Pullup ticket #4207 - requested by taca
net/samba: security update

Revisions pulled up:
- net/samba/Makefile                                            1.235,1.237
- net/samba/Makefile.mirrors                                    1.10
- net/samba/PLIST                                               1.54
- net/samba/distinfo                                            1.91-1.92
- net/samba/patches/patch-ac                                    1.15
- net/samba/patches/patch-ad                                    1.19
- net/samba/patches/patch-ae                                    1.11
- net/samba/patches/patch-af                                    1.12
- net/samba/patches/patch-ah                                    1.7
- net/samba/patches/patch-ai                                    1.7
- net/samba/patches/patch-aj                                    1.7
- net/samba/patches/patch-ak                                    1.6
- net/samba/patches/patch-an                                    1.4
- net/samba/patches/patch-ao                                    1.4
- net/samba/patches/patch-aq                                    1.4
- net/samba/patches/patch-as                                    1.4
- net/samba/patches/patch-av                                    1.5
- net/samba/patches/patch-aw                                    1.4
- net/samba/patches/patch-ba                                    1.11
- net/samba/patches/patch-bb                                    1.5
- net/samba/patches/patch-bf                                    1.6

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Wed Jul  3 20:00:48 UTC 2013

   Modified Files:
   	pkgsrc/net/samba: Makefile PLIST distinfo
   	pkgsrc/net/samba/patches: patch-bf

   Log Message:
   Changes 3.6.16:
   * BUG 9881: Link dbwrap_tool and dbwrap_torture against libtevent.
   * BUG 9722: Properly handle Oplock breaks in compound requests.
   * BUG 9822: Fix crash bug during Win8 sync.
   * BUG 9927: errno gets overwritten in call to check_parent_exists().
   * BUG 8997: Change libreplace GPL source to LGPL.
   * BUG 9900: is_printer_published GUID retrieval.
   * BUG 9941: Fix a bug of drvupgrade of smbcontrol.
   * BUG 9868: Don't know how to make LIBNDR_PREG_OBJ.
   * BUG 9688: Remove "experimental" label on "max protocol=SMB2" parameter.
   * BUG 9881: Check for system libtevent.

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Thu Jul  4 19:31:10 UTC 2013

   Modified Files:
   	pkgsrc/net/samba: Makefile.mirrors

   Log Message:
   Fix URL.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Aug 12 02:45:55 UTC 2013

   Modified Files:
   	pkgsrc/net/samba: Makefile distinfo
   	pkgsrc/net/samba/patches: patch-ac patch-ad patch-ae patch-af patch-ah
   	    patch-ai patch-aj patch-ak patch-an patch-ao patch-aq patch-as
   	    patch-av patch-aw patch-ba patch-bb

   Log Message:
   Update samba to 3.6.17, security release.

                      ==============================
                      Release Notes for Samba 3.6.17
                             August 05, 2013
                      ==============================

   This is a security release in order to address
   CVE-2013-4124 (Missing integer wrap protection in EA list reading can cause
   server to loop with DOS).

   o  CVE-2013-4124:
      All current released versions of Samba are vulnerable to a denial of
      service on an authenticated or guest connection. A malformed packet
      can cause the smbd server to loop the CPU performing memory
      allocations and preventing any further service.

      A connection to a file share, or a local account is needed to exploit
      this problem, either authenticated or unauthenticated if guest
      connections are allowed.

      This flaw is not exploitable beyond causing the code to loop
      allocating memory, which may cause the machine to exceed memory
      limits.

   Changes since 3.6.16:
   ---------------------

   o   Jeremy Allison <jra@samba.org>
       * BUG 10010: CVE-2013-4124: Missing integer wrap protection in EA list
         reading can cause server to loop with DOS.
Pullup ticket #4208 - requested by taca
net/samba35: security update

Revisions pulled up:
- net/samba35/Makefile                                          1.31
- net/samba35/distinfo                                          1.16
- net/samba35/patches/patch-af                                  1.6
- net/samba35/patches/patch-ah                                  1.3
- net/samba35/patches/patch-ap                                  1.2
- net/samba35/patches/patch-aq                                  1.4
- net/samba35/patches/patch-av                                  1.3
- net/samba35/patches/patch-aw                                  1.2
- net/samba35/patches/patch-ba                                  1.2
- net/samba35/patches/patch-bb                                  1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Aug 12 02:47:32 UTC 2013

   Modified Files:
   	pkgsrc/net/samba35: Makefile distinfo
   	pkgsrc/net/samba35/patches: patch-af patch-ah patch-ap patch-aq
   	    patch-av patch-aw patch-ba patch-bb

   Log Message:
   Update samba35 to 3.5.22, security release.

                      ==============================
                      Release Notes for Samba 3.5.22
   			  August 05, 2013
                      ==============================

   This is a security release in order to address
   CVE-2013-4124 (Missing integer wrap protection in EA list reading can cause
   server to loop with DOS).

   o  CVE-2013-4124:
      All current released versions of Samba are vulnerable to a denial of
      service on an authenticated or guest connection. A malformed packet
      can cause the smbd server to loop the CPU performing memory
      allocations and preventing any further service.

      A connection to a file share, or a local account is needed to exploit
      this problem, either authenticated or unauthenticated if guest
      connections are allowed.

      This flaw is not exploitable beyond causing the code to loop
      allocating memory, which may cause the machine to exceed memory
      limits.

   Changes since 3.5.21:
   ---------------------

   o   Jeremy Allison <jra@samba.org>
       * BUG 10010: CVE-2013-4124: Missing integer wrap protection in EA list
         reading can cause server to loop with DOS.
Pullup tickets #4207 and #4208.
Pullup ticket #4210 - requested by wiz
www/py-werkzeug-docs: packaging fix

Revisions pulled up:
- www/py-werkzeug-docs/Makefile                                 1.2

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Mon Aug  5 08:40:14 UTC 2013

   Modified Files:
   	pkgsrc/www/py-werkzeug-docs: Makefile

   Log Message:
   Simplify PKGNAME for older make(1)s or other parsers.
Pullup ticket #4211 - requested by schmonz
www/cvsweb: Perl compatibility patch

Revisions pulled up:
- www/cvsweb/Makefile                                           1.40
- www/cvsweb/distinfo                                           1.17
- www/cvsweb/patches/patch-cvsweb.cgi                           1.1

---
   Module Name:    pkgsrc
   Committed By:   tez
   Date:           Tue Jul 30 13:01:11 UTC 2013

   Modified Files:
           pkgsrc/www/cvsweb: Makefile distinfo
   Added Files:
           pkgsrc/www/cvsweb/patches: patch-cvsweb.cgi

   Log Message:
   Fix warnings from newer perl versions
Pullup tickets #4210 and #4211.
Pullup ticket #4212 - requested by adam
mail/dovecot2: security update

Revisions pulled up:
- mail/dovecot2/Makefile                                    1.46,1.50 via patch
- mail/dovecot2/PLIST                                       1.25-1.26
- mail/dovecot2/distinfo                                    1.36,1.38

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Tue Jul  2 15:38:19 UTC 2013

   Modified Files:
   	pkgsrc/mail/dovecot2: Makefile PLIST distinfo

   Log Message:
   Changes 2.2.4:
   + doveadm: Added "flags" command to modify message flags.
   + doveadm: Added "deduplicate" command to expunge message duplicates.
   + dsync: Show the state in process title with verbose_proctitle=yes.
   - imap/pop3 proxy: Master user logins were broken in v2.2.3
   - sdbox/mdbox: A corrupted index header with wrong size was never
     automatically fixed in v2.2.3.
   - mbox: Fixed assert-crashes related to locking

---
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Thu Aug 15 09:42:41 UTC 2013

   Modified Files:
           pkgsrc/mail/dovecot2: Makefile PLIST distinfo

   Log Message:
   Changes 2.2.5:
   + SSL: Added support for ECDH/ECDHE cipher suites
   + Added some missing man pages
   + quota-status: Added quota_status_toolarge setting
   - director: Users near expiration could have been redirected to
     different servers at the same time.
   - pop3: Avoid assert-crash if client disconnects during LIST.
   - mdbox: Corrupted index header still wasn't automatically fixed.
   - dsync: Various fixes to work better with imapc and pop3c storages.
   - ldap: sasl_bind=yes caused crashes, because Dovecot's lib-sasl
     symbols conflicted with Cyrus SASL library.
   - imap: Various error handling fixes to CATENATE. (Found using
     Apple's stress test script.)
Pullup ticket #4212.
Pullup ticket #4213 - requested by spz
lang/python27: security patch

Revisions pulled up:
- lang/python27/Makefile                                        1.27
- lang/python27/PLIST.common                                    1.6
- lang/python27/distinfo                                        1.25
- lang/python27/patches/patch-Lib_test_nullbytecert.pem         1.1
- lang/python27/patches/patch-Lib_test_test__ssl.py             1.1
- lang/python27/patches/patch-Misc_NEWS                         1.1
- lang/python27/patches/patch-Modules___ssl.c                   1.2

---
   Module Name:	pkgsrc
   Committed By:	spz
   Date:		Sun Aug 18 13:42:14 UTC 2013

   Modified Files:
   	pkgsrc/lang/python27: Makefile PLIST.common distinfo
   	pkgsrc/lang/python27/patches: patch-Modules___ssl.c
   Added Files:
   	pkgsrc/lang/python27/patches: patch-Lib_test_nullbytecert.pem
   	    patch-Lib_test_test__ssl.py patch-Misc_NEWS

   Log Message:
   patch for CVE-2013-4238 taken from
   http://hg.python.org/cpython/rev/bd2360476bdb
Pullup ticket #4214 - requested by bsiegert
devel/doxygen: build fix

Revisions pulled up:
- devel/doxygen/distinfo                                        1.50
- devel/doxygen/patches/patch-tmake_lib_macosx-c++_tmake.conf   1.1

---
   Module Name:    pkgsrc
   Committed By:   bsiegert
   Date:           Tue Aug 20 17:41:15 UTC 2013

   Modified Files:
           pkgsrc/devel/doxygen: distinfo
   Added Files:
           pkgsrc/devel/doxygen/patches: patch-tmake_lib_macosx-c++_tmake.conf

   Log Message:
   Fix build on Mac OS 10.8 by removing an unsupported compiler option.
Pullup ticket #4215 - requested by hannken
net/chrony: security update

Revisions pulled up:
- net/chrony/Makefile                                           1.29
- net/chrony/PLIST                                              1.5
- net/chrony/distinfo                                           1.8
- net/chrony/files/chronyd.sh                                   1.5
- net/chrony/patches/patch-aa                                   1.5
- net/chrony/patches/patch-ab                                   1.5
- net/chrony/patches/patch-ac                                   1.5
- net/chrony/patches/patch-ad                                   1.4
- net/chrony/patches/patch-ae                                   1.5
- net/chrony/patches/patch-af                                   1.4
- net/chrony/patches/patch-ag                                   1.4

---
   Module Name:    pkgsrc
   Committed By:   hannken
   Date:           Fri Aug 16 08:30:20 UTC 2013

   Modified Files:
           pkgsrc/net/chrony: Makefile PLIST distinfo
           pkgsrc/net/chrony/files: chronyd.sh
           pkgsrc/net/chrony/patches: patch-aa patch-ab patch-ac patch-ad patch-ae
               patch-af
   Added Files:
           pkgsrc/net/chrony/patches: patch-ag

   Log Message:
   Update chrony to version 1.29. For a full list of changes
   since 1.24 see file NEWS in the distfile.

   Security fixes since 1.24:

   * Fix crash when processing crafted commands (CVE-2012-4502)
     (possible with IP addresses allowed by cmdallow and localhost)
   * Don't send uninitialized data in SUBNETS_ACCESSED and CLIENT_ACCESSES
     replies (CVE-2012-4503) (not used by chronyc)

   Reviewed by: Joerg Sonnenberger <joerg%netbsd.org@localhost>
Pullup tickets #4213, #4214 and #4215.
Pullup ticket #4216 - requested by drochner
security/putty: security update

Revisions pulled up:
- security/putty/Makefile                                       1.34-1.35
- security/putty/distinfo                                       1.14-1.15
- security/putty/patches/patch-CVE-2013-4852-1                  deleted
- security/putty/patches/patch-CVE-2013-4852-2                  deleted
- security/putty/patches/patch-import.c                         1.2-1.3
- security/putty/patches/patch-terminal.c                       deleted
- security/putty/patches/patch-timing.c                         1.2
- security/putty/patches/patch-unix_gtkfont_c                   deleted
- security/putty/patches/patch-unix_gtkwin.c                    1.3
- security/putty/patches/patch-unix_uxnet.c                     1.2
- security/putty/patches/patch-unix_uxucs.c                     1.2
- security/putty/patches/patch-windows_window.c                 1.2

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Tue Aug  6 12:23:37 UTC 2013

   Modified Files:
           pkgsrc/security/putty: Makefile distinfo
           pkgsrc/security/putty/patches: patch-import.c
   Added Files:
           pkgsrc/security/putty/patches: patch-CVE-2013-4852-1
               patch-CVE-2013-4852-2

   Log Message:
   add patch from upstream to fix possible heap overflow in SSH handshake
   due to integer overflow (CVE-2013-4852)
   bump PKGREV

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Wed Aug  7 11:06:39 UTC 2013

   Modified Files:
           pkgsrc/security/putty: Makefile distinfo
           pkgsrc/security/putty/patches: patch-import.c patch-timing.c
               patch-unix_gtkwin.c patch-unix_uxnet.c patch-unix_uxucs.c
               patch-windows_window.c
   Removed Files:
           pkgsrc/security/putty/patches: patch-CVE-2013-4852-1
               patch-CVE-2013-4852-2 patch-terminal.c patch-unix_gtkfont_c

   Log Message:
   update to 0.63
   This fixes a buffer overflow which was patched in pkgsrc
   (CVE-2013-4852), two other buffer overflows (CVE-2013-4206,
   CVE-2013-4207), and it clears private keys after use now
   (CVE-2013-4208). Other than that, there are mostly bug fixes from 0.62
   and a few small features.
Pullup ticket #4217 - requested by drochner
net/filezilla: security update

Revisions pulled up:
- net/filezilla/Makefile                                        1.44-1.45
- net/filezilla/PLIST                                           1.10
- net/filezilla/distinfo                                        1.17-1.18
- net/filezilla/patches/patch-CVE-2013-4206                     1.1
- net/filezilla/patches/patch-CVE-2013-4208                     1.1
- net/filezilla/patches/patch-CVE-2013-4852-1                   deleted
- net/filezilla/patches/patch-CVE-2013-4852-2                   deleted
- net/filezilla/patches/patch-CVE-2013-4852-3                   deleted
- net/filezilla/patches/patch-aa                                deleted

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Tue Aug  6 12:55:10 UTC 2013

   Modified Files:
           pkgsrc/net/filezilla: Makefile distinfo
   Added Files:
           pkgsrc/net/filezilla/patches: patch-CVE-2013-4852-1
               patch-CVE-2013-4852-2 patch-CVE-2013-4852-3

   Log Message:
   apply patches from pkgsrc/security/putty to fix embedded sftp client
   bump PKGREV

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Wed Aug  7 16:48:49 UTC 2013

   Modified Files:
           pkgsrc/net/filezilla: Makefile PLIST distinfo
   Added Files:
           pkgsrc/net/filezilla/patches: patch-CVE-2013-4206
   patch-CVE-2013-4208 Removed Files:
           pkgsrc/net/filezilla/patches: patch-CVE-2013-4852-1
               patch-CVE-2013-4852-2 patch-CVE-2013-4852-3 patch-aa

   Log Message:
   update to 3.7.2
   This is a major update, many fixes and improvements.
   Main reason for the update was to sync the embedded sftp client
   with putty after fixes for vulnerabilities.
Pullup tickets #4216 and #4217.
Pullup ticket #4218 - requested by ryoon
devel/xulrunner17: security update

Revisions pulled up:
- devel/xulrunner17/Makefile                                    1.12-1.15
- devel/xulrunner17/PLIST                                       1.5
- devel/xulrunner17/buildlink3.mk                               1.10
- devel/xulrunner17/dist.mk                                     1.7-1.8
- devel/xulrunner17/distinfo                                    1.10-1.12
- devel/xulrunner17/patches/patch-dist_stl__wrappers_ios        1.1
- devel/xulrunner17/patches/patch-dist_stl__wrappers_ostream    1.1
- devel/xulrunner17/patches/patch-ipc_chromium_src_base_file__util.cc 1.1
- devel/xulrunner17/patches/patch-ipc_chromium_src_base_file__util__posix.cc 1.2
- devel/xulrunner17/patches/patch-ipc_chromium_src_base_pickle.cc 1.1

---
   Module Name:	pkgsrc
   Committed By:	ryoon
   Date:		Tue Jul  9 10:53:14 UTC 2013

   Modified Files:
   	pkgsrc/devel/xulrunner17: Makefile dist.mk distinfo

   Log Message:
   Update to 17.0.7

   Changelog:
   FIXED
   Security fixes can be found here

   Fixed in Firefox ESR 17.0.7
   MFSA 2013-59 XrayWrappers can be bypassed to run user defined methods in a privileged context
   MFSA 2013-56 PreserveWrapper has inconsistent behavior
   MFSA 2013-55 SVG filters can lead to information disclosure
   MFSA 2013-54 Data in the body of XHR HEAD requests leads to CSRF attacks
   MFSA 2013-53 Execution of unmapped memory through onreadystatechange event
   MFSA 2013-51 Privileged content access and execution via XBL
   MFSA 2013-50 Memory corruption found using Address Sanitizer
   MFSA 2013-49 Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)

---
   Module Name:	pkgsrc
   Committed By:	joerg
   Date:		Tue Jul 16 22:27:45 UTC 2013

   Modified Files:
   	pkgsrc/devel/xulrunner17: distinfo
   	pkgsrc/devel/xulrunner17/patches:
   	    patch-ipc_chromium_src_base_file__util__posix.cc
   Added Files:
   	pkgsrc/devel/xulrunner17/patches: patch-dist_stl__wrappers_ios
   	    patch-dist_stl__wrappers_ostream
   	    patch-ipc_chromium_src_base_file__util.cc
   	    patch-ipc_chromium_src_base_pickle.cc

   Log Message:
   Add visibility wrapper around ios and ostream. Don't use false as null
   pointer.

---
   Module Name:	pkgsrc
   Committed By:	ryoon
   Date:		Fri Aug  2 12:17:57 UTC 2013

   Modified Files:
   	pkgsrc/devel/xulrunner17: Makefile PLIST buildlink3.mk

   Log Message:
   Remove pkg-config *.pc files from standard place.

   * Avoid potential conflicts between xulrunners.
   * Fix buildlink3.mk to handle pc files properly.

---
   Module Name:	pkgsrc
   Committed By:	ryoon
   Date:		Fri Aug  2 12:18:41 UTC 2013

   Modified Files:
   	pkgsrc/devel/xulrunner17: Makefile

   Log Message:
   Bump PKGREVISION for previous.

---
   Module Name:	pkgsrc
   Committed By:	ryoon
   Date:		Thu Aug  8 13:01:38 UTC 2013

   Modified Files:
   	pkgsrc/devel/xulrunner17: Makefile dist.mk distinfo

   Log Message:
   Update to 17.0.8

   Changelog:
   Fixed in Firefox ESR 17.0.8
   MFSA 2013-75 Local Java applets may read contents of local file system
   MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest
   MFSA 2013-72 Wrong principal used for validating URI for some Javascript components
   MFSA 2013-71 Further Privilege escalation through Mozilla Updater
   MFSA 2013-69 CRMF requests allow for code execution and XSS attacks
   MFSA 2013-68 Document URI misrepresentation and masquerading
   MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater
   MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)
Pullup ticket #4218.
Reset revision of "firefox17" package as requested by Ryo ONODERA
in pullup ticket #4218.
Pullup ticket #4219 - requested by obache
emulators/suse121_compat: security update

Revisions pulled up:
- emulators/suse121_compat/Makefile                             1.2
- emulators/suse121_compat/distinfo                             1.2
- emulators/suse121_compat/suse.i386.mk                         1.1

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Sun Aug 25 12:20:25 UTC 2013

   Modified Files:
   	pkgsrc/emulators/suse121_compat: Makefile distinfo
   Added Files:
   	pkgsrc/emulators/suse121_compat: suse.i386.mk

   Log Message:
   Add missing compat RPM for i386.
   PR pkg/48153.

   Bump PKGREVISION.
Pullup ticket #4220 - requested by taca
lang/php53: security patch

Revisions pulled up:
- lang/php53/Makefile                                           1.43 via patch
- lang/php53/distinfo                                           1.67-1.68
- lang/php53/patches/patch-ext_openssl_openssl.c                1.1-1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Aug 14 15:42:56 UTC 2013

   Modified Files:
   	pkgsrc/lang/php53: Makefile distinfo
   Added Files:
   	pkgsrc/lang/php53/patches: patch-ext_openssl_openssl.c

   Log Message:
   Add fix fo openssl, CVE-2013-4073.

   Bump PKGREVISION.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Aug 16 00:38:13 UTC 2013

   Modified Files:
   	pkgsrc/lang/php53: distinfo
   	pkgsrc/lang/php53/patches: patch-ext_openssl_openssl.c

   Log Message:
   Since openssl's security problem has assigned CVE-2013-4248, update comment
   in the patch file.