Pullup ticket #4452 - requested by obache
security/polarssl: security update

Revisions pulled up:
- security/polarssl/Makefile                                    1.5
- security/polarssl/distinfo                                    1.3

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Wed Jul 16 10:03:57 UTC 2014

   Modified Files:
   	pkgsrc/security/polarssl: Makefile distinfo

   Log Message:
   PolarSSL ChangeLog

   = Version 1.2.11 released 2014-07-11
   Features
      * Entropy module now supports seed writing and reading

   Changes
      * Introduced POLARSSL_HAVE_READDIR_R for systems without it
      * Improvements to the CMake build system, contributed by Julian Ospald.
      * Work around a bug of the version of Clang shipped by Apple with
   Mavericks      that prevented bignum.c from compiling. (Reported by Rafael
   Baptista.)    * Improvements to tests/Makefile, contributed by Oden
   Eriksson.    * Use UTC time to check certificate validity.
      * Reject certificates with times not in UTC, per RFC 5280.
      * Migrate zeroizing of data to polarssl_zeroize() instead of memset()
        against unwanted compiler optimizations

   Security
      * Forbid change of server certificate during renegotiation to prevent
        "triple handshake" attack when authentication mode is optional (the
        attack was already impossible when authentication is required).
      * Check notBefore timestamp of certificates and CRLs from the future.
      * Forbid sequence number wrapping
      * Prevent potential NULL pointer dereference in ssl_read_record() (found
   by      TrustInSoft)
      * Fix length checking for AEAD ciphersuites (found by Codenomicon).
        It was possible to crash the server (and client) using crafted messages
        when a GCM suite was chosen.

   Bugfix
      * Fixed X.509 hostname comparison (with non-regular characters)
      * SSL now gracefully handles missing RNG
      * crypt_and_hash app checks MAC before final decryption
      * Fixed x509_crt_parse_path() bug on Windows platforms
      * Added missing MPI_CHK() around some statements in mpi_div_mpi() (found
   by      TrustInSoft)
      * Fixed potential overflow in certificate size verification in
        ssl_write_certificate() (found by TrustInSoft)
      * Fix ASM format in bn_mul.h
      * Potential memory leak in bignum_selftest()
      * Replaced expired test certificate
      * ssl_mail_client now terminates lines with CRLF, instead of LF
      * Fix bug in RSA PKCS#1 v1.5 "reversed" operations
      * Fixed testing with out-of-source builds using cmake
      * Fixed version-major intolerance in server
      * Fixed CMake symlinking on out-of-source builds
      * Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by
        Alex Wilson.)
      * ssl_init() was leaving a dirty pointer in ssl_context if malloc of
        out_ctr failed
      * ssl_handshake_init() was leaving dirty pointers in subcontexts if
   malloc      of one of them failed
      * x509_get_current_time() uses localtime_r() to prevent thread issues
      * Some example server programs were not sending the close_notify alert.
      * Potential memory leak in mpi_exp_mod() when error occurs during
        calculation of RR.
      * Improve interoperability by not writing extension length in ClientHello
        when no extensions are present (found by Matthew Page)
      * rsa_check_pubkey() now allows an E up to N
      * On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings
      * mpi_fill_random() was creating numbers larger than requested on
        big-endian platform when size was not an integer number of limbs
      * Fix detection of DragonflyBSD in net.c (found by Markus Pfeiffer)
      * Stricter check on SSL ClientHello internal sizes compared to actual
   packet      size (found by TrustInSoft)
      * Fix preprocessor checks for bn_mul PPC asm (found by Barry K. Nathan).
      * Use \n\t rather than semicolons for bn_mul asm, since some assemblers
        interpret semicolons as comment delimiters (found by Barry K. Nathan).
      * Disable broken Sparc64 bn_mul assembly (found by Florian Obser).
      * Fix base64_decode() to return and check length correctly (in case of
        tight buffers)

   = Version 1.2.10 released 2013-10-07
   Changes
      * Changed RSA blinding to a slower but thread-safe version
      * Make get_pkcs_padding() constant-time

   Bugfix
      * Fixed memory leak in RSA as a result of introduction of blinding
      * Fixed ssl_pkcs11_decrypt() prototype
      * Fixed MSVC project files

   = Version 1.2.9 released 2013-10-01
   Changes
      * x509_verify() now case insensitive for cn (RFC 6125 6.4)

   Bugfix
      * Fixed potential memory leak when failing to resume a session
      * Fixed potential file descriptor leaks (found by Remi Gacogne)
      * Minor fixes

   Security
      * Fixed potential heap buffer overflow on large hostname setting
      * Fixed potential negative value misinterpretation in load_file()
      * RSA blinding on CRT operations to counter timing attacks
        (found by Cyril Arnaud and Pierre-Alain Fouque)
Pullup ticket #4452.
Pullup ticket #4453 - requested by taca
lang/php55: security patch

Revisions pulled up:
- lang/php55/Makefile                                           1.15
- lang/php55/distinfo                                           1.26
- lang/php55/patches/patch-ext_spl_spl__array.c                 1.1
- lang/php55/patches/patch-ext_spl_spl__dllist.c                1.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Jul 13 15:23:42 UTC 2014

   Modified Files:
   	pkgsrc/lang/php55: Makefile distinfo
   Added Files:
   	pkgsrc/lang/php55/patches: patch-ext_spl_spl__array.c
   	    patch-ext_spl_spl__dllist.c

   Log Message:
   Add fix for CVE-2014-4698 and CVE-2014-4670.

   Bump PKGREVISION.
Pullup ticket #4454 - requested by taca
lang/php54: security patch

Revisions pulled up:
- lang/php54/Makefile                                           1.24
- lang/php54/distinfo                                           1.44
- lang/php54/patches/patch-ext_spl_spl__array.c                 1.1
- lang/php54/patches/patch-ext_spl_spl__dllist.c                1.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Jul 13 15:25:03 UTC 2014

   Modified Files:
   	pkgsrc/lang/php54: Makefile distinfo
   Added Files:
   	pkgsrc/lang/php54/patches: patch-ext_spl_spl__array.c
   	    patch-ext_spl_spl__dllist.c

   Log Message:
   Add fix for CVE-2014-4698 and CVE-2014-4670.

   Bump PKGREVISION.
Pullup ticket #4455 - requested by taca
mail/p5-Email-Address: security update

Revisions pulled up:
- mail/p5-Email-Address/Makefile                                1.17
- mail/p5-Email-Address/distinfo                                1.8

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Jul 16 15:51:57 UTC 2014

   Modified Files:
   	pkgsrc/mail/p5-Email-Address: Makefile distinfo

   Log Message:
   Update p5-Email-Address to 1.905.

   1.905     2014-06-17 22:55:00-04:00 America/New_York
           - additional change to avoid slowdown; this addresses CVE-2014-0477
             change provided by Bastian Blank <waldi@debian.org>

   1.904     2014-06-14 00:21:21-04:00 America/New_York (TRIAL RELEASE)
           - avoid being fooled by an addr-like string in the phrase
           - avoid a slowdown by avoiding backtracking into the phrase

   1.903     2014-04-17 21:02:14-04:00 America/New_York
           - correctly parenthesize false comment "0" (sigh)

   1.902     2014-04-17 10:45:11-04:00 America/New_York
           - when formatting an address where phrase is empty but comment is not,
             do not include "" for the phrase; just omit it
           - when formatting and address where comment lacks enclosing parens, add
             them
Pullup ticket #4456 - requested by taca
www/drupal7: security update

Revisions pulled up:
- www/drupal7/Makefile                                          1.27
- www/drupal7/distinfo                                          1.20

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Jul 17 03:57:10 UTC 2014

   Modified Files:
   	pkgsrc/www/drupal7: Makefile distinfo

   Log Message:
   Update drupal7 to 7.29, security fix release.

   Drupal 7.29, 2014-07-16
   ----------------------
   - Fixed security issues (multiple vulnerabilities). See SA-CORE-2014-003.
Pullup ticket #4457 - requested by taca
www/drupal6: security update

Revisions pulled up:
- www/drupal6/Makefile                                          1.48
- www/drupal6/distinfo                                          1.31

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Jul 17 03:57:57 UTC 2014

   Modified Files:
   	pkgsrc/www/drupal6: Makefile distinfo

   Log Message:
   Update drupal6 to 6.32, security fix release.

   Drupal 6.32, 2014-07-16
   ----------------------
   - Fixed security issues (multiple vulnerabilities). See SA-CORE-2014-003.
Pullup tickets #4453, #4454, #4456, #4457, #4457 and #4458.
Pullup ticket #4458 - requested by obache
textproc/json-c: bug fix patch

Revisions pulled up:
- textproc/json-c/Makefile                                      1.10
- textproc/json-c/hacks.mk                                      1.1

---
   Module Name:	pkgsrc
   Committed By:	obache
   Date:		Thu Jul 17 09:18:27 UTC 2014

   Modified Files:
   	pkgsrc/textproc/json-c: Makefile
   Added Files:
   	pkgsrc/textproc/json-c: hacks.mk

   Log Message:
   Add hack for using gcc builtin atomic function, missing for i386.
   PR pkg/48990.

   Bump PKGREVISION.
Force re-build.