Pullup ticket #4046 - requested by drochner
net/libupnp: security patch

Revisions pulled up:
- net/libupnp/Makefile                                          1.20
- net/libupnp/distinfo                                          1.19

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Tue Jan 29 16:22:47 UTC 2013

   Modified Files:
           pkgsrc/net/libupnp: Makefile distinfo

   Log Message:
   update to 1.6.18
   changes:
   -fix multiple buffer overflows (CVE-2012-5958..65)
   -more bugfixes, Compilation optimisation
Pullup ticket #4046.
Pullup ticket #4048 - requested by drochner
multimedia/vlc2: security patch

Revisions pulled up:
- multimedia/vlc2/Makefile                                      1.23 via patch
- multimedia/vlc2/distinfo                                      1.14
- multimedia/vlc2/patches/patch-SA1302                          1.1

---
   Module Name:    pkgsrc
   Committed By:   drochner
   Date:           Wed Jan 30 15:52:19 UTC 2013

   Modified Files:
           pkgsrc/multimedia/vlc2: Makefile distinfo
   Added Files:
           pkgsrc/multimedia/vlc2/patches: patch-SA1302

   Log Message:
   add patch from upstream to fix Buffer Overflow in ASF Demuxer
   bump PKGREV
Pullup ticket #4048.
Pullup ticket #4049 - requested by ryoon
pkgsrc/x11/py-gtk2: build fix

Revisions pulled up:
- x11/py-gtk2/buildlink3.mk                                     1.42

---
   Module Name:	pkgsrc
   Committed By:	ryoon
   Date:		Thu Jan 31 18:30:50 UTC 2013

   Modified Files:
   	pkgsrc/x11/py-gtk2: buildlink3.mk

   Log Message:
   * py-numpy should be buildlinke-ed on g95 support platforms only like Makefile.
Pullup ticket #4050 - requested by obache
emulators/suse121_qt4: security update

Revisions pulled up:
- emulators/suse121_qt4/Makefile                                1.3
- emulators/suse121_qt4/distinfo                                1.3

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Fri Feb  1 11:12:30 UTC 2013

   Modified Files:
   	pkgsrc/emulators/suse121_qt4: Makefile distinfo

   Log Message:
   Update libqt4 RPMs to 4.7.4-19.17.1 for CVE-2012-6093.

   Bump PKGREVISION.
Pullup ticket #4051 - requested by obache
www/opera: security update

Revisions pulled up:
- www/opera/Makefile                                            1.102
- www/opera/PLIST                                               1.10
- www/opera/distinfo                                            1.44

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Fri Feb  1 11:50:43 UTC 2013

   Modified Files:
   	pkgsrc/www/opera: Makefile PLIST distinfo

   Log Message:
   Update opera to 12.13.

   Opera 12.13 is a recommended upgrade offering security and stability
   enhancements.

   Fixes and Stability Enhancements since Opera 12.12
   General and User Interface
      * Fixed an issue where Opera gets internal communication errors on Facebook
      * Fixed an issue where no webpages load on startup, if Opera is disconnected
        from the Internet
      * Fixed an issue where images will not load after back navigation, when a site
        uses the HTML5 history API (deviantart.com)
        Linux and Windows
          * A new stand-alone update-checker, as part of a planned upgrade of the
   	auto-update system
        Windows
          * Improved protection against hijacking of the default search, including
   	a one-time reset
   Security
      * Fixed an issue where DOM events manipulation might be used to execute
        arbitrary code, as reported by Arthur Gerkis; see our advisory:
          http://www.opera.com/support/kb/view/1042/
      * Fixed an issue where use of SVG clipPaths could allow execution of arbitrary
        code, as reported by anonymous via the iSIGHT Partners GVP Program; see our
        advisory:
          http://www.opera.com/support/kb/view/1043/
      * Fixed a low severity security issue; details will be disclosed at a later
        date
      * Fixed an issue where CORS requests could omit the preflight request, as
        reported by webpentest; see our advisory:
          http://www.opera.com/support/kb/view/1045/
Pullup tickets #4049, #4050 and #4051.
Pullup ticket #4053 - requested by taca
net/samba35: security update

Revisions pulled up:
- net/samba35/Makefile                                          1.26
- net/samba35/distinfo                                          1.15

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Jan 30 11:41:44 UTC 2013

   Modified Files:
   	pkgsrc/net/samba35: Makefile distinfo

   Log Message:
   Update samba35 to 3.5.21.

                      ==============================
                      Release Notes for Samba 3.5.21
   			 January 30, 2013
                      ==============================

   This is a security release in order to address
   CVE-2013-0213 (Clickjacking issue in SWAT) and
   CVE-2013-0214 (Potential XSRF in SWAT).

   o  CVE-2013-0213:
      All current released versions of Samba are vulnerable to clickjacking in the
      Samba Web Administration Tool (SWAT). When the SWAT pages are integrated into
      a malicious web page via a frame or iframe and then overlaid by other content,
      an attacker could trick an administrator to potentially change Samba settings.

      In order to be vulnerable, SWAT must have been installed and enabled
      either as a standalone server launched from inetd or xinetd, or as a
      CGI plugin to Apache. If SWAT has not been installed or enabled (which
      is the default install state for Samba) this advisory can be ignored.

   o  CVE-2013-0214:
      All current released versions of Samba are vulnerable to a cross-site
      request forgery in the Samba Web Administration Tool (SWAT). By guessing a
      user's password and then tricking a user who is authenticated with SWAT into
      clicking a manipulated URL on a different web page, it is possible to manipulate
      SWAT.

      In order to be vulnerable, the attacker needs to know the victim's password.
      Additionally SWAT must have been installed and enabled either as a standalone
      server launched from inetd or xinetd, or as a CGI plugin to Apache. If SWAT has
      not been installed or enabled (which is the default install state for Samba)
      this advisory can be ignored.

   Changes since 3.5.20:
   ---------------------

   o   Kai Blin <kai@samba.org>
       * BUG 9576: CVE-2013-0213: Fix clickjacking issue in SWAT.
       * BUG 9577: CVE-2013-0214: Fix potential XSRF in SWAT.
Pullup ticket #4053.
Pullup ticket #4054 - requested by taca
net/samba: security update

Revisions pulled up:
- net/samba/Makefile                                            1.228 via patch
- net/samba/distinfo                                            1.88

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Jan 30 11:42:55 UTC 2013

   Modified Files:
   	pkgsrc/net/samba: Makefile distinfo

   Log Message:
   Update samba to 3.6.12.

                      ==============================
                      Release Notes for Samba 3.6.12
                             January 30, 2013
                      ==============================

   This is a security release in order to address
   CVE-2013-0213 (Clickjacking issue in SWAT) and
   CVE-2013-0214 (Potential XSRF in SWAT).

   o  CVE-2013-0213:
      All current released versions of Samba are vulnerable to clickjacking in the
      Samba Web Administration Tool (SWAT). When the SWAT pages are integrated into
      a malicious web page via a frame or iframe and then overlaid by other content,
      an attacker could trick an administrator to potentially change Samba settings.

      In order to be vulnerable, SWAT must have been installed and enabled
      either as a standalone server launched from inetd or xinetd, or as a
      CGI plugin to Apache. If SWAT has not been installed or enabled (which
      is the default install state for Samba) this advisory can be ignored.

   o  CVE-2013-0214:
      All current released versions of Samba are vulnerable to a cross-site
      request forgery in the Samba Web Administration Tool (SWAT). By guessing a
      user's password and then tricking a user who is authenticated with SWAT into
      clicking a manipulated URL on a different web page, it is possible to manipulate
      SWAT.

      In order to be vulnerable, the attacker needs to know the victim's password.
      Additionally SWAT must have been installed and enabled either as a standalone
      server launched from inetd or xinetd, or as a CGI plugin to Apache. If SWAT has
      not been installed or enabled (which is the default install state for Samba)
      this advisory can be ignored.

   Changes since 3.6.11:
   --------------------

   o   Kai Blin <kai@samba.org>
       * BUG 9576: CVE-2013-0213: Fix clickjacking issue in SWAT.
       * BUG 9577: CVE-2013-0214: Fix potential XSRF in SWAT.
Pullup ticket #4052 - requested by taca
databases/ruby-activerecord3: security update
devel/ruby-activemodel: security update
devel/ruby-activesupport3: security update
devel/ruby-railties: security update
mail/ruby-actionmailer3: security update
www/ruby-actionpack3: security update
www/ruby-activeresource3: security update
www/ruby-rails3: security update

Revisions pulled up:
- databases/ruby-activerecord3/distinfo                         1.18
- devel/ruby-activemodel/distinfo                               1.18
- devel/ruby-activesupport3/PLIST                               1.2
- devel/ruby-activesupport3/distinfo                            1.19
- devel/ruby-railties/distinfo                                  1.18
- lang/ruby/rails.mk                                            1.38
- mail/ruby-actionmailer3/distinfo                              1.20
- www/ruby-actionpack3/distinfo                                 1.19
- www/ruby-activeresource3/distinfo                             1.18
- www/ruby-rails3/distinfo                                      1.19

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:36:12 UTC 2013

   Modified Files:
   	pkgsrc/lang/ruby: rails.mk

   Log Message:
   Start update of Ruby on Rails 3.0.20.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:37:52 UTC 2013

   Modified Files:
   	pkgsrc/devel/ruby-activesupport3: PLIST distinfo

   Log Message:
   Update ruby-activesupport3 to 3.0.20.

   Fix CVE-2013-0333.

   There is a vulnerability in the JSON  code for Ruby on Rails which
   allows attackers to bypass authentication systems, inject arbitrary
   SQL, inject and execute arbitrary code, or perform a DoS attack on a
   Rails application.

   ## Rails 3.0.20 (unreleased)

   * Fix XML serialization of methods that return nil to not be
     considered as YAML (GH #8853 and GH #492)

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:38:40 UTC 2013

   Modified Files:
   	pkgsrc/devel/ruby-activemodel: distinfo

   Log Message:
   Update ruby-activemodel to 3.0.20.

   Fix CVE-2013-0333.

   There is a vulnerability in the JSON  code for Ruby on Rails which
   allows attackers to bypass authentication systems, inject arbitrary
   SQL, inject and execute arbitrary code, or perform a DoS attack on a
   Rails application.

   ## Rails 3.0.20 (unreleased)

   * Fix XML serialization of methods that return nil to not be
     considered as YAML (GH #8853 and GH #492)

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:39:33 UTC 2013

   Modified Files:
   	pkgsrc/www/ruby-activeresource3: distinfo

   Log Message:
   Update ruby-activeresource3 to 3.0.20.

   No change except version.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:40:43 UTC 2013

   Modified Files:
   	pkgsrc/databases/ruby-activerecord3: distinfo

   Log Message:
   Update ruby-activerecord3 to 3.0.20.

   No change except version.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:41:17 UTC 2013

   Modified Files:
   	pkgsrc/www/ruby-actionpack3: distinfo

   Log Message:
   Update ruby-actionpack3 to 3.0.20.

   No change except version.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:41:49 UTC 2013

   Modified Files:
   	pkgsrc/mail/ruby-actionmailer3: distinfo

   Log Message:
   Update ruby-actionmailer3 to 3.0.20.

   No change except version.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:42:27 UTC 2013

   Modified Files:
   	pkgsrc/devel/ruby-railties: distinfo

   Log Message:
   Update ruby-railties to 3.0.20.

   No change except version.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jan 29 15:42:58 UTC 2013

   Modified Files:
   	pkgsrc/www/ruby-rails3: distinfo

   Log Message:
   Update ruby-rails3 to 3.0.20.

   No change except version.
Pullup tickets #4052 and #4054.