- Bump PORTREVISION
Changes:
- CVE-2006-7243
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow
context-dependent attackers to bypass intended access restrictions by placing a
safe file extension after this character, as demonstrated by .php\0.jpg at the
end of the argument to the file_exists function
Secuity 3761df02-0f9c-11e0-becc-0022156e8794 fixed by check in fopen functions
for strlen(filename) != filename_len
- CVE-2012-4388
The sapi_header_op function in main/SAPI.c does not properly determine a pointer
during checks for %0D sequences (aka carriage return characters), which allows
remote attackers to bypass an HTTP response-splitting protection mechanism via a
crafted URL, this vulnerability exists because of an incorrect fix for
CVE-2011-1398.
- Timezone database updated to version 2012.9 (2012i)
PR: ports/173685
Submitted by: Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Approved by: maintainer
Feature safe: yes
- Add and update relevant vuxml entries
Changes:
- CVE-2011-1398 - The sapi_header_op function in main/SAPI.c in PHP
before 5.3.11 does not properly handle %0D sequences
- CVE-2012-0789 - Memory leak in the timezone functionality in PHP
before 5.3.9 allows remote attackers to cause a denial of service
(memory consumption) by triggering many strtotime function calls,
which are not properly handled by the php_date_parse_tzfile cache.
- CVE-2012-3365 - The SQLite functionality in PHP before 5.3.15 allows
remote attackers to bypass the open_basedir protection mechanism via
unspecified vectors
- Timezone database updated to version 2012.5 (2012e) (from 2011.13 (2011m))
- Minor improvements (CVE-2012-2688, compilation issues with old GCC)
PR: ports/171583
Submitted by: Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Approved by: Alex Keda <admin@lissyara.su> (maintainer)
- update backports patch to latest version (20120504)
- align pathnames in slave ports
- bump PORTREVISION
The only drawback of this change is that now for building of every slave
port (php extension) we extracting full php52 source tree.
Apologies that it took that long.
PR: 164849
Submitted by: Svyatoslav Lempert <svyatoslav.lempert at gmail dot com>
Approved by: Alex Keda <admin at lissyara dot su>
Security: 60de13d5-95f0-11e1-806a-001143cd36d8
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
2 weeks according to portaudit (ranging from 23 days to 7 years).
The maintainers were notified by mail that this action would be taken
on 2011-09-03. (Ports for which maintainers responded have been/will be
dealt with separately.)
Also mark DEPRECATED ports that rely on the FORBIDDEN ports, and a few
ports that rely on those DEPRECATED ports.
