Pullup ticket #4055 - requested by taca
security/openssl: security update

Revisions pulled up:
- security/openssl/Makefile                                     1.172
- security/openssl/distinfo                                     1.91

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Feb  5 15:54:31 UTC 2013

   Modified Files:
   	pkgsrc/security/openssl: Makefile distinfo

   Log Message:
   Update openssl to 0.9.8y.

    Changes between 0.9.8x and 0.9.8y [5 Feb 2013]

     *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time=
   .=


        This addresses the flaw in CBC record processing discovered by
        Nadhem Alfardan and Kenny Paterson. Details of this attack can be =
   found
        at: http://www.isg.rhul.ac.uk/tls/

        Thanks go to Nadhem Alfardan and Kenny Paterson of the Information=

        Security Group at Royal Holloway, University of London
        (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley an=
   d
        Emilia K=E4sper for the initial patch.
        (CVE-2013-0169)
        [Emilia K=E4sper, Adam Langley, Ben Laurie, Andy Polyakov, Steve H=
   enson]

     *) Return an error when checking OCSP signatures when key is NULL.
        This fixes a DoS attack. (CVE-2013-0166)
        [Steve Henson]

     *) Call OCSP Stapling callback after ciphersuite has been chosen, so
        the right response is stapled. Also change SSL_get_certificate()
        so it returns the certificate actually sent.
        See http://rt.openssl.org/Ticket/Display.html?id=3D2836.
        (This is a backport)
        [Rob Stradling <rob.stradling@comodo.com>]

     *) Fix possible deadlock when decoding public keys.
        [Steve Henson]
Pullup tickets #4055.
Pullup ticket #4059 - requested by obache
emulators/suse121_base: security update

Revisions pulled up:
- emulators/suse121_base/Makefile                               1.6
- emulators/suse121_base/distinfo                               1.5

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Sat Feb  9 09:39:28 UTC 2013

   Modified Files:
   	pkgsrc/emulators/suse121_base: Makefile distinfo

   Log Message:
   Update coreutils RPM to 8.14-3.19.1 for CVE-2013-0221 CVE-2013-0222 and
   CVE-2013-0223.

   Bump PKGREVISION.
Merge branch 'pkgsrc_2012Q4' into joyent/feature/sngl/2012Q4
Pullup ticket #4058 - requested by obache
multimedia/adobe-flash-plugin11: security update

Revisions pulled up:
- multimedia/adobe-flash-plugin11/Makefile                      1.11
- multimedia/adobe-flash-plugin11/distinfo                      1.10

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Sat Feb  9 09:24:37 UTC 2013

   Modified Files:
   	pkgsrc/multimedia/adobe-flash-plugin11: Makefile distinfo

   Log Message:
   Update adobe-flash-plugin11 to 11.2.202.262 for APSB13-04.
Pullup ticket #4061 - requested by taca
mail/roundcube: security update

Revisions pulled up:
- mail/roundcube/Makefile                                       1.50-1.51
- mail/roundcube/PLIST                                          1.26
- mail/roundcube/distinfo                                       1.28
- mail/roundcube/files/roundcube.conf                           1.5

---
   Module Name:	pkgsrc
   Committed By:	jym
   Date:		Tue Jan  8 23:27:55 UTC 2013

   Modified Files:
   	pkgsrc/mail/roundcube/files: roundcube.conf

   Log Message:
   roundcube defines its default configuration in .htaccess files and this
   will take precedence over any parameter specified in the <Directory>
   section.

   So remove the php blocks and add a comment to explain this.

---
   Module Name:	pkgsrc
   Committed By:	jym
   Date:		Thu Jan 10 00:15:55 UTC 2013

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile

   Log Message:
   Bump revision, as noted by wiz@ and gdt@. Thanks!

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Feb  8 14:01:03 UTC 2013

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile PLIST distinfo

   Log Message:
   Update roundcube to 0.8.5.

   CHANGELOG Roundcube Webmail
   ===========================

   - Fix #countcontrols issue in IE<=8 when text is very long (#1488890)
   - Fix unwanted horizontal scrollbar in message preview header (#1488866)
   - Add workaround for IE<=8 bug where Content-Disposition:inline was ignored
     (#1488844)
   - Fix XSS vulnerability in vbscript: and data:text links handling (#1488850)
   - Fix absolute positioning in HTML messages (#1488819)
   - Fix keybord events on messages list in opera browser (#1488823)
   - Fix cache (in)validation after setting \Deleted flag
   - Fix selection of collapsed thread rows (#1488772)
   - Fix wrapping of quoted text with format=flowed (#1488177)
Pullup tickets #4058, #4059 and #4061.
Pullup ticket #4056 - requested by taca
lang/ruby193-base: security update

Revisions pulled up:
- lang/ruby/rubyversion.mk                                      1.93-1.94
- lang/ruby193-base/Makefile                                    1.21-1.23
- lang/ruby193-base/PLIST                                       1.5-1.6
- lang/ruby193-base/distinfo                                    1.14-1.16
- lang/ruby193-base/patches/patch-configure                     1.5-1.6
- lang/ruby193-base/patches/patch-configure.in                  1.5
- lang/ruby193-base/patches/patch-lib_rubygems.rb               1.2
- lang/ruby193-base/patches/patch-lib_rubygems_specification.rb 1.3
- lang/ruby193-base/patches/patch-lib_rubygems_version.rb       1.1
- lang/ruby193-base/patches/patch-random.c                      deleted
- lang/ruby193-base/patches/patch-test_rubygems_test__gem.rb    1.2

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Jan 31 15:56:14 UTC 2013

   Modified Files:
   	pkgsrc/lang/ruby: rubyversion.mk
   	pkgsrc/lang/ruby193-base: Makefile PLIST distinfo
   	pkgsrc/lang/ruby193-base/patches: patch-configure patch-configure.in
   	    patch-lib_rubygems.rb patch-test_rubygems_test__gem.rb
   Removed Files:
   	pkgsrc/lang/ruby193-base/patches: patch-random.c

   Log Message:
   Update ruby193 to 1.9.3p374 (Ruby 1.9.3-p374).

   These releasess don't include any security fixes.

   Ruby 1.9.3-p362:

   This release includes other many bug fixes.

       Resolved build problems on Solaris.
       Windows 8 support (hopefully).
       other many bug fixes.

   Ruby 1.9.3-p374:

   This release includes many bug fixes. Especially,

       Fixed randomly SEGV problem (often reported with Rails)
       Windows 8 support (maybe, hopefully)
       other many bug fixes.

   See tickets and ChangeLog for details.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sat Feb  2 08:11:54 UTC 2013

   Modified Files:
   	pkgsrc/lang/ruby193-base: Makefile distinfo
   	pkgsrc/lang/ruby193-base/patches: patch-lib_rubygems_specification.rb
   Added Files:
   	pkgsrc/lang/ruby193-base/patches: patch-lib_rubygems_version.rb

   Log Message:
   Add a two fixes from ruby-2.0.0/rubygems 1.8.25.

   * Allow multiple conditions for requirement of gem's specification since
     some newer gem already use this feature.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Feb  6 15:48:31 UTC 2013

   Modified Files:
   	pkgsrc/lang/ruby: rubyversion.mk
   	pkgsrc/lang/ruby193-base: Makefile PLIST distinfo
   	pkgsrc/lang/ruby193-base/patches: patch-configure

   Log Message:
   Update ruby193 pacakges to 1.9.3p385.

   This release includes a security fix about bundled RDoc.
   Full changes are too may to write here, please refer ChangeLog.
Pullup tickets #4056.
Pullup ticket #4057 - requested by taca
devel/ruby-rdoc: security update

Revisions pulled up:
- devel/ruby-rdoc/PLIST                                         1.7
- devel/ruby-rdoc/distinfo                                      1.9
- lang/ruby/rdoc.mk                                             1.12

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Feb  6 15:53:15 UTC 2013

   Modified Files:
   	pkgsrc/devel/ruby-rdoc: PLIST distinfo
   	pkgsrc/lang/ruby: rdoc.mk

   Log Message:
   Update ruby-rdoc to 3.12.1.

   === 3.12.1 / 2013-02-05

   * Bug fixes
     * Fixed an XSS exploit in darkfish.js.  This could lead to cookie disclosure
       to third parties.  See CVE-2013-0256[rdoc-ref:CVE-2013-0256.rdoc] for full
       details including a patch you can apply to generated RDoc documentation.
     * Ensured that rd parser files are generated before checking the manifest.
Pullup tickets #4057.
Pullup ticket #4060 - requested by taca
www/ruby-rack: security update
www/ruby-rack12: security update
www/ruby-rack13: security update

Revisions pulled up:
- www/ruby-rack/Makefile                                        1.14-1.15
- www/ruby-rack/distinfo                                        1.14
- www/ruby-rack12/Makefile                                      1.5
- www/ruby-rack12/distinfo                                      1.4
- www/ruby-rack13/Makefile                                      1.4
- www/ruby-rack13/distinfo                                      1.3

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Jan 31 16:03:34 UTC 2013

   Modified Files:
   	pkgsrc/www/ruby-rack: Makefile
   	pkgsrc/www/ruby-rack-cache: Makefile
   	pkgsrc/www/ruby-rack12: Makefile
   	pkgsrc/www/ruby-rack13: Makefile

   Log Message:
   Update HOMEPAGE to github's one.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Feb  8 13:19:13 UTC 2013

   Modified Files:
   	pkgsrc/www/ruby-rack12: Makefile distinfo

   Log Message:
   Update ruby-rack12 to 1.2.8.

   * February 7th, Thirty fifth public release 1.1.6, 1.2.8, 1.3.10
     * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Feb  8 13:19:57 UTC 2013

   Modified Files:
   	pkgsrc/www/ruby-rack13: Makefile distinfo

   Log Message:
   Update ruby-rack13 to 1.3.10.

   February 7th, Thirty fifth public release 1.1.6, 1.2.8, 1.3.10
     * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Fri Feb  8 13:22:00 UTC 2013

   Modified Files:
   	pkgsrc/www/ruby-rack: Makefile distinfo

   Log Message:
   Update ruby-rack to 1.4.5.

   * February 7th, Thirty fifth public release 1.4.5
     * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie
     * Fix CVE-2013-0262, symlink path traversal in Rack::File
Pullup ticket #4062 - requested by he
textproc/icu: build fix

Revisions pulled up:
- textproc/icu/hacks.mk                                         1.1

---
   Module Name:	pkgsrc
   Committed By:	jmcneill
   Date:		Fri Feb  1 03:44:22 UTC 2013

   Added Files:
   	pkgsrc/textproc/icu: hacks.mk

   Log Message:
   Fix NetBSD build with gcc <= 4.5 on arm (missing builtin atomics).
Pullup ticket #4063 - requested by he
pkgsrc/multimedia/gmplayer: build fix
pkgsrc/multimedia/mencoder: build fix
pkgsrc/multimedia/mplayer: build fix

Revisions pulled up:
- multimedia/gmplayer/distinfo                                  1.80
- multimedia/mplayer-share/Makefile.common                      1.52
- multimedia/mplayer-share/distinfo                             1.80
- multimedia/mplayer-share/patches/patch-aa                     1.31

---
   Module Name:	pkgsrc
   Committed By:	jmcneill
   Date:		Thu Jan 10 23:30:53 UTC 2013

   Modified Files:
   	pkgsrc/multimedia/mplayer-share: Makefile.common

   Log Message:
   libavutil moved to ffmpeg/libavutil, fix for arm build

---
   Module Name:	pkgsrc
   Committed By:	jmcneill
   Date:		Sat Jan 12 11:55:35 UTC 2013

   Modified Files:
   	pkgsrc/multimedia/gmplayer: distinfo
   	pkgsrc/multimedia/mplayer-share: distinfo
   	pkgsrc/multimedia/mplayer-share/patches: patch-aa

   Log Message:
   Fix configure script to correctly identify the host architecture on
   NetBSD/evbarm.
Pullup ticket #4064 - requested by he
audio/pulseaudio: build fix

Revisions pulled up:
- audio/pulseaudio/distinfo                                     1.35
- audio/pulseaudio/options.mk                                   1.5
- audio/pulseaudio/patches/patch-configure                      1.2
- audio/pulseaudio/patches/patch-src_Makefile.in                1.2

---
   Module Name:	pkgsrc
   Committed By:	tsutsui
   Date:		Tue Jan 29 15:02:24 UTC 2013

   Modified Files:
   	pkgsrc/audio/pulseaudio/patches: patch-configure

   Log Message:
   Always use atomic_ops(3) on NetBSD even on arm, i.e. kill Linux-ARM'ism.
   Fixes configure failure on NetBSD/arm 6.0.

   Also add patch comment.

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Tue Jan 29 15:34:47 UTC 2013

   Modified Files:
   	pkgsrc/audio/pulseaudio/patches: patch-src_Makefile.in

   Log Message:
   Add comment.

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Tue Jan 29 15:34:55 UTC 2013

   Modified Files:
   	pkgsrc/audio/pulseaudio: distinfo

   Log Message:
   regen

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Tue Jan 29 15:35:04 UTC 2013

   Modified Files:
   	pkgsrc/audio/pulseaudio: options.mk

   Log Message:
   Whitespace cleanup for pkglint.
Pullup ticket #4065 - requested by drochner
devel/boost-headers: security patch

Revisions pulled up:
- devel/boost-headers/Makefile                                  1.24
- meta-pkgs/boost/distinfo                                      1.56
- meta-pkgs/boost/patches/patch-CVE-2013-0252_1                 1.1
- meta-pkgs/boost/patches/patch-CVE-2013-0252_2                 1.1

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Tue Feb  5 18:49:06 UTC 2013

   Modified Files:
           pkgsrc/devel/boost-headers: Makefile
           pkgsrc/meta-pkgs/boost: distinfo
   Added Files:
           pkgsrc/meta-pkgs/boost/patches: patch-CVE-2013-0252_1
               patch-CVE-2013-0252_2

   Log Message:
   add patch from upstream to fix insuficcient validation of UTF-8 strings
   which is considered a security problem
   bump PKGREV for the affected header, didn't check yet where this
   header is compiled into
   (boost-1.53 is out, just added the patch for a possible pullup)
Pullup ticket #4066 - requested by drochner
www/curl: security patch

Revisions pulled up:
- www/curl/Makefile                                             1.123 via patch
- www/curl/distinfo                                             1.81
- www/curl/patches/patch-CVE-2013-0249                          1.1

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Fri Feb  8 15:45:42 UTC 2013

   Modified Files:
           pkgsrc/www/curl: Makefile distinfo
   Added Files:
           pkgsrc/www/curl/patches: patch-CVE-2013-0249

   Log Message:
   add patch from upstream to fix SASL buffer overflow vulnerability
   (CVE-2013-0249), bump PKGREV
Pullup ticket #4067 - requested by obache
multimedia/adobe-flash-plugin10.1: security update

Revisions pulled up:
- multimedia/adobe-flash-plugin10.1/Makefile                    1.24
- multimedia/adobe-flash-plugin10.1/distinfo                    1.15

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Wed Feb 13 11:23:10 UTC 2013

   Modified Files:
   	pkgsrc/multimedia/adobe-flash-plugin10.1: Makefile distinfo

   Log Message:
   Update adobe-flash-plugin10.1 to 10.3.183.61 for APSB-13-04 and APSB-13-05.
Pullup ticket #4068 - requested by obache
multimedia/adobe-flash-plugin11: security update

Revisions pulled up:
- multimedia/adobe-flash-plugin11/Makefile                      1.12
- multimedia/adobe-flash-plugin11/distinfo                      1.11

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Wed Feb 13 11:24:21 UTC 2013

   Modified Files:
   	pkgsrc/multimedia/adobe-flash-plugin11: Makefile distinfo

   Log Message:
   Update adobe-flash-plugin11 to 11.2.202.270 for APSB-13-05.
Pullup tickets #4062, #4063, #4064, #4065, #4066 and #4067.