Pullup ticket #4517 - requested by wiz
shells/bash: security update

Revisions pulled up:
- shells/bash/Makefile                                          1.72
- shells/bash/distinfo                                          1.38

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Tue Oct  7 00:16:52 UTC 2014

   Modified Files:
   	pkgsrc/shells/bash: Makefile distinfo

   Log Message:
   Another day, another bash patch. Welcome to 4.3.030.
   Fixes CVE-2014-6278:
   A combination of nested command substitutions and function importing
   from the environment can cause bash to execute code appearing in
   the environment variable value following the function definition.
Pullup ticket #4517.
Pullup ticket #4518 - requested by bsiegert
shells/mksh: security update

Revisions pulled up:
- shells/mksh/Makefile                                          1.28
- shells/mksh/distinfo                                          1.26
- shells/mksh/patches/patch-mksh.1                              1.7

---
   Module Name:    pkgsrc
   Committed By:   bsiegert
   Date:           Tue Oct  7 18:51:02 UTC 2014

   Modified Files:
           pkgsrc/shells/mksh: Makefile distinfo
           pkgsrc/shells/mksh/patches: patch-mksh.1

   Log Message:
   Security: Update mksh to 50d.

   R50d is a required bugfix release:

   - [Goodbox] Fix NULL pointer dereference on “unset x; nameref x”
   - [tg] Fix severe regression in field splitting (LP#1378208)
   - [tg] Add a warning about not using tainted user input (including from
     the environ(7)ment) in arithmetics, until Stéphane writes it up nicely

   R50c is a security fix release:

   - [tg] Know more rare signals when generating sys_signame[] replacement
   - [tg] OpenBSD sync (mostly RCSID only)
   - [tg] Document HISTSIZE limit; found by luigi_345 on IRC
   - [zacts] Fix link to Debian .mkshrc
   - [tg] Cease exporting $RANDOM (Debian #760857)
   - [tg] Fix C99 compatibility
   - [tg] Work around klibc bug causing a coredump (Debian #763842)
   - [tg] Use issetugid(2) as additional check if we are FPRIVILEGED
   - [tg] SECURITY: do not permit += from environment
   - [tg] Fix more field splitting bugs reported by Stephane Chazelas and
     mikeserv; document current status wrt. ambiguous ones as testcases too
Pullup ticket #4519 - requested by taca
www/apache24: security patch

Revisions pulled up:
- www/apache24/Makefile                                         1.31
- www/apache24/distinfo                                         1.16
- www/apache24/patches/patch-modules_cache_cache__util.c        1.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Oct  8 04:27:18 UTC 2014

   Modified Files:
   	pkgsrc/www/apache24: Makefile distinfo
   Added Files:
   	pkgsrc/www/apache24/patches: patch-modules_cache_cache__util.c

   Log Message:
   Add patch for CVE-2014-3581.

   Bump PKGREVISION.
Pullup ticket #4520 - requested by taca
security/openssh: security patch

Revisions pulled up:
- security/openssh/Makefile                                     1.221
- security/openssh/distinfo                                     1.87
- security/openssh/patches/patch-sshconnect.c                   1.1

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Oct  8 15:50:22 UTC 2014

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo
   Added Files:
   	pkgsrc/security/openssh/patches: patch-sshconnect.c

   Log Message:
   Add fix for CVE-2014-2653 from
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513.

   Bump PKGREVISION.
Pullup tickets #4518, #4519 and #4520.
Drop misleading SSL patch.

One really does need to put < before the ssl key/cert file; the
upstream example is correct.

ok adam@
Revert accidental commit to the stable branch.
Pullup ticket #4509 - requested by tron
mail/spamassassin: bug fix

Revisions pulled up:
- mail/spamassassin/Makefile                                    1.115
- mail/spamassassin/distinfo                                    1.63
- mail/spamassassin/patches/patch-lib_Mail_SpamAssassin_DnsResolver.pm 1.3

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Wed Oct  1 11:37:31 UTC 2014

   Modified Files:
   	pkgsrc/mail/spamassassin: Makefile distinfo
   Added Files:
   	pkgsrc/mail/spamassassin/patches:
   	    patch-lib_Mail_SpamAssassin_DnsResolver.pm

   Log Message:
   Make the DNSRBL based plug-ins work with version 0.76 or newer of the
   "p5-Net-DNS" package. Patch taken from the SVN repository.


   To generate a diff of this commit:
   cvs rdiff -u -r1.114 -r1.115 pkgsrc/mail/spamassassin/Makefile
   cvs rdiff -u -r1.62 -r1.63 pkgsrc/mail/spamassassin/distinfo
   cvs rdiff -u -r0 -r1.3 \
       pkgsrc/mail/spamassassin/patches/patch-lib_Mail_SpamAssassin_DnsResolver.pm
now for the correct branch (grmbl grmbl grmbl ..)
thanks to he@ for pointing this issue out
Pullup ticket #4515 - requested by tron
databases/phpmyadmin: security update

Revisions pulled up:
- databases/phpmyadmin/Makefile                                 1.135
- databases/phpmyadmin/distinfo                                 1.92

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	tron
   Date:		Sat Oct  4 15:35:49 UTC 2014

   Modified Files:
   	pkgsrc/databases/phpmyadmin: Makefile distinfo

   Log Message:
   Update "phpmyadmin" package to version 4.2.9.1.

   The following bugs have been fixed since version 4.2.9:
   - bug #4544 [security] XSS vulnerabilities in table search and table
                          structure pages


   To generate a diff of this commit:
   cvs rdiff -u -r1.134 -r1.135 pkgsrc/databases/phpmyadmin/Makefile
   cvs rdiff -u -r1.91 -r1.92 pkgsrc/databases/phpmyadmin/distinfo
pullups 4509 and 4515
Merge branch 'pkgsrc_2014Q3' into joyent/feature/pbulkmulti/2014Q3