DISTNAME" instead of defining it manually.

	Modified Files:
		pkgsrc/graphics/tiff: Makefile

	Log Message:
	Add mirror on "ftp.fu-berlin.de" to master site list.

	Modified Files:
		pkgsrc/graphics/tiff: Makefile distinfo
		pkgsrc/graphics/tiff/patches: patch-ag
	Added Files:
		pkgsrc/graphics/tiff/patches: patch-ai patch-aj patch-ak patch-al
		    patch-am patch-an patch-ao patch-ap patch-aq patch-ar patch-as
		    patch-at patch-au patch-av patch-aw patch-ax

	Log Message:
	Add various bug fixes taken from Debian's unstable distribution which
	include fixes for CESA-2004-006. Bump package revision.
Pullup ticket 118 - requested by Adrian Portelli
build and security fixes for freeradius

Based on patches provided by Adrian.

Pullup ticket 120 - requested by Todd Vierling
security fix for gzip

	Modified Files:
		pkgsrc/mk: bsd.pkg.mk

	Log Message:
	Automatic inclusion of gzip-base needs a version number in the BUILD_DEPENDS.

	Modified Files:
		pkgsrc/mk: bsd.pkg.mk

	Log Message:
	Bump gzip-base to 1.2.4b for security fix.

	Modified Files:
		pkgsrc/archivers/gzip: Makefile
		pkgsrc/archivers/gzip-base: Makefile distinfo
	Added Files:
		pkgsrc/archivers/gzip-base/patches: patch-ab

	Log Message:
	Update gzip to 1.2.4b, fixing a filename buffer overflow.
Pullup ticket 120 - requested by Todd Vierling
security fix for gzip

	Modified Files:
		pkgsrc/mk: bsd.pkg.mk

	Log Message:
	Automatic inclusion of gzip-base needs a version number in the BUILD_DEPENDS.

	Modified Files:
		pkgsrc/mk: bsd.pkg.mk

	Log Message:
	Bump gzip-base to 1.2.4b for security fix.

	Modified Files:
		pkgsrc/archivers/gzip: Makefile
		pkgsrc/archivers/gzip-base: Makefile distinfo
	Added Files:
		pkgsrc/archivers/gzip-base/patches: patch-ab

	Log Message:
	Update gzip to 1.2.4b, fixing a filename buffer overflow.

Pullup ticket 120 - requested by Todd Vierling
security fix for gzip

	Modified Files:
		pkgsrc/mk: bsd.pkg.mk

	Log Message:
	Automatic inclusion of gzip-base needs a version number in the BUILD_DEPENDS.

	Modified Files:
		pkgsrc/mk: bsd.pkg.mk

	Log Message:
	Bump gzip-base to 1.2.4b for security fix.

	Modified Files:
		pkgsrc/archivers/gzip: Makefile
		pkgsrc/archivers/gzip-base: Makefile distinfo
	Added Files:
		pkgsrc/archivers/gzip-base/patches: patch-ab

	Log Message:
	Update gzip to 1.2.4b, fixing a filename buffer overflow.
Pullup (via patch) ticket 123 - requested by Takahiro Kambe
security fix for squid

	Modified Files:
		pkgsrc/www/squid: Makefile distinfo
		pkgsrc/www/squid/patches: patch-ag patch-an patch-bb
	Removed Files:
		pkgsrc/www/squid/patches: patch-ba

	Log Message:
	Update squid package to 2.5.7.

	This includes security problem with SNMP support which enabled by default.

	<http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities>

	* pkgsrc changes:

	  - Don't use PKGNAME within DIST_SUBDIR.  Instead, date based DIST_STAMP.
	    This change prevent extra DIST_SUBDIR change asked by kim@.
	  - Remove setproctitle(3) hack for dnsserver helper program since use of
	    dnsserver itself is problematic with huge size of squid process.

	* Changes to squid-2.5.STABLE7 (11 Oct 2004)

	  - [Medium] No objects cached in ufs cache_dir type in some
	    configurations. Issue introduced in 2.5.STABLE6 by the patch for
	    Bug #676. (Bug #1011)
	  - [Minor] LDAP helpers update to correct LDAP connection management
	    and add support for literal password compare instead of binding
	  - [Minor] A large number of queued DNS lookups for the same domain
	    (Bug #852)
	  - [Cosmetic] request_header_max_size configuration partly ignored
	    (Bug #899)
	  - [Minor] Partial hit results in TCP_HIT, not TCP_MISS. (Bug #1001)
	  - Bug #1012: [Cosmetic] HEAD requests may return stale information
	    (Bug #1012)
	  - [Cosmetic] Warn if cache_dir ufs can not create files. (Bug #918)
	  - [Minor] case insensitive authentication (Bug #431)
	  - [Cosmetic] Add delay pools information to active_requests. (Bug
	    #882)
	  - [Minor] Apparent memory leak in client_db (Bug #833)
	  - [Minor] NTLM authentication truncated causing failures. (Bug
	    #1016)
	  - [Cosmetic] Grammatical corrections in squid.conf.default
	  - [Cosmetic] Unknown %X errorpage codes incorrectly quoted. (Bug
	    #1030)
	  - [Medium] Segfaults and other strange crashes when using heap
	    policies. (Bug #1009)
	  - [Minor] Supplementary group memberships not set (Bug #1021)
	  - [Cosmetic] ERR_TOO_BIG Portugese translation
	  - [Minor] external_acl does not handle newlines (Bug #1038)
	  - [Major] NTLM authentication denial of service when using msnt_auth
	    or fake_auth (Bug #1045)
	  - [Medium] Memory leaks when using NTLM authentication without
	    challenge reuse. (Bug #994)
	  - [Minor] Temporary NTLM memory leak with challenge reuse enabled
	    (Bug #910)
	  - [Minor] assertion failed: "n_ufs_dirs <=
	    Config.cacheSwap.n_configured". (Bug #1053)
	  - [Minor] Segfault in authenticateDigestHandleReply. (Bug #1031)
	  - [Minor] acl time fails to parse multiple time specifications
	    (Bug #1060)
	  - [Minor] cachemgr config dumps mixed up Range and Request-Range
	    headers in http_header_access & replace directives. (Bug #1056)
	  - [Minor] Content-Disposition added as a well known header (Bug #961)
	  - [Cosmetic] Don't warn about arp acls not being supported on FreeBSD
	    (Bug #1074)
	  - [Cosmetic] Limit internal send/receive buffer sizes (Bug #1075)
	  - [Medium] New acl types to match arbitrary HTTP headers. In addition
	    the http_header_access & replace directivess now support arbitrary
	    headers and not only the well known ones. (Bug #961)
	  - [Cosmetic] ncsa_auth now accepts Window formatted password files
	    (Bug #1078)
	  - [Cosmetic] Support the --program-prefix/suffix options or other
	    configure program name transforms (Bug #1019)
	  - [Minor] Fix race condition in CONNECT and also handle aborts of
	    CONNECT requests in a more graceful manner. (Bug #859)
	  - [Minor] New balance_on_multiple_ip directive to work around certain
	    broken load balancers and optimized ipcache on reload requests
	    (Bug #1058)
	  - [Medium] New reply_header_max_size directive (Bug #874)
	  - [Minor] Suspected instability on aborted PUT/POST requests (Bug #1089)
	  - [Security] SNMP Denial of Service fix (CAN-2004-0918)
Correct the version number in the Makefile on the pkgsrc-2004Q3 branch.
Pointed out by Soren Jacobsen.
Security Pullup - requested by Matthias Scheler
security fix for ap-ssl

	Modified Files:
		pkgsrc/www/ap-ssl: Makefile distinfo

	Log Message:
	Update "ap-ssl" package to version 2.8.20. Changes since version 2.8.19:
	- With OpenSSL 0.9.7, prevent session resumption during a
	  renegotiation to force the client to negotiate a new (and
	  acceptable to mod_ssl) cipher suite. Additionally, ensure
	  that a correct cipher suite has been negotiated afterwards
	  (CAN-2004-0885).
	- Fixed more printf(3) style format string bugs (not security
	  related) which could crash the server if mod_ssl's trace
	  or debug log level is enabled.


	To generate a diff of this commit:
	cvs rdiff -r1.83 -r1.84 pkgsrc/www/ap-ssl/Makefile
	cvs rdiff -r1.22 -r1.23 pkgsrc/www/ap-ssl/distinfo
Pull-up patch-aa from the HEAD, and re-generate its checksum.

Fixes build on pkgsrc-2004Q3 branch.

Thanks to Soren Jacobsen for pointing this one out.
Security Pullup - requested by Mark Davies
security fix for kpdf, part of kdegraphics3

PKGREVISION is set to 2 so that it's newer than the 3.3.0nb1 that was
in HEAD before 3.3.1.

	Module Name: pkgsrc
	Committed By: markd
	Date:  Sat Oct 23 13:19:12 UTC 2004

	Modified Files:
	 pkgsrc/graphics/kdegraphics3: Makefile distinfo

	Log Message:
	Fix integer overflow and integer arithmetic flaws in kpdf.
	From http://www.kde.org/info/security/advisory-20041021-1.txt
	Bump PKGREVISION.
Update meta-pkgs/kde3 for the previous kdegraphics3 patch (kpdf
security fix).
Security Pullup - requested by Grant Beattie
security fix for firefox

Includes the following modifications:

	Module Name:    pkgsrc
	Committed By:   grant
	Date:           Mon Oct  4 09:11:30 UTC 2004

	Modified Files:
		pkgsrc/www/firefox: Makefile-firefox.common distinfo

	Log Message:
	update to Firefox 0.10.1, bugfix for a security issue:

		http://www.mozilla.org/press/mozilla-2004-10-01-02.html


	To generate a diff of this commit:
	cvs rdiff -r1.3 -r1.4 pkgsrc/www/firefox/Makefile-firefox.common
	cvs rdiff -r1.16 -r1.17 pkgsrc/www/firefox/distinfo
---
	Module Name:    pkgsrc
	Committed By:   grant
	Date:           Mon Oct  4 09:15:29 UTC 2004

	Modified Files:
		pkgsrc/www/firefox: distinfo
		pkgsrc/www/firefox/patches: patch-br

	Log Message:
	commit a patch for using thread-safe resolver library functions on
	NetBSD >=2.0F - I've been running with it for months on -current
	without any problems.


	To generate a diff of this commit:
	cvs rdiff -r1.17 -r1.18 pkgsrc/www/firefox/distinfo
	cvs rdiff -r1.2 -r1.3 pkgsrc/www/firefox/patches/patch-br
---
	Module Name:    pkgsrc
	Committed By:   reed
	Date:           Sat Oct 16 20:08:48 UTC 2004

	Modified Files:
		pkgsrc/www/firefox: Makefile-firefox.common

	Log Message:
	Use cp(1)'s -RL instead of -r, because coreutils's
	cp -r copies symlinks as symlinks (which caused
	files to be missing in install).

	Hopefully, this is portable. I tested under NetBSD and with coreutils.
	And I brought this up on tech-pkg in July.


	To generate a diff of this commit:
	cvs rdiff -r1.4 -r1.5 pkgsrc/www/firefox/Makefile-firefox.common

---
	Module Name:    pkgsrc
	Committed By:   reed
	Date:           Tue Oct 19 21:01:47 UTC 2004

	Modified Files:
		pkgsrc/www/firefox: Makefile-firefox.common

	Log Message:
	Instead of non-portable cp -RL, use pax with -Lrw
	to copy the extensions files.

	On Solaris, cp doesn't know -L. (Reported by R. Quinn.)
	Using pax was suggested by grant@.


	To generate a diff of this commit:
	cvs rdiff -r1.5 -r1.6 pkgsrc/www/firefox/Makefile-firefox.common
---
	Module Name:    pkgsrc
	Committed By:   xtraeme
	Date:           Thu Oct 21 00:55:36 UTC 2004

	Modified Files:
		pkgsrc/www/firefox: distinfo
	Added Files:
		pkgsrc/www/firefox/patches: patch-cd

	Log Message:
	Only include <stdbool.h> if !defined(_cplusplus) in nptypes.h.

	Fixes build on NetBSD/macppc and maybe others, tested by Peter Bex
	on 2-0/macppc and i386/-current/2-0 by me, closes PR pkg/27033.


	To generate a diff of this commit:
	cvs rdiff -r1.18 -r1.19 pkgsrc/www/firefox/distinfo
	cvs rdiff -r0 -r1.1 pkgsrc/www/firefox/patches/patch-cd
---
	Module Name:    pkgsrc
	Committed By:   grant
	Date:           Sun Oct 24 05:41:25 UTC 2004

	Modified Files:
		pkgsrc/www/firefox: distinfo
	Added Files:
		pkgsrc/www/firefox/patches: patch-ce patch-cf

	Log Message:
	apply patch from mozilla CVS to fix bug id #260337 (installer missing
	libnsl on Solaris), as well as another sh(1) portability fix.

		https://bugzilla.mozilla.org/show_bug.cgi?id=260337

	no PKGREVISION bump because this didn't build on Solaris without
	libnsl.


	To generate a diff of this commit:
	cvs rdiff -r1.19 -r1.20 pkgsrc/www/firefox/distinfo
	cvs rdiff -r0 -r1.1 pkgsrc/www/firefox/patches/patch-ce \
	    pkgsrc/www/firefox/patches/patch-cf
Security Pullup - requested by Adrian Portelli
security fix for socat

	Includes the following modifications:

	Module Name:    pkgsrc
	Committed By:   adrianp
	Date:           Thu Sep 30 12:42:46 UTC 2004

	Modified Files:
		pkgsrc/net/socat: Makefile distinfo
		pkgsrc/net/socat/patches: patch-aa

	Log Message:
	Update socat to 1.4.0.2

	- Change to my NetBSD email address

	####################### V 1.4.0.2:

	corrections:
		exec'd write-only addresses get a chance to flush before being killed
		error handler: print notice on error-exit
		filan printed wrong file type information

	####################### V 1.4.0.1:

	corrections:
		socks4a constructed invalid header. Problem found, reported, and fixed
		by Thomas Themel, by Peter Palfrader, and by rik
		with nofork, don't forget to apply some process related options
		(chroot, setsid, setpgid, ...)

	####################### V 1.4.0.0:

	new features:
		simple openssl server (ssl-l), experimental openssl trust
		new options "cafile", "capath", "key", "cert", "egd", and "pseudo" for
		openssl
		new options "retry", "forever", and "intervall"
		option "fork" for address TCP improves `gender changer´
		options "sigint", "sigquit", and "sighup" control passing of signals to
		sub process (thanks to David Shea who contributed to this issue)
		readline takes respect to the prompt issued by the peer address
		options "prompt" and "noprompt" allow to override readline's new
		default behaviour
		readline supports invisible password with option "noecho"
		socat option -lp allows to set hostname in log output
		socat option -lu turns on microsecond resolution in log output

	corrections:
		before reading available data, check if writing on other channel is
		possible
		tcp6, udp6: support hostname specification (not only IP address), and
		map IP4 names to IP6 addresses
		openssl client checks server certificate per default
		support unidirectional communication with exec/system subprocess
		try to restore original terminal settings when terminating
		test.sh uses tmp dir /tmp/$USER/$$ instead of /tmp/$$
		socks4 failed on platforms where long does not have 32 bits
		(thanks to Peter Palfrader and Thomas Seyrat)
		hstrerror substitute wrote wrong messages (HP-UX, Solaris)
		proxy error message was truncated when answer contained multiple spaces

	porting:
		compiles with AIX xlc, HP-UX cc, Tru64 cc (but might not link)


	To generate a diff of this commit:
	cvs rdiff -r1.2 -r1.3 pkgsrc/net/socat/Makefile
	cvs rdiff -r1.1.1.1 -r1.2 pkgsrc/net/socat/distinfo
	cvs rdiff -r1.1.1.1 -r1.2 pkgsrc/net/socat/patches/patch-aa
---
	Module Name:    pkgsrc
	Committed By:   adrianp
	Date:           Mon Oct 25 17:13:51 UTC 2004

	Modified Files:
		pkgsrc/net/socat: Makefile distinfo

	Log Message:
	- Update to 1.4.0.3
	- Security fix for: http://www.dest-unreach.org/socat/advisory/socat-adv-1.html


	To generate a diff of this commit:
	cvs rdiff -r1.4 -r1.5 pkgsrc/net/socat/Makefile
	cvs rdiff -r1.2 -r1.3 pkgsrc/net/socat/distinfo
Security Pullup - requested by Grant Beattie and Havard Eidnes
security fix for cabextract

	Module Name:    pkgsrc
	Committed By:   wiz
	Date:           Thu Oct 28 10:35:56 UTC 2004

	Modified Files:
		pkgsrc/archivers/cabextract: Makefile distinfo
	Added Files:
		pkgsrc/archivers/cabextract/patches: patch-aa

	Log Message:
	Update to 1.1:
	  * A security vulnerability has been fixed. If the files within a
	    cabinet file include "../" in their filenames, this will be
	    changed to "xx/", so cabinets cannot access the parent directory
	    of where you want to extract them.
	  * cabextract should now compile cleanly on AIX and Cygwin.
----
	Module Name:    pkgsrc
	Committed By:   tv
	Date:           Fri Oct 29 14:31:27 UTC 2004

	Modified Files:
		pkgsrc/archivers/cabextract: distinfo
	Added Files:
		pkgsrc/archivers/cabextract/patches: patch-ab

	Log Message:
	Make build on Interix (and possibly AIX).  mempcpy() is not actually used
	anywhere, yet configure.ac declared an AC_REPLACE_FUNCS() for it.  Rip out
	the offending code from configure until it is rebuilt at the source.

	(Patch to remove the AC_REPLACE_FUNCS submitted to author.)
Security Pullup - requested by Grant Beattie and Havard Eidnes
security fix for wv

	Module Name:    pkgsrc
	Committed By:   adam
	Date:           Tue Sep 21 14:45:49 UTC 2004

	Modified Files:
		pkgsrc/converters/wv: Makefile PLIST distinfo

	Log Message:
	Changes 1.0.2:
	* Fix iDEFENSE buffer overrun security problem
	(thanks to Matthias for heads-up)


	To generate a diff of this commit:
	cvs rdiff -r1.37 -r1.38 pkgsrc/converters/wv/Makefile
	cvs rdiff -r1.6 -r1.7 pkgsrc/converters/wv/PLIST
	cvs rdiff -r1.9 -r1.10 pkgsrc/converters/wv/distinfo