Pullup ticket #4365 - requested by obache
emulators/suse131_libcurl: security update

Revisions pulled up:
- emulators/suse131_libcurl/Makefile                            1.3
- emulators/suse131_libcurl/distinfo                            1.3

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Sat Apr 12 01:00:46 UTC 2014

   Modified Files:
   	pkgsrc/emulators/suse131_libcurl: Makefile distinfo

   Log Message:
   Update suse131 libcurl4 RPM to 7.32.0-2.16.1 for CVE-2014-0138,
   CVE-2014-0139.

   Bump PKGREVISION.
Pullup ticket #4369 - requested by bsiegert
lang/python26: build fix

Revisions pulled up:
- lang/python26/Makefile                                        1.63
- lang/python26/distinfo                                        1.58
- lang/python26/patches/patch-am                                1.23
- lang/python27/Makefile                                        1.40
- lang/python27/distinfo                                        1.36
- lang/python27/patches/patch-am                                1.15

---
   Module Name:    pkgsrc
   Committed By:   bsiegert
   Date:           Sun Apr 13 14:56:56 UTC 2014

   Modified Files:
           pkgsrc/lang/python26: Makefile distinfo
           pkgsrc/lang/python26/patches: patch-am

   Log Message:
   Redo reverted commit from obache@. Original description:

   Prevent to detect unwanted builtin openssl.

   After bump of BUILDLINK_API_DEPENDS.openssl to 1.0.1c,
   buitin openssl is not acceptable for various platforms.

---
   Module Name:    pkgsrc
   Committed By:   bsiegert
   Date:           Sun Apr 13 15:06:20 UTC 2014

   Modified Files:
           pkgsrc/lang/python27: Makefile distinfo
           pkgsrc/lang/python27/patches: patch-am

   Log Message:
   Reapply reverted commit from obache@. Original description:

   Prevent to detect unwanted builtin openssl.

   After bump of BUILDLINK_API_DEPENDS.openssl to 1.0.1c,
   buitin openssl is not acceptable for various platforms.
Pullup ticket #4370 - requested by morr
www/wordpress: security update

Revisions pulled up:
- www/wordpress/Makefile                                        1.39
- www/wordpress/distinfo                                        1.31

---
   Module Name:	pkgsrc
   Committed By:	morr
   Date:		Sun Apr 13 14:10:59 UTC 2014

   Modified Files:
   	pkgsrc/www/wordpress: Makefile distinfo

   Log Message:
   Update to newest version of Wordpress, containing security fixes.

   It contains 9 bugfixes and 5 security fixes:

   * Potential authentication cookie forgery. CVE-2014-0166.
   * Privilege escalation: prevent contributors from publishing posts. CVE-2014-0165.
   * (Hardening) Pass along additional information when processing pingbacks to help hosts identify potentially abusive requests.
   * (Hardening) Fix a low-impact SQL injection by trusted users.
   * (Hardening) Prevent possible cross-domain scripting through Plupload, the third-party library WordPress uses for uploading files.
Pullup ticket #4371 - requested by taca
net/net-snmp: security update

Revisions pulled up:
- net/net-snmp/Makefile                                         1.103
- net/net-snmp/distinfo                                         1.81

---
   Module Name:	pkgsrc
   Committed By:	he
   Date:		Tue Apr  8 14:10:25 UTC 2014

   Modified Files:
   	pkgsrc/net/net-snmp: Makefile distinfo

   Log Message:
   Upgrade net-snmp to version 5.7.2.1.

   Upstream changes:
      * 5.{5,6,7}.2.1 *
          snmpd:
            - SECURITY: a denial of service attack vector was discovered on
              the linux implementation of the ICMP-MIB.  This release fixes
              this bug and all users are encouraged to update their SNMP
              agent if they make use of the ICMP-MIB table objects.

   Fixes CVE-2014-2284.
Pullup tickets #4365, #4369, #4370 and #4371.
Pullup ticket #4372 - requested by taca
print/a2ps: security patch

Revisions pulled up:
- print/a2ps/Makefile                                           1.77
- print/a2ps/distinfo                                           1.15
- print/a2ps/patches/patch-CVE-2014-0466_1                      1.1
- print/a2ps/patches/patch-CVE-2014-0466_2                      1.1

---
   Module Name:	pkgsrc
   Committed By:	tez
   Date:		Tue Apr  8 19:32:11 UTC 2014

   Modified Files:
   	pkgsrc/print/a2ps: Makefile distinfo
   Added Files:
   	pkgsrc/print/a2ps/patches: patch-CVE-2014-0466_1 patch-CVE-2014-0466_2

   Log Message:
   Add fix for CVE-2014-0466 from
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742902
Pullup ticket #4373 - requested by taca
databases/mysql55-client: security update
databases/mysql56-server: update to keep in sync with with "mysql55-client"

Revisions pulled up:
- databases/mysql55-client/Makefile                             1.16
- databases/mysql55-client/Makefile.common                      1.35
- databases/mysql55-client/distinfo                             1.32
- databases/mysql55-client/patches/patch-libmysql_CMakeLists.txt 1.2
- databases/mysql55-server/Makefile                             1.20
- databases/mysql55-server/PLIST                                1.28

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Mon Mar 31 08:03:23 UTC 2014

   Modified Files:
   	pkgsrc/databases/mysql55-client: Makefile Makefile.common distinfo
   	pkgsrc/databases/mysql55-client/patches: patch-libmysql_CMakeLists.txt
   	pkgsrc/databases/mysql55-server: Makefile PLIST

   Log Message:
   Changes 5.5.37:

   Functionality Added or Changed

   On Solaris, mysql_config --libs now includes -R/path/to/library so that libraries can be found at runtime.

   Bugs Fixed

   InnoDB: A regression introduced by Bug 14329288 would result in a performance degradation when a compressed table does not fit into memory.

   InnoDB: The maximum value for innodb_thread_sleep_delay is now 1000000 microseconds. The previous maximum value (4294967295 microseconds on 32-bit and 18446744073709551615 microseconds on 64-bit) was unnecessarily large. Because the maximum value of innodb_thread_sleep_delay is limited by the value set for innodb_adaptive_max_sleep_delay (when set to a non-zero value), the maximum value for innodb_thread_sleep_delay is now the same as the maximum value for innodb_adaptive_max_sleep_delay.

   InnoDB: In debug builds, creating a unique index on a binary column, with input data containing duplicate keys, would cause an assertion.

   InnoDB: InnoDB would fail to start when innodb_data_file_path specified the data file size in kilobytes by appending K to the size value.

   InnoDB: An insert buffer merge would cause an assertion error due to incorrectly handled ownership information for externally stored BLOBs.

   InnoDB: Assertion failure in thread thread_num in file ibuf0ibuf.cc line 4080
   InnoDB: Failing assertion: rec_get_deleted_flag(rec, page_is_comp(page))

   InnoDB: Decreasing the auto_increment_increment value would have no affect on the next auto-increment value.

   Replication: The server did not handle correctly the insertion of a row larger than 4 GB when using row-based replication.

   Replication: When using row-based replication, an additional auto-increment column on the slave version of a table was not updated correctly; a zero was inserted instead.

   Replication: Statements involving the Performance Schema tables should not be written to the binary log, because the content of these tables is applicable only to a given MySQL Server instance, and may differ greatly between different servers in a replication topology. The database administrator should be able to configure (INSERT, UPDATE, or DELETE) or flush (TRUNCATE TABLE) performance schema tables on a single server without affecting others. However, when replicating from a MySQL 5.5 master to a MySQL 5.5 or later slave, warnings about unsafe statements updating Performance Schema tables were elevated to errors. For MySQL 5.6 and later slaves, this prevented the simultaneous use of performance_schema and GTIDs (see Replication with Global Transaction Identifiers, in the MySQL 5.6 Manual).

   This fix causes all updates on tables in the performance_schema database to be filtered on the master and not replicated, regardless of the type of logging that is in effect. Prior to this fix, statements using were handled by being marked as unsafe for replication, which caused warnings during execution; the statements were nonetheless written to the binary log, regardless of the logging format in effect.

   Existing replication behavior for tables in the INFORMATION_SCHEMA database is not changed by this fix.

   For more information, see MySQL Performance Schema.

   Compilation failed if MySQL was configured with CFLAGS set to include a -Werror option with an argument.

   A shared libmysqld embedded server library was not built on Linux.

   While printing the server version, the mysql client did not check for buffer overflow in a string variable.

   Contraction information in a collation could be mishandled, resulting in incorrect decisions about whether a character is part of a contraction, and miscalculation of contraction weights.

   DROP TRIGGER succeeded even with the read_only system variable enabled.

   Updating the Performance Schema setup_instruments table on a replication master caused a slave to exit.

   Due to a race condition, it was possible for two threads to end up with the same query ID for different queries.

   When run by root, mysqld --help --verbose exited with a nonzero error code after displaying the help message.

   MySQL client programs from a Community Edition distribution could not connect using SSL to a MySQL server from an Enterprise Edition. This was due to a difference in certificate handling by yaSSL and OpenSSL (used for Community and Enterprise, respectively). OpenSSL expected a blank certificate to be sent when not all of the --ssl-ca, --ssl-cert, and --ssl-key options were specified, and yaSSL did not do so. To resolve this, yaSSL has been modified to send a blank certificate when an option is missing.

   A deadlock error occurring during subquery execution could cause an assertion to be raised.

   The Performance Schema stage/sql/Waiting to get readlock instrument is no longer used and has been removed.

   For system variables that take a string value, SET statements permitted an unquoted value, but values that contained dots were parsed incorrectly and only part of the value was assigned. For example, SET GLOBAL slow_query_log_file = my_slow.log assigned the value my_slow. Now such values must be quoted or an error occurs.

   On Windows, mysql_install_db.pl could be run only from within the bin directory under the installation directory.
Pullup ticket #4374 - requested by taca
databases/mysql56-client: security update
databases/mysql56-server: update to keep in sync with with "mysql56-client"

Revisions pulled up:
- databases/mysql56-client/Makefile.common                      1.14
- databases/mysql56-client/distinfo                             1.14
- databases/mysql56-server/PLIST                                1.9

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Mon Mar 31 10:32:13 UTC 2014

   Modified Files:
   	pkgsrc/databases/mysql56-client: Makefile.common distinfo
   	pkgsrc/databases/mysql56-server: PLIST

   Log Message:
   Changes 5.6.17:

   Functionality Added or Changed

   Incompatible Change: The AES_ENCRYPT() and AES_DECRYPT() functions now permit control of the block encryption mode and take an optional initialization vector argument:

   The new block_encryption_mode system variable controls the mode for block-based encryption algorithms. Its default value is aes-128-ecb, which signifies encryption using a key length of 128 bits and ECB mode.

   An optional init_vector argument provides an initialization vector for encryption modes that require it:

   AES_ENCRYPT(str,key_str[,init_vector])
   AES_DECRYPT(crypt_str,key_str[,init_vector])
   A random string of bytes to use for the initialization vector can be produced by calling the new RANDOM_BYTES() function.

   For more information, see Encryption and Compression Functions.

   These changes make statements that use AES_ENCRYPT() or AES_DECRYPT() unsafe for statement-based replication and they cannot be stored in the query cache. Queries that use RANDOM_BYTES() are unsafe for statement-based replication and cannot be stored in the query cache.

   Incompatible Change: The ERROR_FOR_DIVISION_BY_ZERO, NO_ZERO_DATE, and NO_ZERO_IN_DATE SQL modes now are deprecated and setting the sql_mode value to include any of them generates a warning. In MySQL 5.7, these modes do nothing. Instead, their effects are included in the effects of strict SQL mode (STRICT_ALL_TABLES or STRICT_TRANS_TABLES). The motivation for the change in MySQL 5.7 is to reduce the number of SQL modes with an effect dependent on strict mode and make them part of strict mode itself.

   To make advance preparation for an upgrade to MySQL 5.7, see SQL Mode Changes in MySQL 5.7. That discussion provides guidelines to assess whether your applications will be affected by the SQL mode changes in MySQL 5.7.

   InnoDB: MySQL now supports rebuilding regular and partitioned InnoDB tables using online DDL (ALGORITHM=INPLACE) for the following operations:

   OPTIMIZE TABLE

   ALTER TABLE ... FORCE

   ALTER TABLE ... ENGINE=INNODB (when run on an InnoDB table)

   Online DDL support reduces table rebuild time and permits concurrent DML, which helps reduce user application downtime. For additional information, see Overview of Online DDL.

   On Solaris, mysql_config --libs now includes -R/path/to/library so that libraries can be found at runtime.

   mysql_install_db provides a more informative diagnostic message when required Perl modules are missing.

   The IGNORE clause for ALTER TABLE is now deprecated and will be removed in a future version of MySQL. ALTER IGNORE TABLE causes problems for replication, prevents online ALTER TABLE for unique index creation, and causes problems with foreign keys (rows removed in the parent table).

   Bugs Fixed
Pullup ticket #4375 - requested by obache
textproc/p5-YAML-LibYAML: security patch

Revisions pulled up:
- textproc/p5-YAML-LibYAML/Makefile                             1.15
- textproc/p5-YAML-LibYAML/distinfo                             1.10
- textproc/p5-YAML-LibYAML/patches/patch-LibYAML_scanner.c      1.1
- textproc/p5-YAML-LibYAML/patches/patch-LibYAML_yaml__private.h 1.1

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Mon Apr 14 13:22:20 UTC 2014

   Modified Files:
   	pkgsrc/textproc/p5-YAML-LibYAML: Makefile distinfo
   Added Files:
   	pkgsrc/textproc/p5-YAML-LibYAML/patches: patch-LibYAML_scanner.c
   	    patch-LibYAML_yaml__private.h

   Log Message:
   Apply patch to internal LibYAML for CVE-2013-6393 and CVE-2014-2525.

   Bump PKGREVISION.
Pullup tickets #4373, #4374 and #4375.