Add CHANGES file for branch.
Pullup ticket #4238 - requested by wiz
security/gnupg: security update

Revisions pulled up:
- security/gnupg/Makefile                                       1.121
- security/gnupg/distinfo                                       1.62

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Sat Oct  5 13:19:51 UTC 2013

   Modified Files:
   	pkgsrc/security/gnupg: Makefile distinfo

   Log Message:
   Update to 1.4.15:

   Noteworthy changes in version 1.4.15 (2013-10-04)
   -------------------------------------------------

       * Fixed possible infinite recursion in the compressed packet
         parser. [CVE-2013-4402]

       * Protect against rogue keyservers sending secret keys.

       * Use 2048 bit also as default for batch key generation.

       * Minor bug fixes.


   To generate a diff of this commit:
   cvs rdiff -u -r1.120 -r1.121 pkgsrc/security/gnupg/Makefile
   cvs rdiff -u -r1.61 -r1.62 pkgsrc/security/gnupg/distinfo
Pullup ticket #4239 - requested by wiz
security/gnupg2: security update

Revisions pulled up:
- security/gnupg2/Makefile                                      1.48
- security/gnupg2/distinfo                                      1.29

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Sat Oct  5 13:20:03 UTC 2013

   Modified Files:
   	pkgsrc/security/gnupg2: Makefile distinfo

   Log Message:
   Update to 2.0.22:

   Noteworthy changes in version 2.0.22 (2013-10-04)
   -------------------------------------------------

    * Fixed possible infinite recursion in the compressed packet
      parser. [CVE-2013-4402]

    * Improved support for some card readers.

    * Prepared building with the forthcoming Libgcrypt 1.6.

    * Protect against rogue keyservers sending secret keys.


   To generate a diff of this commit:
   cvs rdiff -u -r1.47 -r1.48 pkgsrc/security/gnupg2/Makefile
   cvs rdiff -u -r1.28 -r1.29 pkgsrc/security/gnupg2/distinfo
pullups 4238 and 4239
Pullup ticket #4237 - requested by obache
www/ap2-subversion: functionality fix

Revisions pulled up:
- www/ap2-subversion/Makefile                                   1.60
- www/ap2-subversion/PLIST                                      1.6

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Sat Oct  5 12:41:57 UTC 2013

   Modified Files:
   	pkgsrc/www/ap2-subversion: Makefile PLIST

   Log Message:
   Let to install modules into apache libexecdir, same as 1.7.x.
   fixes PR pkg/48273

   Bump PKGREVISION.


   To generate a diff of this commit:
   cvs rdiff -u -r1.59 -r1.60 pkgsrc/www/ap2-subversion/Makefile
   cvs rdiff -u -r1.5 -r1.6 pkgsrc/www/ap2-subversion/PLIST
pullup 4237
Pullup ticket #4240 - requested by wiz
x11/modular-xorg-server: security fix

Revisions pulled up:
- x11/modular-xorg-server/Makefile                              1.81
- x11/modular-xorg-server/distinfo                              1.52
- x11/modular-xorg-server/patches/patch-dix_dixfonts.c          1.1

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Tue Oct  8 20:33:54 UTC 2013

   Modified Files:
   	pkgsrc/x11/modular-xorg-server: Makefile distinfo
   Added Files:
   	pkgsrc/x11/modular-xorg-server/patches: patch-dix_dixfonts.c

   Log Message:
   Fix CVE-2013-4396.

   From a4d9bf1259ad28f54b6d59a480b2009cc89ca623 Mon Sep 17 00:00:00 2001
   From: Alan Coopersmith <alan.coopersmith@oracle.com>
   Date: Mon, 16 Sep 2013 21:47:16 -0700
   Subject: [PATCH] Avoid use-after-free in dix/dixfonts.c: doImageText()

   Save a pointer to the passed in closure structure before copying it
   and overwriting the *c pointer to point to our copy instead of the
   original.  If we hit an error, once we free(c), reset c to point to
   the original structure before jumping to the cleanup code that
   references *c.

   Since one of the errors being checked for is whether the server was
   able to malloc(c->nChars * itemSize), the client can potentially pass
   a number of characters chosen to cause the malloc to fail and the
   error path to be taken, resulting in the read from freed memory.

   Since the memory is accessed almost immediately afterwards, and the
   X server is mostly single threaded, the odds of the free memory having
   invalid contents are low with most malloc implementations when not using
   memory debugging features, but some allocators will definitely overwrite
   the memory there, leading to a likely crash.

   Reported-by: Pedro Ribeiro <pedrib@gmail.com>
   Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
   Reviewed-by: Julien Cristau <jcristau@debian.org>

   Bump PKGREVISION.


   To generate a diff of this commit:
   cvs rdiff -u -r1.80 -r1.81 pkgsrc/x11/modular-xorg-server/Makefile
   cvs rdiff -u -r1.51 -r1.52 pkgsrc/x11/modular-xorg-server/distinfo
   cvs rdiff -u -r0 -r1.1 \
       pkgsrc/x11/modular-xorg-server/patches/patch-dix_dixfonts.c
pullup 4240
Pullup ticket #4241 - requested by tez
graphics/librsvg: security patch

Revisions pulled up:
- graphics/librsvg/Makefile                                     1.74
- graphics/librsvg/distinfo                                     1.26
- graphics/librsvg/patches/patch-CVE-2013-1881                  1.1

---
   Module Name:    pkgsrc
   Committed By:   tez
   Date:           Thu Oct  3 13:39:13 UTC 2013

   Modified Files:
           pkgsrc/graphics/librsvg: Makefile distinfo
   Added Files:
           pkgsrc/graphics/librsvg/patches: patch-CVE-2013-1881

   Log Message:
   Fix for CVE-2013-1881 (SA55088)
   Modified (for portability) from
   https://git.gnome.org/browse/librsvg/patch/?id=f01aded72c38f0e18bc7ff67dee800e380251c8e
Pullup ticket #4241.
Pullup ticket #4242 - requested by taca
sysutils/ruby-rb-appscript: build fix

Revisions pulled up:
- sysutils/ruby-rb-appscript/Makefile                           1.4
- sysutils/ruby-rb-appscript/PLIST                              1.5

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Oct  1 15:24:02 UTC 2013

   Modified Files:
   	pkgsrc/sysutils/ruby-rb-appscript: Makefile PLIST

   Log Message:
   Fix build problem and clean up PLIST.

   Bump PKGREVISION.
Pullup ticket #4243 - requested by he
graphics/png: build fix

Revisions pulled up:
- graphics/png/Makefile                                         1.163
- graphics/png/distinfo                                         1.108

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Mon Sep 30 18:17:03 UTC 2013

   Modified Files:
   	pkgsrc/graphics/png: Makefile distinfo

   Log Message:
   Update to 1.6.6:

   Version 1.6.6 [September 16, 2013]
     Removed two stray lines of code from arm/arm_init.c, again.
Pullup ticket #4244 - requested by obache
www/py-genshi: security update

Revisions pulled up:
- www/py-genshi/Makefile                                        1.8
- www/py-genshi/distinfo                                        1.3

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Fri Oct 11 10:54:15 UTC 2013

   Modified Files:
   	pkgsrc/www/py-genshi: Makefile distinfo

   Log Message:
   Update genshi to 0.6.1.

   Version 0.6.1
   http://svn.edgewall.org/repos/genshi/tags/0.6.1/
   (Jan 27 2013, from branches/stable/0.6.x)

     * Security fix to enhance sanitizing of CSS in style attributes. Genshi's
       `HTMLSanitizer` disallows style attributes by default (this remains
       unchanged) and warns against such attacks in its documentation, but
       the provided CSS santizing is now less lacking (see #455).
     * Fix for error in how `HTMLFormFiller` would handle `textarea` elements if
       no value was not supplied form them.
     * The `HTMLFormFiller` now correctly handles check boxes and radio buttons
       with an empty `value` attribute.
     * Template `Context` objects now have a `.copy` method.
     * Added a simple `tox.ini` file for using tox to test against multiple
       verions of Python.
     * Fix for bug in `QName` comparison (see #413).
     * Fix for bug in handling of trailing events in match template matches
       (see #399).
     * Fix i18n namespace declaration in documentation (see #400).
     * Fix for bug in caching of events in serializers by no longer caching
       `(TEXT, Markup)` events (see #429).
     * Fix handling of `None` by `Markup.escape` in `_speedups.c` (see #439).
     * Fix handling of internal state by match templates (relevant when multiple
       templates match the same part of the stream, see #370).
     * Fix handling of multiple events between or on either side of start and end
       tags in translated messages (see #404).
     * Fix test failures caused by changes in HTMLParser in Python 2.7 (see #501).
     * Fix infinite loop in interplotation lexing that was introduced by a change
       in Python 2.7's tokenizer (see #540).
     * Fix handling of processing instructions without data (see #368).
     * Updated MANIFEST.in so as not to rely on build from Subersion 1.6.
Pullup tickets #4242, #4243 and #4244.
Pullup ticket #4245 - requested by joerg
devel/bmake: build fix

Revisions pulled up:
- devel/bmake/files/util.c                                      1.12

---
   Module Name:	pkgsrc
   Committed By:	joerg
   Date:		Mon Oct 14 23:19:10 UTC 2013

   Modified Files:
   	pkgsrc/devel/bmake/files: util.c

   Log Message:
   Workaround for bad Linux headers.
Pullup ticket #4246 - requested by joerg
lang/python27: build fix

Revisions pulled up:
- lang/python27/Makefile                                        1.30

---
   Module Name:	pkgsrc
   Committed By:	joerg
   Date:		Tue Oct 15 20:46:41 UTC 2013

   Modified Files:
   	pkgsrc/lang/python27: Makefile

   Log Message:
   PowerPC64 is a 64bit platform.
Pullup tickets #4245 #4246.
Pullup ticket #4247 - requested by bsiegert
lang/gawk: build fix

Revisions pulled up:
- lang/gawk/Makefile                                            1.57
- lang/gawk/PLIST                                               1.20
- lang/gawk/distinfo                                            1.25
- lang/gawk/patches/patch-extension_configure                   1.1

---
   Module Name:    pkgsrc
   Committed By:   bsiegert
   Date:           Sat Oct 19 19:47:39 UTC 2013

   Modified Files:
           pkgsrc/lang/gawk: Makefile PLIST distinfo
   Added Files:
           pkgsrc/lang/gawk/patches: patch-extension_configure

   Log Message:
   Fix build on MirBSD.

   The gawk developers added code to skip building the extensions on MirBSD
   but inserted a syntax error. Also skip the extensions in the PLIST on MirBSD.
Pullup ticket #4247.
Pullup ticket #4249 - requested by taca
mail/roundcube: security update

Revisions pulled up:
- mail/roundcube/Makefile                                       1.60
- mail/roundcube/distinfo                                       1.34
- mail/roundcube/patches/patch-aa                               1.11

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Oct 22 03:21:45 UTC 2013

   Modified Files:
   	pkgsrc/mail/roundcube: Makefile distinfo
   	pkgsrc/mail/roundcube/patches: patch-aa

   Log Message:
   Update roundcube to 0.9.5.  This release contains fix for CVE-2013-6172.

   RELEASE 0.9.5
   -------------
   - Fix failing vCard import when email address field contains spaces (#1489386)
   - Fix default spell-check configuration after Google suspended their spell service
   - Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
   - Fix iframe onload for upload errors handling (#1489379)
   - Fix address matching in Return-Path header on identity selection (#1489374)
   - Fix text wrapping issue with long unwrappable lines (#1489371)
   - Fixed mispelling: occured -> occurred (#1489366)
   - Fixed issues where HTML comments inside style tag would hang Internet Explorer
   - Fix setting domain in virtualmin password driver (#1489332)
   - Hide Delivery Status Notification option when smtp_server is unset (#1489336)
   - Display full attachment name using title attribute when name is too long to display (#1489320)
   - Fix attachment icon issue when rare font/language is used (#1489326)
   - Fix expanded thread root message styling after refreshing messages list (#1489327)
   - Fix issue where From address was removed from Cc and Bcc fields when editing a draft (#1489319)
   - Fix error_reporting directive check (#1489323)
   - Fix de_DE localization of "About" label in Help plugin (#1489325)