security update:



Important: Session fixation CVE-2013-2067

FORM authentication associates the most recent request requiring
authentication with the current session. By repeatedly sending
a request for an authenticated resource while the victim is
completing the login form, an attacker could inject a request
that would be executed using the victim's credentials.

Note that the option to change session ID on authentication was
added in Tomcat 6.0.21. In earlier 6.0.x releases, prevention of
session fixation was an application responsibility.
This vulnerability represents a bug in Tomcat's session fixation
protection that was added in 6.0.21. Hence, only versions 6.0.21
onwards are listed as vulnerable.

This was fixed in revision 1417891.

This issue was identified by the Tomcat security team on
15 Oct 2012 and made public on 10 May 2013.

Affects: 6.0.21-6.0.36

Important: Denial of service CVE-2012-3544

When processing a request submitted using the chunked transfer
encoding, Tomcat ignored but did not limit any extensions that
were included. This allows a client to perform a limited DOS
by streaming an unlimited amount of data to the server.

This was fixed in revision 1476592.

This issue was reported to the Tomcat security team on
10 November 2011 and made public on 10 May 2013.

Affects: 6.0.0-6.0.36


ChangeLog:
++++++++++
Catalina

fix	52055: Ensure that filters are recycled. (markt/kkolinko)
fix	52184: Reduce log level for invalid cookies. (markt)
fix	53481: Added support for SSLHonorCipherOrder to allow the
	server to impose its cipher order on the client. Based on
	a patch provided by Marcel Šebek. (schultz)
fix	54044: Correct bug in timestamp cache used by logging
	(including the access log valve) that meant entries could
	be made with an earlier timestamp than the true timestamp. (markt)
fix	In FormAuthenticator: If it is configured to change
	Session IDs, do the change before displaying the login
	form. (kkolinko)
fix	54054: Do not share shell environment variables between
	multiple instances of the CGI servlet. (markt)
fix	54087: Correctly handle (ignore) invalid If-Modified-Since
	header rather than throwing an exception. (markt/kkolinko)
fix	54220: Ensure the ErrorReportValve only generates an error
	report if the error flag on the response has been set. (markt)
fix	Fix memory leak of servlet instances when running with
	a SecurityManager and either init() or destroy() methods
	fail or the servlet is a SingleThreadModel one, and of
	filter instances if their destroy() method fails with an
	Error. (kkolinko)
fix	54382: Fix NPE when SSI processing is enabled and an empty
	SSI directive is present. (markt)
fix	54483: Correct one of the Spanish translations. Based on
	a suggestion from adinamita. (kkolinko)
update	54527: Synchronize conf/web.xml mime mapping with Tomcat 7. (markt)

Coyote

fix	54248: Ensure that byte order marks are swallowed when
	using a Reader to read a request body with a BOM for those
	encodings that require byte order marks. (markt)
fix	54324: Allow APR connector to disable TLS compression
	if OpenSSL supports it. (schultz)
fix	54456: Ensure that if a client aborts a request when
	sending a chunked request body that this is communicated
	correctly to the client reading the request body. (markt)
update	Update the native component of the APR/native connector
	to 1.1.27 and make that version the recommended minimum
	version. (kkolinko)

Jasper

fix	54615: Tomcat 6 doesn't build against ecj 4.x (kkolinko)

Cluster

fix	54045: Make sure getMembers() returns available member
	when TcpFailureDetector works in static cluster. (kfujino)

Web applications

update	22278: Add a commented out sample configuration of
	RemoteAddrValve to META-INF/context.xml files of the
	Manager and Host Manager applications. (kkolinko)
fix	54080: Clarify documentation for initial value of
	internalProxies attribute of RemoteIpValve. (schultz/kkolinko)
fix	54198: Clarify that HttpServletResponse.sendError(int)
	results in an HTML response by default. (markt)
fix	54207: Correct JNDI factory package name in Javadoc for
	org.apache.naming.java.javaURLContextFactory. (markt)

Other

update	Add sample Apache Commons Daemon JSVC wrapper script
	bin/daemon.sh that can be used with /etc/init.d. (kkolinko)
update	In the build configuration: introduce property
	"tomcat.output" that is used to specify location of the
	build output directory. This simplifies configuration if
	someone wants to move the output directory elsewhere
	(e.g. out of the source tree). (kkolinko)
fix	54390: Use 'java_home' on Mac OS X to auto-detect
	JAVA_HOME. (schultz)
update	54601: Change catalina.sh to consistently use
	LOGGING_MANAGER variable to configure logging, instead
	of modifying JAVA_OPTS one. (kkolinko)
update	54890: Update to Apache Commons Daemon 1.0.15. (mturk)
Update math/ntl to version 6.0.0

Differences from previous version (5.5.2):

	2013.02.15: Changes between NTL 5.5.2 and 6.0

	Replaced the old template-like macros for vectors, matrices, and pairs
	with true template classes:  Vec<T>, Mat<T>, and Pair<S,T>.  For
	backwards compatibilty, all the names that were used in previous
	versions (e.g., vec_ZZ_p, mat_ZZ_p) have been replaced with
	appropriate typedefs.

	For many years, I resisted the temptation of using templates, because
	compiler support was very inconsistent.  But that no longer seems to
	be the case.

	This change, while rather sweeping, should create very few, if any,
	incompatibilities with existing software.  The biggest issue would be
	for software that uses the old template-like macros:  such macro
	invocations can simply be replaced with appropriate typedefs.

	Made the conversion interface more complete and uniform.  Also, using
	template notation, one can and should now write conv<ZZ>(a) instead of
	to_ZZ(a) (for backward compatibility, all the old names to_XXX are
	still there, but many new conversions are not available under these
	old names).  There are many new conversions provided.  Moreover,
	whenever there is a conversion from a ring R to a ring S, there is a
	corresponding, coefficiet-wise conversion from the polynomial ring
	R[X] to the polynomial ring R[X].

	In addition, using the template mechanism, there are generic
	conversions for vectors and matrices.  For example, if there is a
	conversion from S to T, then there is automatically a corresponding
	component-wise conversion from Vec<S> to Vec<T>.

	Introduced a more general mechanism for accessing GF2's in packed
	structures via indexing (see the class ref_GF2 in the GF2 module).
	Employed ideas from David Harvey to make the single-precision FFT
	faster (about twice as fast in many cases).  This speeds up many
	higher-level operations.

	Fixed all known bugs.
Note update of math/ntl to version 6.0.0
Initial import of HElib, a library to perform homomorphic encryption,
into the Packages Collection.

	HElib is a software library that implements homomorphic encryption
	(HE).  Currently available is an implementation of the
	Brakerski-Gentry-Vaikuntanathan (BGV) scheme, along with many
	optimizations to make homomorphic evaluation run faster, focusing
	mostly on effective use of the Smart-Vercauteren ciphertext packing
	techniques and the Gentry-Halevi-Smart optimizations.
Add and enable security/HElib
Note addition of security/HElib
Changes 4.4.6:
* improved sftp backend with symlink info retrieving (readlink).
* new cls option -a to show dot files.
* new setting cmd:cls-exact-time.
* fixed NULL dereference when torrent:use-dht is off.
* fixed torrent for info_hash with NUL character (broken in 4.4.4).
Updated net/lftp to 4.4.6
Update to 3.08. Changes:

Fixed handling of --ignore-warnings and --ignore-errors so that these
are now required to process files with warnings or errors.

Added --test-eps making a partial test of EPS compliance.

Added --dump for displaying summary of DSC information.
Updated print/epstool to 3.08
Update atk to 2.8.0

Changes in version 2.8.0:
==========================
*
* Updated Visual C++ configuration files
  * Make entries more consistent with the other GNOME Visual Studio
    projects.
  * Enable the building of introspection files for Visual C++ builds
  * bgo694255: Visual C++ builds: Integrate building of introspection files
* Updated Slovak, Portuguese and Tadjik translation.

Changes in version 2.7.91:
==========================
*
* atkobject: added a explicit include to locale.h

Changes in version 2.7.90:
==========================
*
* Bug 694117
*  * atkobject: add atk_object_get_object_locale
*  * atkdocument: deprecate atk_document_get_locale

Changes in version 2.7.5:
==========================
*
* build: Use GNOME_COMPILE_WARNINGS
* atkhyperlink: Ensure we get even deprecated prototypes
* Bug 651343: add ATK_ROLE_LEVEL_BAR
* Prepare Visual Studio 2010 projects for Visual Studio 2012
* Updated Uyghur translations

Changes in version 2.7.4:
==========================
*
* Bug 690379: Atk lacks any kind of version utilities
* Fixed out of tree builds caused by fix of bug 690379
* Bug 656750: AtkWindow requires documentation

Changes in version 2.7.3:
==========================
*
* Bug 689907: Problems with the management of
*  ATK_STATE_SELECTABLE/ATK_STATE_SELECTED states at AtkObject
* Bug 686746: Port introspection fixes from Vala
* Bug 689952: Add introspection support for Windows MSVC builds
* Other Visual C++ configuration files:
*  * Use MultiByte character set

Changes in version 2.7.2:
==========================
*
* Bug 686801: Extend atk_add_global_event_listener in order to support
*   signal details
* Updated Thai translation.
Updated devel/atk to 2.8.0
Update at-spi2-core to 2.8.0

* Add atspi_accessible_get_object_locale (BGO#694368).
* Start the bus launcher in the initialization phase (BGO#694984).
* Removed a debug print that was accidentally included in 2.7.5.
* Add ATSPI_ROLE_LEVEL_BAR to correspond to the new atk role.
* Fix various compiler warnings.
* Fix some ref count leaks.
* Some functions that return accessibles now propagate errors.
* Atspi_accessible_get_index_in_parent no longer returns -1 if the object's
  parent is not cached (BGO#688057).
* re-register keystroke listeners if the registry goes away and then returns.
* Fix atspi_device_listener_new_simple.
* Fix some compiler warnings.
* Build: use gobject-introspection's Makefile instead of rolling our own.
* Fix a crash when parsing events without detail when there is a listener
  for the event that names a specific detail value.
* Fix crash when removing hung processes.
* Fix deregistering of applications.
* A few documentation fixes.
* Only call an event listener once per event, even if the listener registered
  for both the event and a superset of the event.
* Don't distribute dbind-config.h (BGO#688083).
* Fix gtk-doc for Atspi-Registry (BGO#688224).
* Some introspection fixes to make vapigen happy (BGO#688223).
* [registry] Fixed a crash handling DeregisterKeystrokeListener.
* Update the cache in response to role change notifications (BGO#685469).
* Don't output a warning when a p2p connection isn't available.
Updated devel/at-spi2-core to 2.8.0
Update at-spi2-atk to 2.8.1

* Add Locale property (BGO#694368).
* Bump atk dependency to 2.7.5 (BGO#693189).
* Support ATSPI_ROLE_LEVEL_BAR to correspond to the new atk role.
* Fix various compiler warnings.
* re-register if the registry goes away and later returns.
* Stop using deprecated glib functions.
* Fix a few memory leaks.
* atk-adaptor: don't emit a critical in case the bridge was not initialized
  (BGO#684334).
* Remove dbind (it was only used for the droute test).
* Fix a crash in socket_embed_hook if spi_global_register is NULL.
* [droute] Fix memory leak in path cleanup (BGO#688363).
* Remove the schema; it was only used to specify the location of the
  atk-bridge library, which is now installed in the standard path.
* Fix compiler warnings (BGO#678045).
Updated devel/at-spi2-atk to 2.8.1
Update gdk-pixbuf2 to 2.28.1

* Fix build with libpng 1.6
* Translation updates (Tadjik, Russian, Crimean Tatar, Hindi)
* Allow prepare_func call in stop_load (695228)
* Translation updates (Lithuanian, German, Basque, Belarusian,
  Thai, Greek, Indonesian, Korean, Assamese, Italian, Estonian,
  Hungarian, Portuguese, Danish, Latvian)
* Make gdk_pixbuf_animation_new_from_file load png files (694148)
* Fix string formatting for l10n extraction (693534)
* Translation updates (Hebrew, Spanish, Brazilian Portuguese,
  Slovenian, Galician, French, Catalan, Catalan (Valencian),
  Malayalam, Slovak, Polish, Czech, Serbian, Uyghur, Norwegian
  bokmål, Punjabi, Traditional Chinese)
* Allow loading animations from streams
* Allow loading animations from resources
* Fix cross-compiling for Windows and Wine (692072)
* Translation updates (Hungarian, German, Polish)
* The broken locking mechanism for loaders has been removed.
  gdk-pixbuf now ignores loaders that are not marked as thread-safe.
Updated graphics/gdk-pixbuf2 to 2.28.1
Update gtk3 to version 3.8.2
Rename patch-gtk_a11y_gail.c to patch-gtk_a11y_gtkaccessibility.c

Many improvements, bug fixes and translation updates:
https://git.gnome.org/browse/gtk+/tree/NEWS?id=3.8.2

Highlights:

* Deprecations and removals:
 - Custom CSS properties have been deprecated
 - Support for color schemes has been removed
 - gtk_style_provider_get_style, gtk_style_provider_get_icon_factory
 - GtkGradient and GtkSymbolicColor
 - All the padding style properties in menus

* CSS improvements:
 - Add cycle detection to color resolving

* A lot of filechooser button fixes

* The print dialog now shows printers that are discovered
  using avahi, if configured with --enable-avahi-browsing

* We now support the Window Manager frame synchronization protocol draft (when
  running under a WM that supports it). This means applications will throttle
  their drawing cycle to what the compositor is drawing, and the compositor
  will never render half-updated windows, for seamless resizing and improved
  smoothness in drawing.
  See https://mail.gnome.org/archives/wm-spec-list/2013-January/msg00000.html
  and the articles at http://blog.fishsoup.net/ for more details.

* We now support setting an opacity to any GtkWidget, not just toplevels:
  gtk_window_set_opacity has been deprecated in favor of gtk_widget_set_opacity.

* GtkIconTheme gained asynchronous loaders for GtkIconInfo objects

* GtkIconInfo has changed from being a boxed type to a GObject. This
  is technically an ABI change, but basically all existing code
  will keep working if its used as a boxed type, and its not
  possible to instantiate GtkIconInfos outside Gtk, so this is not
  expected to be a big problem.

* GtkTreeView and GtkIconView allow single-click activation

* GtkImage can be set from a resource

* GdkWaylandDisplay is now public

* gdk_window_set_fullscreen_mode: new function to let windows
  be fullscreened across multiple monitors

* We now use state flags for text direction: GTK_STATE_FLAG_LTR/RTL.
  gtk_style_context_set_direction() has been deprecated.

* We install headers for accessible implementations of GTK+ widgets.
  This makes it possible to implement accessibility for third-party
  widgets by subclassing the proper GTK+ implementation. To do this,
  include gtk/gtk-a11y.h.

* Invisible widgets now return a size of 0x0. This is an experimental
  change that makes GtkWidget::visible essentially behave the same way
  that "display: none" does in CSS. If you want the effect of CSS's
  "visibility: hidden", you can use a GtkNotebook with an empty page.

* GtkFrame now draws a background.

* The Broadway backend now installs a separate server: broadwayd.

* GtkBuilder now lets you refer to external objects from a ui
  file if the objects have been exported with the new function
  gtk_builder_expose_object()

* Font handling has been improved:
 - The default font is no longer handled like a custom style sheet
   that overrides everything, but as the initial value. This is the
   same behavior as in web browsers.
 - It is now possible to set font-family and font-size like other
   CSS properties, and relative font sizes are supported. Font
   sizes in CSS can be specified as numbers or with keywords
   like xx-small, medium, smaller, larger,...

* GTK+ now uses proper Unicode ellipses in strings.
Updated x11/gtk3 to 3.8.2