- ruby-tw-1.0.2 [pkg/48447] (1.0.8 now)
+ ruby-ncurses-1.3.1
Changes 2.2.27:

  *) SECURITY: CVE-2014-0098 (cve.mitre.org)
     Clean up cookie logging with fewer redundant string parsing passes.
     Log only cookies with a value assignment. Prevents segfaults when
     logging truncated cookies.

  *) SECURITY: CVE-2013-6438 (cve.mitre.org)
     mod_dav: Keep track of length of cdata properly when removing
     leading spaces. Eliminates a potential denial of service from
     specifically crafted DAV WRITE requests

  *) core: draft-ietf-httpbis-p1-messaging-23 corrections regarding
     TE/CL conflicts.

  *) mod_proxy_http: Core dumped under high load. PR 50335.

  *) proxy_util: NULL terminate the right buffer in 'send_http_connect'.

  *) mod_proxy: Remove (never documented) <Proxy ~ wildcard-url> syntax which
     is equivalent to <ProxyMatch wildcard-url>.

  *) mod_ldap: Fix a potential memory leak or corruption.

  *) mod_ssl: Do not perform SNI / Host header comparison in case of a
     forward proxy request.

  *) mod_rewrite: Add mod_rewrite.h to the headers installed on Windows.
Updated www/apache22 to 2.2.27
+ abcm2ps-7.8.0, anjuta-3.12.0, calibre-1.30, gama-1.15, gdl-3.12.0,
  glade-3.18.1, gmp-6.0.0, gnome-3.12, gnome-keyring-3.12.0,
  grilo-plugins-0.2.12, json-glib-1.0.0, libgee-0.14.0,
  libgnome-keyring-3.12.0, mousetweaks-3.12.0, ocrad-0.23, openssh-6.6,
  phpmyadmin-4.1.12, seahorse-3.12.0, tea-37.2.0, webkit-gtk-2.4.0,
  xf86-video-vmware-13.0.2.
Update dansguardian to 2.12.0.3

* Applied patch #9 (Crash when more than one authplugin are selected)
  by Frederic Bourgeois
* Added feature to allow Facebook mock ajax (request #6) by Jason Spiro
* Added contrib dir
* Added a new html & css validated html template in contrib (request #3).
  By Chris Peschke
* Converted iso-8859 message files to utf-8 (bug #86). Suggested
  by Fred Ulisses Maranhao
* Fixed Error reading Content-Length (bug #84). By Carlos Soto
* Fixed compilation error BSD due lack of string.h when using
  memcpy() (bug #75). By Alexander Hornung
* Fixed exceptioniplist case sensitivity (bug #11). By Mark J Hewitt
* Fixed accept-encoding support for new tokens (bug #13). By userquin
* Applied patch 3438750 (GCC 4.4 and 4.6 compatibility) by Mathieu PARENT
* Applied patch 3438749 (French translation update) by Mathieu PARENT
* Applied patch 3418297 (Set proxy timeout in dansguardian.conf)
  by Frederic Bourgeois
* Applied patch 3419088 (login/password in URL is dropped) by Mathieu PARENT
* Applied patch 3419089 ("Expect" header should be dropped) by Mathieu PARENT
* Applied patch 3438751 (Fix queue handling in OptionContainer)
  by Mathieu PARENT
* Applied patch 3515167 (Fix digest identication) by Frederic Bourgeois
* Fixed GCC warnings
* LFS review in String.cpp (requires different arch review yet)

Previous release notes seem to be lost - the build structure changed, and:

  Both the main configuration file and the filter group configuration
  file(s) have changed since the last stable release.  If you try
  to re-use the configuration from an existing copy of 2.8.0.6 or
  earlier, the daemon will not start.  On the other hand, list
  files (phrase lists, domain lists, etc.) have not changed format,
  and should largely "just work".  There have been improvements to
  the default list files, though, so again it is recommended that
  you start from the new version and re-do any customisations.
Updated www/dansguardian to 2.12.0.3
add patch from upstream to fix heap-based buffer overflow which can lead
to arbitrary code execution (CVE-2014-2525)
bump PKGREV
add patch from upstream (XSA-89) to fix:
Processing of the HVMOP_set_mem_access HVM control operations does not
check the size of its input and can tie up a physical CPU for extended
periods of time.
bump PKGREV
Version 1.3.11 (2013-07-27)
  o OSPF stub router option (RFC 3137).
  o TTL security for OSPF and RIP.
  o Protocol packet priority and traffic class handling.
  o Multiple routing tables support for FreeBSD and OpenBSD.
  o Extends constants to all filter data types.
  o Implements eval command.
  o 'bgppath ~ int set' filter operation.
  o Several bugfixes.

Version 1.3.10 (2013-04-30)
  o Lightweight BIRD client for embedded environments.
  o Dynamic IPv6 router advertisements.
  o New 'next hop keep' option for BGP.
  o Smart default routing table for 'show route export/preexport/protocol'.
  o Automatic router ID selection could be configured to use address of loopback.
  o Allows configured global addresses of NBMA neighbors in OSPFv3.
  o Allows BIRD commands from UNIX shell even in restricted mode.
  o Route limits inherited from templates can be disabled.
  o Symbol names enclosed by apostrophes can contain dots.
  o Several bugfixes.

Version 1.3.9 (2013-01-11)
  o BIRD can be configured to keep and show filtered routes.
  o Separate receive and import limits.
  o Several new reconfiguration cmd options (undo, timeout, check).
  o Configurable automatic router ID selection.
  o Dragonfly BSD support.
  o Fixed OSPFv3 vlinks.
  o Several minor bugfixes.

Version 1.3.8 (2012-08-07)
  o Generalized import and export route limits.
  o RDNSS and DNSSL support for RAdv.
  o Include in config file support wildcards.
  o History deduplication in BIRD client.
  o New route attributes krt_source, krt_metric.
  o Different instance ID support for OSPFv3.
  o Real broadcast mode for OSPFv2.
  o Several minor bugfixes.

Version 1.3.7 (2012-03-22)
  o Route Origin Authorization basics.
  o RIPng working again.
  o Extended clist operations in filters.
  o Fixes several bugs in BSD iface handling.
  o Several minor bugfixes and enhancements.
Updated net/bird to 1.3.11
Update to 0.8.8.5 for security fixes.

10 March 2014: libmodplug 0.8.8.5

    A very long time between the last release (although some
    occasional activity occured in git)
    The code is now in both the sourceforge git tree (as a full
    project), as well as github (only libmodplug): Here.
    Some security patches: CVE-2013-4233, CVE-2013-4234, as well
    as many fixes suggested by static analyzers: clang build-scan,
    and coverity.
    A few patches to ease compilation in windows environments,
    including a CMakeLists file.
Updated audio/libmodplug to 0.8.8.5
+ cvs-fast-export-1.10, glpk-4.54, reposurgeon-3.8,
  xorg-util-macros-1.19.0, xrandr-1.4.2.
Fix ruby-readline build problem with readline 6.3 and later.
Update to 0.18.4

Changelog:

aria2 1.18.4
============

Release Note
------------

This release adds new RPC authorization mechanism using --rpc-secret
option.  The existing --rpc-user and --rpc-passwd options are now
deprecated, and all applications using RPC API is strongly encouraged
to migrate to the new mechanism.  See RPC INTERFACE section in aria2
manual page for the details.  The new RPC method, aria2.saveSession,
was added, which tells aria2 server to save session file immediately.
There are several enhancements and bug fixes.  See the changes for the
details.

Changes
-------

* Added support for RPC channel encryption in aria2rpc

  Patch from David Macek

* Add aria2.saveSession RPC method

  This method saves the current session to a file specified by
  --save-session option. This method returns "OK" if it succeeds.

* Add numStoppedTotal key to aria2.getGlobalStat() RPC method response

  It shows the number of stopped downloads in the current session and
  not capped by --max-download-result option. On the other hand, the
  existing numStopped key also shows the number of stopped downloads,
  but it is capped by --max-download-result option.

* Better handling of 30x HTTP status codes

  Reference: http://greenbytes.de/tech/tc/httpredirects/

* Implement new RPC authorization using --rpc-secret option

  Add future deprecation warning to --rpc-user and --rpc-passwd.  Warn
  if neither --rpc-secret nor a combination of --rpc-user/rpc-passwd
  is set.

* Add --enable-color option to enable/disable terminal color output

* Add DSCP support

* gnutls: Don't fail handshake if returned error is not fatal

* Add workaround GnuTLS bug with OCSP status extension and
  non-blocking socket

  GnuTLS version 3.1.3 - 3.1.18 and 3.2.0 - 3.2.8, inclusive, has this
  bug. For these versions, we disable OCSP status extension.

* Make GnuTLS log level dependent on the aria2 ones


aria2 1.18.3
============

Release Note
------------

This release fixes the bug which may cause assertion failure after
multi-file downloads (e.g., multi-file metalink or torrent) are
performed several times due to the bad handling of --bt-max-open-files
option.

Changes
-------

* Fix crash if unpause failed before assigning BtProgressInfoFile
  object

* Enable and check PIE in makerelease-osx

* Fix bug that numOpenFile_ is not reduced when MultiDiskAdaptor is
  deleted

  This bug caused assertion error in
  RequestGroupMan::ensureMaxOpenFileLimit
Updated net/aria2 to 1.18.4
Reduce GCC_REQD. Thank you, richard@.
Fix build with gcc 4.8.
Update openssh to 6.6.1 (OpenSSH 6.6p1).

pkgsrc change

    * Use PLIST_VARS.
    * Update hpn-patch based on openssh-6.5p1-hpnssh14v4.diff.gz.

Fixes security problem (SA57488).

For full changes, please refer below release notes.

	http://www.openssh.com/txt/release-6.5
	http://www.openssh.com/txt/release-6.6