Important changes:
*) SECURITY: CAN-2004-0493 (cve.mitre.org)
Close a denial of service vulnerability identified by Georgi
Guninski which could lead to memory exhaustion with certain
input data. [Jeff Trawick]
*) SECURITY: CAN-2004-0488 (cve.mitre.org)
mod_ssl: Fix a buffer overflow in the FakeBasicAuth code for a
(trusted) client certificate subject DN which exceeds 6K in length.
[Joe Orton]
Details can be found here:
http://www.apache.org/dist/httpd/CHANGES_2.0
- Use autoconf 2.59
- Add add SUEXEC_LOGFILE tunable to set suexec logfile [1]
- Silently ignore removal of libexec/apache2 directory
- Import latest version of apr_reslit.c from apr CVS which
adds timeout feature to apr_reslist_acquire().
This is required for future mod_logio-st.
- Add explicit dependency on libiconv (so nowwe support libiconv)
- Move Windows Update fix from MASTER_SITE_LOCAL to ports tree
- add WITH_EXPERIMENTAL_PATCHES knobs:
These patches are backports from apache CVS HEAD or apr CVS HEAD.
They have positive impacts on apache responsiveness but can be
instable
and are NOT currently supported by apache/apr teams.
* exp-http-ready.patch: add "httpready" support for ACCEPT_FILTER
(currently apache 2 only support "dataready")
* exp-apr-kqueue.patch: add support for kqueue in apr_poll().
This patch greatly improves apache network performance (up to
18% according to the author, on my test box, between 13% and 21%)
Test and feedback on -STABLE are welcome ;)
For more details, please see:
http://marc.theaimsgroup.com/?t=108650227500001&r=1&w=2
Submitted by: knu [1]
NOTE:
Please set MASTER_SITE_APACHE_HTTPD to closest mirrors.
you can easily find them from:
http://www.apache.org/dyn/closer.cgi/httpd/
Thanks :
portupgrade:
- Make -PP/--use-packages-only work better, just as I originally
intended. Now packages are correctly identified using
pkg_info(1), "LATEST_LINK" files are also properly detected.
Related informational messages have also been improved.
It turned out that the LATEST_LINK/NO_LATEST_LINK detection was
broken long ago and hasn't been working for long.
pkg_fetch(1):
- Properly rename a "latest link" file with a full package name with
version part.
pkgtools.conf(5):
- Improve and unify the method for pattern matching in MAKE_ARGS,
BEFOREBUILD, BEFOREDEINSTALL and AFTERINSTALL variables.
This should fix some cases where it looks like MAKE_ARGS entries
are ignored.
logfile, one Linux-only change, and one change in a test script). Assign
submitter as new maintainer as current one has not responded to PRs for
some time.
PR: ports/68199
Submitted by: Fernan Aguero <fernan at iib dot unsam dot edu dot ar>
version of perl in 4.x
Whilst the package list isn't affected, PORTREVISION has been bumped
to warn 4.x users -- those on 5.x don't necessarily have to update.
PR: 68509
Submitted by: Martin Kammerhofer <dada@pluto.tugraz.at>
-Remove the build and run depend of XFree86-4-clients.
-Bump PORTREVISION, because of depend and pkg-plist changes.
PR: ports/68512
Submitted by: Roman Bogorodskiy <bogorodskiy@inbox.ru>
