Pullup ticket #4567 - requested by tron
databases/phpmyadmin: security update

Revisions pulled up:
- databases/phpmyadmin/Makefile                                 1.139-1.140
- databases/phpmyadmin/distinfo                                 1.96-1.97

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Sun Dec  7 12:37:54 UTC 2014

   Modified Files:
   	pkgsrc/databases/phpmyadmin: Makefile distinfo

   Log Message:
   Update "phpmyadmin" package to version 4.2.13.1. Changes since version 4.2.=
   12:
   - bug #4604 Query history not being deleted
   - bug #4057 db/table query string parameters no longer work
   - bug #4605 Unseen messages in tracking
   - bug #4606 Tracking report export as SQL dump does not work
   - bug #4607 Syntax error during db_copy operation
   - bug #4608 SELECT permission issues with relations and restricted access
   - bug #4612 [security] XSS vulnerability in redirection mechanism
   - bug #4611 [security] DOS attack with long passwords


   To generate a diff of this commit:
   cvs rdiff -u -r1.138 -r1.139 pkgsrc/databases/phpmyadmin/Makefile
   cvs rdiff -u -r1.95 -r1.96 pkgsrc/databases/phpmyadmin/distinfo

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Sun Dec  7 14:27:29 UTC 2014

   Modified Files:
   	pkgsrc/databases/phpmyadmin: Makefile distinfo

   Log Message:
   Use significantly smaller ".tar.xz" distribution file now that downloads
   =66rom the master site are working again.


   To generate a diff of this commit:
   cvs rdiff -u -r1.139 -r1.140 pkgsrc/databases/phpmyadmin/Makefile
   cvs rdiff -u -r1.96 -r1.97 pkgsrc/databases/phpmyadmin/distinfo
ticket 4567
Pullup ticket #4571 - requested by snj
security/libksba: security patch

Revisions pulled up:
- security/libksba/Makefile                                     1.30
- security/libksba/distinfo                                     1.17
- security/libksba/patches/patch-aa                             1.2

---
   Module Name:    pkgsrc
   Committed By:   wiz
   Date:           Tue Nov 25 14:35:37 UTC 2014

   Modified Files:
           pkgsrc/security/libksba: Makefile distinfo
           pkgsrc/security/libksba/patches: patch-aa

   Log Message:
   Update to 1.3.2. Add comment to patch.

   Noteworthy changes in version 1.3.2 (2014-11-25) [C19/A11/R3]
   ------------------------------------------------

    * Fixed a buffer overflow in ksba_oid_to_str.

   Noteworthy changes in version 1.3.1 (2014-09-18)
   ------------------------------------------------

    * Fixed memory leak in CRL parsing.

    * Build fixes for Windows, Android, and ppc64el.
Pullup ticket #4572 - requested by jnemeth
comms/asterisk: security update

Revisions pulled up:
- comms/asterisk/Makefile                                       1.116
- comms/asterisk/distinfo                                       1.70

---
   Module Name:    pkgsrc
   Committed By:   jnemeth
   Date:           Fri Dec 12 22:12:56 UTC 2014

   Modified Files:
           pkgsrc/comms/asterisk: Makefile distinfo

   Log Message:
   Update to Asterisk 11.14.2: this is a security fix release.

   The Asterisk Development Team has announced security releases for
   Certified Asterisk 11.6 and Asterisk 11, 12, and 13. The available
   security releases are released as versions 11.6-cert9, 11.14.2,
   12.7.2, and 13.0.2.

   The release of these versions resolves the following security vulnerability:

   * AST-2014-019: Remote Crash Vulnerability in WebSocket Server

     When handling a WebSocket frame the res_http_websocket module
     dynamically changes the size of the memory used to allow the
     provided payload to fit. If a payload length of zero was received
     the code would incorrectly attempt to resize to zero. This
     operation would succeed and end up freeing the memory but be
     treated as a failure. When the session was subsequently torn down
     this memory would get freed yet again causing a crash.

   For more information about the details of this vulnerability, please read
   security advisory AST-2014-019, which was released at the same time as this
   announcement.

   For a full list of changes in the current releases, please see the Change Logs:

   http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.14.2

   The security advisory is available at:

   * http://downloads.asterisk.org/pub/security/AST-2014-019.pdf

   Thank you for your continued support of Asterisk!
Pullup tickets #4571 and #4573.