Update to 7.0.57

Changelog:
Tomcat 7.0.57 (violetagg)

    Catalina

        add	47919: Extend the information logged when Tomcat starts to optionally log the values of command line arguments (enabled by default) and environment variables (disabled by default). Note that the values added to CATALINA_OPTS and JAVA_OPTS environment variables will be logged, as they are used to build up the command line. (markt)
        add	56401: Log version information when Tomcat starts. (markt/kkolinko)
        fix	57022: Ensure SPNEGO authentication continues to work with the JNDI Realm using delegated credentials with recent Oracle JREs. (markt)
        fix	Correct a couple of NPEs in the JNDI Realm that could be triggered with when not specifying a roleBase and enabling roleSearchAsUser. (markt)
        fix	Remove the unnecessary registration of context.xml as a redeploy resource. The context.xml having an external docBase has already been registered as a redeploy resources at first. (kfujino)
        fix	Improve the previous fix for 56401. Avoid logging version information in the constructor since it then gets logged at undesirable times such as when using StoreConfig. (markt)
        fix	57105: When parsing web.xml do not limit the buffer element of the jsp-property-group element to integer values as the allowed values are <number>kb or none. (markt)
        update	Update the minimum required version of the Tomcat Native library (if used) to 1.1.32. (markt)
        update	57144: Improve ClientAbortException to provide non-null message. (kkolinko)

    Coyote

        add	53952: Add support for TLSv1.1 and TLSv1.2 for APR connector. Based upon a patch by Marcel Šebek. This feature requires Tomcat Native library 1.1.32 or later. (schultz/jfclere)
        add	Disable SSLv3 by default for JSSE based HTTPS connectors (BIO and NIO). The change also ensures that SSLv2 is disabled for these connectors although SSLv2 should already be disabled by default by the JRE. (markt)
        add	Disable SSLv3 by default for the APR/native HTTPS connector. (markt)
        fix	Do not increase remaining counter at end of stream in IdentityInputFilter. (kkolinko)

    Jasper

        fix	57099: Ensure that semi-colons are not permitted in JSP import page directives. (markt)

    Cluster

        fix	Avoid possible integer overflows reported by Coverity Scan. (fschumacher)

    WebSocket

        fix	57054: Correctly handle the case in the WebSocket client when the HTTP response to the upgrade request can not be read in a single pass; either because the buffer is too small or the server sent the response in multiple packets. (markt)
        fix	Fix client subprotocol handling. (remm)
        fix	Add null checks for arguments in remote endpoint. (remm/kkolinko)
        fix	57091: Work around the behaviour of the Oracle JRE when creating new threads in an applet environment that breaks the WebSocket client implementation. Patch provided by Niklas Hallqvist. (markt)
        fix	57118: Ensure that that an EncodeException is thrown by RemoteEndpoint.Basic.sendObject(Object) rather than an IOException when no suitable Encoder is configured for the given Object. (markt)

    Web applications

        fix	Correct documentation for ServerCookie.ALLOW_NAME_ONLY system property. (kkolinko)
        fix	57049: Clarified that jvmRoute can be set in <Engine>'s jvmRoute or in a system property. (schultz)
        fix	Correct version of Java WebSocket mentioned in documentation (s/1.0/1.1/). (markt/kkolinko)
        update	In examples web application move Async and Comet examples from JSP to Servlet examples page. (kkolinko)
        update	Suppress timestamp comments and enable charset header in Javadoc. (kkolinko)

    jdbc-pool

        fix	57079: Use Tomcat version number for jdbc-pool module when building and shipping the module as part of Tomcat. (markt/kkolinko)
        fix	Fix broken overview page in javadoc generated via "javadoc" task in jdbc-pool build.xml file. (kkolinko)

    Other

        update	56079: The Apache Tomcat Windows service and the Apache Tomcat Windows service monitor application are now digitally signed. (markt)
        fix	Fix timestamps in Tomcat build and jdbc-pool to use 24-hour format instead of 12-hour one and use UTC timezone. (markt/kkolinko)
        update	Improve Tomcat build script to ensure that only one ecj-nn.jar file is present in Tomcat lib directory when Eclipse JDT Compiler is updated to a new version. (kkolinko)
        update	56596: Update to Tomcat Native Library version 1.1.32 to pick up the Windows binaries that are based on OpenSSL 1.0.1j and APR 1.5.1. (markt)
        code	In Tomcat tests: log name of the current test method at start time. (kkolinko)
Updated www/apache-tomcat7 to 7.0.57
Update subversion to 1.8.11.

This release addresses two security issues:
    CVE-2014-3580: mod_dav_svn DoS from invalid REPORT requests.
    CVE-2014-8108: mod_dav_svn DoS from use of invalid transaction names.

Version 1.8.11
(15 Dec 2014, from /branches/1.8.x)
http://svn.apache.org/repos/asf/subversion/tags/1.8.10

 User-visible changes:
  - Client-side bugfixes:
    * checkout/update: fix file externals failing to follow history and
      subsequently silently failing (issue #4185)
    * patch: don't skip targets in valid --git difs (r1592014, r1592034)
    * diff: make property output in diffs stable (r1589360)
    * diff: fix diff of local copied directory with props (r1619380, r1619393)
    * diff: fix changelist filter for repos-WC and WC-WC (r1621978, r1621981)
    * remove broken conflict resolver menu options that always error out
      (r1620332)
    * improve gpg-agent support (r1600331, r1600348, 1600368, r1600563,
      r1600781)
    * fix crash in eclipse IDE with GNOME Keyring (issue #3498)
    * fix externals shadowing a versioned directory (issue #4085)
    * fix problems working on unix file systems that don't support
      permissions (r1612225)
    * upgrade: keep external registrations (issue #4519)
    * cleanup: iprove performance of recorded timestamp fixups (r1633126)
    * translation updates for German

  - Server-side bugfixes:
    * disable revprop caching feature due to cache invalidation problems
      (r1543594, r1619774, r1619105, r1619118, r1619153, r1619802)
    * skip generating uniquifiers if rep-sharing is not supported (r1561426)
    * mod_dav_svn: reject requests with missing repository paths (r1643409)
    * mod_dav_svn: reject requests with invalid virtual transaction names
      (r1643437)
    * mod_dav_svn: avoid unneeded memory growth in resource walking
      (issue #4531)

 Developer-visible changes:
  - General:
    * make sure all members of the repos layer notify struct are valid,
      fixes crashes in API users using all members (r1616131)
    * properly generate a version resource when building on Windows (r1542610,
      r1564576, r1568180)
    * fix LIBTOOL_M4 and LIBTOOL_CONFIG variable not be evaluated properly
      during a unix build (r1637826)
    * allow the use of libtool 2.4.3 (r1640862, r1640873, r1643793)
Updated devel/subversion to 1.8.11
Update ntpd4 pacakge to 4.2.8, here is summary for security related fixes.

NTP 4.2.8 (Harlan Stenn <stenn@ntp.org>, 2014/12/18)

Focus: Security and Bug fixes, enhancements.

Severity: HIGH

In addition to bug fixes and enhancements, this release fixes the
following high-severity vulnerabilities:

* Weak default key in config_auth().

  References: [Sec 2665] / CVE-2014-9293 / VU#852879
  CVSS: (AV:N/AC:L/Au:M/C:P/I:P/A:C) Base Score: 7.3
  Vulnerable Versions: all releases prior to 4.2.7p11
  Date Resolved: 28 Jan 2010

  Summary: If no 'auth' key is set in the configuration file, ntpd
	would generate a random key on the fly.  There were two
	problems with this: 1) the generated key was 31 bits in size,
	and 2) it used the (now weak) ntp_random() function, which was
	seeded with a 32-bit value and could only provide 32 bits of
	entropy.  This was sufficient back in the late 1990s when the
	code was written.  Not today.

  Mitigation: Upgrade to 4.2.7p11 or later.

  Credit: This vulnerability was noticed in ntp-4.2.6 by Neel Mehta
  	of the Google Security Team.

* Non-cryptographic random number generator with weak seed used by
  ntp-keygen to generate symmetric keys.

  References: [Sec 2666] / CVE-2014-9294 / VU#852879
  CVSS: (AV:N/AC:L/Au:M/C:P/I:P/A:C) Base Score: 7.3
  Vulnerable Versions: All NTP4 releases before 4.2.7p230
  Date Resolved: Dev (4.2.7p230) 01 Nov 2011

  Summary: Prior to ntp-4.2.7p230 ntp-keygen used a weak seed to
  	prepare a random number generator that was of good quality back
	in the late 1990s. The random numbers produced was then used to
	generate symmetric keys. In ntp-4.2.8 we use a current-technology
	cryptographic random number generator, either RAND_bytes from
	OpenSSL, or arc4random().

  Mitigation: Upgrade to 4.2.7p230 or later.

  Credit:  This vulnerability was discovered in ntp-4.2.6 by
  	Stephen Roettger of the Google Security Team.

* Buffer overflow in crypto_recv()

  References: Sec 2667 / CVE-2014-9295 / VU#852879
  CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5
  Versions: All releases before 4.2.8
  Date Resolved: Stable (4.2.8) 18 Dec 2014

  Summary: When Autokey Authentication is enabled (i.e. the ntp.conf
  	file contains a 'crypto pw ...' directive) a remote attacker
	can send a carefully crafted packet that can overflow a stack
	buffer and potentially allow malicious code to be executed
	with the privilege level of the ntpd process.

  Mitigation: Upgrade to 4.2.8, or later, or
	Disable Autokey Authentication by removing, or commenting out,
	all configuration directives beginning with the crypto keyword
	in your ntp.conf file.

  Credit: This vulnerability was discovered by Stephen Roettger of the
  	Google Security Team.

* Buffer overflow in ctl_putdata()

  References: Sec 2668 / CVE-2014-9295 / VU#852879
  CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5
  Versions: All NTP4 releases before 4.2.8
  Date Resolved: Stable (4.2.8) 18 Dec 2014

  Summary: A remote attacker can send a carefully crafted packet that
  	can overflow a stack buffer and potentially allow malicious
	code to be executed with the privilege level of the ntpd process.

  Mitigation: Upgrade to 4.2.8, or later.

  Credit: This vulnerability was discovered by Stephen Roettger of the
  	Google Security Team.

* Buffer overflow in configure()

  References: Sec 2669 / CVE-2014-9295 / VU#852879
  CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5
  Versions: All NTP4 releases before 4.2.8
  Date Resolved: Stable (4.2.8) 18 Dec 2014

  Summary: A remote attacker can send a carefully crafted packet that
	can overflow a stack buffer and potentially allow malicious
	code to be executed with the privilege level of the ntpd process.

  Mitigation: Upgrade to 4.2.8, or later.

  Credit: This vulnerability was discovered by Stephen Roettger of the
	Google Security Team.

* receive(): missing return on error

  References: Sec 2670 / CVE-2014-9296 / VU#852879
  CVSS: (AV:N/AC:L/Au:N/C:N/I:N/A:P) Base Score: 5.0
  Versions: All NTP4 releases before 4.2.8
  Date Resolved: Stable (4.2.8) 18 Dec 2014

  Summary: Code in ntp_proto.c:receive() was missing a 'return;' in
  	the code path where an error was detected, which meant
	processing did not stop when a specific rare error occurred.
	We haven't found a way for this bug to affect system integrity.
	If there is no way to affect system integrity the base CVSS
	score for this bug is 0. If there is one avenue through which
	system integrity can be partially affected, the base score
	becomes a 5. If system integrity can be partially affected
	via all three integrity metrics, the CVSS base score become 7.5.

  Mitigation:
        Upgrade to 4.2.8, or later,
        or Remove or comment out all configuration directives
	beginning with the crypto keyword in your ntp.conf file.

  Credit: This vulnerability was discovered by Stephen Roettger of the
  	Google Security Team.

See http://support.ntp.org/security for more information.
Note update of net/ntp4 package to 4.2.8.
Update HOMEPAGE, was Host Unknown. But the link to download still gets 404.