March 2018 - CRUX - lists.crux.nu

ports/opt (3.4): [notify] firefox: updated to 52.7.3esr. Fix for CVE-2018-5148
by crux＠crux.nu 27 Mar '18

27 Mar '18

commit 7b0af82e1a1394a0c963261f9ee4e9fba6d5e6b4 Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Tue Mar 27 21:12:20 2018 +0200 [notify] firefox: updated to 52.7.3esr. Fix for CVE-2018-5148 diff --git a/firefox/.md5sum b/firefox/.md5sum index 5f0661db0..f08f2c5b9 100644 --- a/firefox/.md5sum +++ b/firefox/.md5sum @@ -1,3 +1,3 @@ -0f1cfb1276ec3504e114e60836b80f70 firefox-52.7.2esr.source.tar.xz +06eb5d65a6e0eb5b1c21c73430534c43 firefox-52.7.3esr.source.tar.xz afe61c7760e835bd12d5dfd40af4ec84 firefox-install-dir.patch cf6971669f70b440cb6ff8df8b2722ae firefox.desktop diff --git a/firefox/.signature b/firefox/.signature index 84313841c..57a8ca3bc 100644 --- a/firefox/.signature +++ b/firefox/.signature @@ -1,7 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/b8yonhxUV65mj2usPMmv/xob0ED18KOQ6SoFm4+eJjpb2ORzsiHMCUUTD4RMjkVzs5GmL3ip+HjsYdBrLGPwQA= -SHA256 (Pkgfile) = 2650d2ff8fc02e8786377e4a3277375041894f62b20ab68c3599753502b534ee +RWSE3ohX2g5d/XI4nWoMhnXIA/9wwYWoz6gNT76pH7ins+yJ4j9j4J3N2GWBUJNFBMMXH2kPoVOpqZh7yRZ6yK0oey6esOG6BgE= +SHA256 (Pkgfile) = 10cbd877f480d3245a56a044a0e73f2ffac22b16d73983cb844d7a5a542f233e SHA256 (.footprint) = 8dfd3449f8d0a00b2ebc71e998a948728b63356ea7ab0cc10c2e2f79d1df0e07 -SHA256 (firefox-52.7.2esr.source.tar.xz) = 659260afe0016d0ef46862ce08035e22b38fafc536d73e5bfefd0cbd9ae6fb05 +SHA256 (firefox-52.7.3esr.source.tar.xz) = 5cc68c1a7486cfbbf02aec0e9da9f87b55e7bfc68c7d5139bc1e578441aaf19f SHA256 (firefox-install-dir.patch) = 32c0102521b7296627ba457575c742746400680c3aecd18be8b1b382dccdc0ce SHA256 (firefox.desktop) = 8ba3439f3dfc5cab883641969c93d8d15f8f20d7188d9568346b2edad52d6f91 diff --git a/firefox/Pkgfile b/firefox/Pkgfile index 04512e0d0..249bf82cf 100644 --- a/firefox/Pkgfile +++ b/firefox/Pkgfile @@ -4,7 +4,7 @@ # Depends on: nss, autoconf-2.13, unzip, zip, libidl, gtk, gtk3, alsa-lib, xorg-libxt, yasm name=firefox -version=52.7.2esr +version=52.7.3esr release=1 source=(https://ftp.mozilla.org/pub/firefox/releases/$version/source/firefo… firefox-install-dir.patch firefox.desktop)

1 0

ports/opt (3.3): [notify] firefox: updated to 52.7.3esr. Fix for CVE-2018-5148
by crux＠crux.nu 27 Mar '18

27 Mar '18

commit 7b0af82e1a1394a0c963261f9ee4e9fba6d5e6b4 Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Tue Mar 27 21:12:20 2018 +0200 [notify] firefox: updated to 52.7.3esr. Fix for CVE-2018-5148 diff --git a/firefox/.md5sum b/firefox/.md5sum index 5f0661db0..f08f2c5b9 100644 --- a/firefox/.md5sum +++ b/firefox/.md5sum @@ -1,3 +1,3 @@ -0f1cfb1276ec3504e114e60836b80f70 firefox-52.7.2esr.source.tar.xz +06eb5d65a6e0eb5b1c21c73430534c43 firefox-52.7.3esr.source.tar.xz afe61c7760e835bd12d5dfd40af4ec84 firefox-install-dir.patch cf6971669f70b440cb6ff8df8b2722ae firefox.desktop diff --git a/firefox/.signature b/firefox/.signature index 84313841c..57a8ca3bc 100644 --- a/firefox/.signature +++ b/firefox/.signature @@ -1,7 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/b8yonhxUV65mj2usPMmv/xob0ED18KOQ6SoFm4+eJjpb2ORzsiHMCUUTD4RMjkVzs5GmL3ip+HjsYdBrLGPwQA= -SHA256 (Pkgfile) = 2650d2ff8fc02e8786377e4a3277375041894f62b20ab68c3599753502b534ee +RWSE3ohX2g5d/XI4nWoMhnXIA/9wwYWoz6gNT76pH7ins+yJ4j9j4J3N2GWBUJNFBMMXH2kPoVOpqZh7yRZ6yK0oey6esOG6BgE= +SHA256 (Pkgfile) = 10cbd877f480d3245a56a044a0e73f2ffac22b16d73983cb844d7a5a542f233e SHA256 (.footprint) = 8dfd3449f8d0a00b2ebc71e998a948728b63356ea7ab0cc10c2e2f79d1df0e07 -SHA256 (firefox-52.7.2esr.source.tar.xz) = 659260afe0016d0ef46862ce08035e22b38fafc536d73e5bfefd0cbd9ae6fb05 +SHA256 (firefox-52.7.3esr.source.tar.xz) = 5cc68c1a7486cfbbf02aec0e9da9f87b55e7bfc68c7d5139bc1e578441aaf19f SHA256 (firefox-install-dir.patch) = 32c0102521b7296627ba457575c742746400680c3aecd18be8b1b382dccdc0ce SHA256 (firefox.desktop) = 8ba3439f3dfc5cab883641969c93d8d15f8f20d7188d9568346b2edad52d6f91 diff --git a/firefox/Pkgfile b/firefox/Pkgfile index 04512e0d0..249bf82cf 100644 --- a/firefox/Pkgfile +++ b/firefox/Pkgfile @@ -4,7 +4,7 @@ # Depends on: nss, autoconf-2.13, unzip, zip, libidl, gtk, gtk3, alsa-lib, xorg-libxt, yasm name=firefox -version=52.7.2esr +version=52.7.3esr release=1 source=(https://ftp.mozilla.org/pub/firefox/releases/$version/source/firefo… firefox-install-dir.patch firefox.desktop)

1 0

ports/core (3.4): [notify] openssl: updated to 1.0.2o. Fix for CVE-2018-0739
by crux＠crux.nu 27 Mar '18

27 Mar '18

commit 221ebf31bd8ec1a4c8cb0416da50897e6a7489be Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Tue Mar 27 20:58:51 2018 +0200 [notify] openssl: updated to 1.0.2o. Fix for CVE-2018-0739 diff --git a/openssl/.md5sum b/openssl/.md5sum index 47b76adf..fbac7282 100644 --- a/openssl/.md5sum +++ b/openssl/.md5sum @@ -1,2 +1,2 @@ 91f85842d2118003ee465c34259047e6 mksslcert.sh -13bdc1b1d1ff39b6fd42a255e74676a4 openssl-1.0.2n.tar.gz +44279b8557c3247cbe324e2322ecd114 openssl-1.0.2o.tar.gz diff --git a/openssl/.signature b/openssl/.signature index 3639404c..5a4c5981 100644 --- a/openssl/.signature +++ b/openssl/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/core.pub -RWRJc1FUaeVeqq1Tn1XXxsRt+F/Bhc4qXjWmXrXe7SXy9JUE8CiRnC2YKOEaZ5y2YojHT47jDqBlucmjSsX5DjFp3CUsaM9bvww= -SHA256 (Pkgfile) = d41ea6a07d6060be1b2c8ab58897609d00e504c5c0313acdbe8f96cb53201cf1 +RWRJc1FUaeVeqqn1ERAwn7xZ8DnAWZ9gOGdeqYJvHh/qU/Id78alBSt4/zEWH/Per6Hz+3IpmDbudbGnXyqMQlND8Xk7MgMWUAY= +SHA256 (Pkgfile) = a7ae1bbf2602b717ac5070c360d6072be7079a8e3c630fda6cf8f55df39b65b6 SHA256 (.footprint) = 7dbc1710a05fce27dc1dc6997877ecf87a36e43283e87cc3a1fbc00894c21a6a -SHA256 (openssl-1.0.2n.tar.gz) = 370babb75f278c39e0c50e8c4e7493bc0f18db6867478341a832a982fd15a8fe +SHA256 (openssl-1.0.2o.tar.gz) = ec3f5c9714ba0fd45cb4e087301eb1336c317e0d20b575a125050470e8089e4d SHA256 (mksslcert.sh) = d01cfd061b792f4f7444429582c5c9e83aaa7fc63cafd05669fd3f2970dff779 diff --git a/openssl/Pkgfile b/openssl/Pkgfile index 4ed7635a..4000e716 100644 --- a/openssl/Pkgfile +++ b/openssl/Pkgfile @@ -3,7 +3,7 @@ # Maintainer: CRUX System Team, core-ports at crux dot nu name=openssl -version=1.0.2n +version=1.0.2o release=1 source=(http://www.openssl.org/source/$name-$version.tar.gz \ mksslcert.sh)

1 0

ports/core (3.3): [notify] openssl: updated to 1.0.2o. Fix for CVE-2018-0739
by crux＠crux.nu 27 Mar '18

27 Mar '18

commit 221ebf31bd8ec1a4c8cb0416da50897e6a7489be Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Tue Mar 27 20:58:51 2018 +0200 [notify] openssl: updated to 1.0.2o. Fix for CVE-2018-0739 diff --git a/openssl/.md5sum b/openssl/.md5sum index 47b76adf..fbac7282 100644 --- a/openssl/.md5sum +++ b/openssl/.md5sum @@ -1,2 +1,2 @@ 91f85842d2118003ee465c34259047e6 mksslcert.sh -13bdc1b1d1ff39b6fd42a255e74676a4 openssl-1.0.2n.tar.gz +44279b8557c3247cbe324e2322ecd114 openssl-1.0.2o.tar.gz diff --git a/openssl/.signature b/openssl/.signature index 3639404c..5a4c5981 100644 --- a/openssl/.signature +++ b/openssl/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/core.pub -RWRJc1FUaeVeqq1Tn1XXxsRt+F/Bhc4qXjWmXrXe7SXy9JUE8CiRnC2YKOEaZ5y2YojHT47jDqBlucmjSsX5DjFp3CUsaM9bvww= -SHA256 (Pkgfile) = d41ea6a07d6060be1b2c8ab58897609d00e504c5c0313acdbe8f96cb53201cf1 +RWRJc1FUaeVeqqn1ERAwn7xZ8DnAWZ9gOGdeqYJvHh/qU/Id78alBSt4/zEWH/Per6Hz+3IpmDbudbGnXyqMQlND8Xk7MgMWUAY= +SHA256 (Pkgfile) = a7ae1bbf2602b717ac5070c360d6072be7079a8e3c630fda6cf8f55df39b65b6 SHA256 (.footprint) = 7dbc1710a05fce27dc1dc6997877ecf87a36e43283e87cc3a1fbc00894c21a6a -SHA256 (openssl-1.0.2n.tar.gz) = 370babb75f278c39e0c50e8c4e7493bc0f18db6867478341a832a982fd15a8fe +SHA256 (openssl-1.0.2o.tar.gz) = ec3f5c9714ba0fd45cb4e087301eb1336c317e0d20b575a125050470e8089e4d SHA256 (mksslcert.sh) = d01cfd061b792f4f7444429582c5c9e83aaa7fc63cafd05669fd3f2970dff779 diff --git a/openssl/Pkgfile b/openssl/Pkgfile index 4ed7635a..4000e716 100644 --- a/openssl/Pkgfile +++ b/openssl/Pkgfile @@ -3,7 +3,7 @@ # Maintainer: CRUX System Team, core-ports at crux dot nu name=openssl -version=1.0.2n +version=1.0.2o release=1 source=(http://www.openssl.org/source/$name-$version.tar.gz \ mksslcert.sh)

1 0

CruxEX (CRUX 3.2) Live Build 180321 with LXDE, Spotify (a must-have!), Google Chrome (for Netflix) and kernel 4.15.11-exton
by C A Exton 21 Mar '18

21 Mar '18

A new version of CruxEX is out. ############################################################ CruxEX (CRUX 3.2) Live Build 180321 with LXDE, Spotify (a must-have!), Google Chrome (for Netflix) and kernel 4.15.11-exton CruxEX 3.3 64 bit Linux Live USB is based on CRUX 3.3. CruxEX 3.3 2018 uses the LXDE Desktop environment. I have replaced the original CRUX kernel with “my” special kernel 4.15.11-exton, with support for “extra everything”. KERNEL and installed PACKAGES Kernel 4.15.11 is the latest available stable kernel as of 180321. Among all installed and updated applications are Firefox, Google Chrome (for Netflix), Spotify (a must-have!), GParted, PCManFM, Gimp and Wicd. NOTE: Spotify and Google Chrome are not in the CRUX repositories. NEWS 180321 CruxEX 2018 is distributed only as a Zip file. Install my new version of CruxEX 3.3 64bit from 180321 to a USB Pen Drive and save your system changes. If you later on decide you want to install CruxEX to hard drive from the USB Pen Drive all your system changes will also be installed to the hard drive. UNIQUE CruxEX 3.3 2018 build 180321 is – as my previous CRUX-remasters – unique in the world. I.e. there is no other CRUX Live CD/USB (as far as I know). In any case, not for downloading. SCREENSHOTS 1. The LXDE Desktop with Spotify running: http://cruxex.exton.net/cruxex-desktop-spotify-running-180321.jpg 2. Netflix running in Google Chrome: http://cruxex.exton.net/cruxex-netflix-nvidia-running.jpg 3. Showing Google Chrome version: http://cruxex.exton.net/cruxex-google-chrome-version.jpg 4. Root’s Desktop with Wicd running: http://cruxex.exton.net/cruxex-root-desktop-180321.jpg READ MORE: http://cruxex.exton.net/ ############################################################# 180321 C A Exton

3 3

ports/opt (3.4): [notify] poppler: update to 0.63.0
by crux＠crux.nu 19 Mar '18

19 Mar '18

commit a6f6e65bc46606d3602e0995476302c31699702e Author: Juergen Daubert <jue(a)jue.li> Date: Mon Mar 19 12:17:54 2018 +0100 [notify] poppler: update to 0.63.0 ABI has been changed, rebuild of direct dependent ports like cups-filters required. diff --git a/poppler/.footprint b/poppler/.footprint index 8e65ecda0..6b553f0e3 100644 --- a/poppler/.footprint +++ b/poppler/.footprint @@ -150,11 +150,11 @@ drwxr-xr-x root/root usr/include/poppler/splash/ -rw-r--r-- root/root usr/include/poppler/splash/SplashXPathScanner.h drwxr-xr-x root/root usr/lib/ lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so -> libpoppler-cpp.so.0 -lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so.0 -> libpoppler-cpp.so.0.3.0 --rwxr-xr-x root/root usr/lib/libpoppler-cpp.so.0.3.0 -lrwxrwxrwx root/root usr/lib/libpoppler.so -> libpoppler.so.73 -lrwxrwxrwx root/root usr/lib/libpoppler.so.73 -> libpoppler.so.73.0.0 --rwxr-xr-x root/root usr/lib/libpoppler.so.73.0.0 +lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so.0 -> libpoppler-cpp.so.0.4.0 +-rwxr-xr-x root/root usr/lib/libpoppler-cpp.so.0.4.0 +lrwxrwxrwx root/root usr/lib/libpoppler.so -> libpoppler.so.74 +lrwxrwxrwx root/root usr/lib/libpoppler.so.74 -> libpoppler.so.74.0.0 +-rwxr-xr-x root/root usr/lib/libpoppler.so.74.0.0 drwxr-xr-x root/root usr/lib/pkgconfig/ -rw-r--r-- root/root usr/lib/pkgconfig/poppler-cairo.pc -rw-r--r-- root/root usr/lib/pkgconfig/poppler-cpp.pc diff --git a/poppler/.md5sum b/poppler/.md5sum index a990a9ea4..8f35bcec2 100644 --- a/poppler/.md5sum +++ b/poppler/.md5sum @@ -1 +1 @@ -42b801f2defaccb6b6cf1bf783ee1552 poppler-0.62.0.tar.xz +66a54da4896b1408611699feda5c1821 poppler-0.63.0.tar.xz diff --git a/poppler/.signature b/poppler/.signature index 16de522f5..d9309cac2 100644 --- a/poppler/.signature +++ b/poppler/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/ZOpJR2K1zD2XS24ujTnyeiemuiNW/jJbGJJpXxl/OgLFMbXlXahCXu6QqjP7mIjuLpOjdCiZ+4xeztLctslXAc= -SHA256 (Pkgfile) = 54b98f56e6183497b7ddc9e19d83fbdba97b5b9d42b407fab82bb5f70083e2b6 -SHA256 (.footprint) = aecdc6cd89696ee4b4e47dcd33bcde0e923971b37079e1f8b5f6d03d83541ae8 -SHA256 (poppler-0.62.0.tar.xz) = 5b9a73dfd4d6f61d165ada1e4f0abd2d420494bf9d0b1c15d0db3f7b83a729c6 +RWSE3ohX2g5d/dz/5NZi6COFh1kHuX9s7Qurdp59lxcrV2x729iodmvLGIOqXFtJB/IYiWzDbqeD3IVpxXMzxefqRjEl4TvNjAs= +SHA256 (Pkgfile) = 410f44e34d56291a75849b0017d0a0fa7e939524a9759067bcb5ee43ac7ec31f +SHA256 (.footprint) = 0739c74d2dcf82d94e03937bf3827140b81b2f780667ca361e4bae0a0f6b8a3e +SHA256 (poppler-0.63.0.tar.xz) = 27cc8addafc791e1a26ce6acc2b490926ea73a4f89196dd8a7742cff7cf8a111 diff --git a/poppler/Pkgfile b/poppler/Pkgfile index 7b14966be..974765a44 100644 --- a/poppler/Pkgfile +++ b/poppler/Pkgfile @@ -4,7 +4,7 @@ # Depends on: cmake cairo lcms2 name=poppler -version=0.62.0 +version=0.63.0 release=1 source=(https://poppler.freedesktop.org/poppler-$version.tar.xz)

1 0

ports/opt (3.4): [notify] firefox: updated to 52.7.2esr. Fix for CVE-2018-5146
by crux＠crux.nu 19 Mar '18

19 Mar '18

commit d469e49ff2452863fd423042b92895f1b2ee5136 Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Sat Mar 17 05:44:32 2018 +0100 [notify] firefox: updated to 52.7.2esr. Fix for CVE-2018-5146 diff --git a/firefox/.md5sum b/firefox/.md5sum index 8ed3a9bd9..5f0661db0 100644 --- a/firefox/.md5sum +++ b/firefox/.md5sum @@ -1,3 +1,3 @@ -5e8d73d94ec686b7920c483e5d7f7816 firefox-52.7.0esr.source.tar.xz +0f1cfb1276ec3504e114e60836b80f70 firefox-52.7.2esr.source.tar.xz afe61c7760e835bd12d5dfd40af4ec84 firefox-install-dir.patch cf6971669f70b440cb6ff8df8b2722ae firefox.desktop diff --git a/firefox/.signature b/firefox/.signature index 97f67e3b0..84313841c 100644 --- a/firefox/.signature +++ b/firefox/.signature @@ -1,7 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/cFC2kfZHsH+qu0bkfgpSSKQSxcd6HS93WfWCtMI2VVBefl813PrJABNTiXz7QCjkN45tqjhkNQeHUtxPEGOhgI= -SHA256 (Pkgfile) = c63d53e9c91311917b941974109901b9fcf85a8d4d37cc2222332824f6c80162 +RWSE3ohX2g5d/b8yonhxUV65mj2usPMmv/xob0ED18KOQ6SoFm4+eJjpb2ORzsiHMCUUTD4RMjkVzs5GmL3ip+HjsYdBrLGPwQA= +SHA256 (Pkgfile) = 2650d2ff8fc02e8786377e4a3277375041894f62b20ab68c3599753502b534ee SHA256 (.footprint) = 8dfd3449f8d0a00b2ebc71e998a948728b63356ea7ab0cc10c2e2f79d1df0e07 -SHA256 (firefox-52.7.0esr.source.tar.xz) = 293c8394ed7dab1ea833c50a7b19a2fa3432e7c2f9edd891403bca12fc0fed33 +SHA256 (firefox-52.7.2esr.source.tar.xz) = 659260afe0016d0ef46862ce08035e22b38fafc536d73e5bfefd0cbd9ae6fb05 SHA256 (firefox-install-dir.patch) = 32c0102521b7296627ba457575c742746400680c3aecd18be8b1b382dccdc0ce SHA256 (firefox.desktop) = 8ba3439f3dfc5cab883641969c93d8d15f8f20d7188d9568346b2edad52d6f91 diff --git a/firefox/Pkgfile b/firefox/Pkgfile index 13da9ea50..04512e0d0 100644 --- a/firefox/Pkgfile +++ b/firefox/Pkgfile @@ -4,7 +4,7 @@ # Depends on: nss, autoconf-2.13, unzip, zip, libidl, gtk, gtk3, alsa-lib, xorg-libxt, yasm name=firefox -version=52.7.0esr +version=52.7.2esr release=1 source=(https://ftp.mozilla.org/pub/firefox/releases/$version/source/firefo… firefox-install-dir.patch firefox.desktop)

1 0

ports/opt (3.4): [notify] libvorbis: 1.3.5 -> 1.3.6 CVE-2018-5146
by crux＠crux.nu 19 Mar '18

19 Mar '18

commit 7f0a7ceabf6a8aa9737dbaca28cd8880c8f15df0 Author: Danny Rawlins <monster.romster(a)gmail.com> Date: Sat Mar 17 15:32:06 2018 +1100 [notify] libvorbis: 1.3.5 -> 1.3.6 CVE-2018-5146 diff --git a/libvorbis/.md5sum b/libvorbis/.md5sum index 8bbbeef92..314482ad6 100644 --- a/libvorbis/.md5sum +++ b/libvorbis/.md5sum @@ -1,4 +1,2 @@ 943275d84d55dfa072ec3a2566fd9bfa CVE-2017-14160.patch -d32bb2a15cde558464ff6b1a7199d9c6 CVE-2017-14632.patch -d54deff7374d7205441cf5e4dfd32bee CVE-2017-14633.patch -28cb28097c07a735d6af56e598e1c90f libvorbis-1.3.5.tar.xz +b7d1692f275c73e7833ed1cc2697cd65 libvorbis-1.3.6.tar.xz diff --git a/libvorbis/.signature b/libvorbis/.signature index 15a02858a..1d9b2fff7 100644 --- a/libvorbis/.signature +++ b/libvorbis/.signature @@ -1,8 +1,6 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/XBLjepyAeVAsv0mpvzium7JjPBpyQUlW+ZuPdO7oz0ATE3bC1nBn5EHSwuxsNGum4EOVduL32Cr08X2/7IVtwk= -SHA256 (Pkgfile) = 833e8c8db431ef3375b53fa800a7d06a33a9b6e62913ff5ec6c8dd5d8c1b51ad +RWSE3ohX2g5d/Shy67ruRjEpCHOsfIQxfHr8pwN3DSsHj1YwGc58vD8ZiC+750BoHQGJIKOG587Ac5kBv3pgs9/2ay7c0h5E3gc= +SHA256 (Pkgfile) = 0b19e75e688d1961d2ed901c31906a2bb1af1ee7966e7cbc40b0a16c0a8240df SHA256 (.footprint) = 709e3fdd589a25de7fa9ca41700639d37f7dae5eba48fe6cffa354efd8625b37 -SHA256 (libvorbis-1.3.5.tar.xz) = 54f94a9527ff0a88477be0a71c0bab09a4c3febe0ed878b24824906cd4b0e1d1 -SHA256 (CVE-2017-14633.patch) = d1a44c7a683b3d1ab2bd645ef4ee21002cb1c7466975073381ed1e533153e328 -SHA256 (CVE-2017-14632.patch) = 2fed965880686a145c0da6abbb08224d0ed26e4bf1b1c3a8f7b5d2d33f6bc8e7 +SHA256 (libvorbis-1.3.6.tar.xz) = af00bb5a784e7c9e69f56823de4637c350643deedaf333d0fa86ecdba6fcb415 SHA256 (CVE-2017-14160.patch) = f93bf45de3a21db0fa9bb9cd25edefb1182bf24d61028a86cbf45fbcd11fbdf5 diff --git a/libvorbis/CVE-2017-14632.patch b/libvorbis/CVE-2017-14632.patch deleted file mode 100644 index 9ff5a8ca1..000000000 --- a/libvorbis/CVE-2017-14632.patch +++ /dev/null @@ -1,51 +0,0 @@ -From c1c2831fc7306d5fbd7bc800324efd12b28d327f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx(a)sigxcpu.org> -Date: Wed, 15 Nov 2017 18:22:59 +0100 -Subject: [PATCH] CVE-2017-14632: vorbis_analysis_header_out: Don't clear opb - if not initialized - -If the number of channels is not within the allowed range -we call oggback_writeclear altough it's not initialized yet. - -This fixes - - =23371== Invalid free() / delete / delete[] / realloc() - ==23371== at 0x4C2CE1B: free (vg_replace_malloc.c:530) - ==23371== by 0x829CA31: oggpack_writeclear (in /usr/lib/x86_64-linux-gnu/libogg.so.0.8.2) - ==23371== by 0x84B96EE: vorbis_analysis_headerout (info.c:652) - ==23371== by 0x9FBCBCC: ??? (in /usr/lib/x86_64-linux-gnu/sox/libsox_fmt_vorbis.so) - ==23371== by 0x4E524F1: ??? (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) - ==23371== by 0x4E52CCA: sox_open_write (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) - ==23371== by 0x10D82A: open_output_file (sox.c:1556) - ==23371== by 0x10D82A: process (sox.c:1753) - ==23371== by 0x10D82A: main (sox.c:3012) - ==23371== Address 0x68768c8 is 488 bytes inside a block of size 880 alloc'd - ==23371== at 0x4C2BB1F: malloc (vg_replace_malloc.c:298) - ==23371== by 0x4C2DE9F: realloc (vg_replace_malloc.c:785) - ==23371== by 0x4E545C2: lsx_realloc (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) - ==23371== by 0x9FBC9A0: ??? (in /usr/lib/x86_64-linux-gnu/sox/libsox_fmt_vorbis.so) - ==23371== by 0x4E524F1: ??? (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) - ==23371== by 0x4E52CCA: sox_open_write (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) - ==23371== by 0x10D82A: open_output_file (sox.c:1556) - ==23371== by 0x10D82A: process (sox.c:1753) - ==23371== by 0x10D82A: main (sox.c:3012) - -as seen when using the testcase from CVE-2017-11333 with -008d23b782be09c8d75ba8190b1794abd66c7121 applied. However the error was -there before. ---- - lib/info.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/lib/info.c b/lib/info.c -index 7bc4ea42..8d0b2edd 100644 ---- a/lib/info.c -+++ b/lib/info.c -@@ -589,6 +589,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v, - private_state *b=v->backend_state; - - if(!b||vi->channels<=0||vi->channels>256){ -+ b = NULL; - ret=OV_EFAULT; - goto err_out; - } diff --git a/libvorbis/CVE-2017-14633.patch b/libvorbis/CVE-2017-14633.patch deleted file mode 100644 index 069927c7b..000000000 --- a/libvorbis/CVE-2017-14633.patch +++ /dev/null @@ -1,31 +0,0 @@ -From a79ec216cd119069c68b8f3542c6a425a74ab993 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx(a)sigxcpu.org> -Date: Tue, 31 Oct 2017 18:32:46 +0100 -Subject: [PATCH] CVE-2017-14633: Don't allow for more than 256 channels - -Otherwise - - for(i=0;i<vi->channels;i++){ - /* the encoder setup assumes that all the modes used by any - specific bitrate tweaking use the same floor */ - int submap=info->chmuxlist[i]; - -overreads later in mapping0_forward since chmuxlist is a fixed array of -256 elements max. ---- - lib/info.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/info.c b/lib/info.c -index fe759edf..7bc4ea42 100644 ---- a/lib/info.c -+++ b/lib/info.c -@@ -588,7 +588,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v, - oggpack_buffer opb; - private_state *b=v->backend_state; - -- if(!b||vi->channels<=0){ -+ if(!b||vi->channels<=0||vi->channels>256){ - ret=OV_EFAULT; - goto err_out; - } diff --git a/libvorbis/Pkgfile b/libvorbis/Pkgfile index 6461bb154..04d7d6f7b 100644 --- a/libvorbis/Pkgfile +++ b/libvorbis/Pkgfile @@ -4,19 +4,15 @@ # Depends on: libogg name=libvorbis -version=1.3.5 -release=2 +version=1.3.6 +release=1 source=(https://downloads.xiph.org/releases/vorbis/$name-$version.tar.xz - CVE-2017-14633.patch - CVE-2017-14632.patch CVE-2017-14160.patch) build() { cd $name-$version # https://security-tracker.debian.org/tracker/source-package/libvorbis - patch -p1 -i $SRC/CVE-2017-14633.patch - patch -p1 -i $SRC/CVE-2017-14632.patch patch -p1 -i $SRC/CVE-2017-14160.patch ./configure --prefix=/usr

1 0

ports/opt (3.3): [notify] poppler: update to 0.63.0
by crux＠crux.nu 19 Mar '18

19 Mar '18

commit a6f6e65bc46606d3602e0995476302c31699702e Author: Juergen Daubert <jue(a)jue.li> Date: Mon Mar 19 12:17:54 2018 +0100 [notify] poppler: update to 0.63.0 ABI has been changed, rebuild of direct dependent ports like cups-filters required. diff --git a/poppler/.footprint b/poppler/.footprint index 8e65ecda0..6b553f0e3 100644 --- a/poppler/.footprint +++ b/poppler/.footprint @@ -150,11 +150,11 @@ drwxr-xr-x root/root usr/include/poppler/splash/ -rw-r--r-- root/root usr/include/poppler/splash/SplashXPathScanner.h drwxr-xr-x root/root usr/lib/ lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so -> libpoppler-cpp.so.0 -lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so.0 -> libpoppler-cpp.so.0.3.0 --rwxr-xr-x root/root usr/lib/libpoppler-cpp.so.0.3.0 -lrwxrwxrwx root/root usr/lib/libpoppler.so -> libpoppler.so.73 -lrwxrwxrwx root/root usr/lib/libpoppler.so.73 -> libpoppler.so.73.0.0 --rwxr-xr-x root/root usr/lib/libpoppler.so.73.0.0 +lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so.0 -> libpoppler-cpp.so.0.4.0 +-rwxr-xr-x root/root usr/lib/libpoppler-cpp.so.0.4.0 +lrwxrwxrwx root/root usr/lib/libpoppler.so -> libpoppler.so.74 +lrwxrwxrwx root/root usr/lib/libpoppler.so.74 -> libpoppler.so.74.0.0 +-rwxr-xr-x root/root usr/lib/libpoppler.so.74.0.0 drwxr-xr-x root/root usr/lib/pkgconfig/ -rw-r--r-- root/root usr/lib/pkgconfig/poppler-cairo.pc -rw-r--r-- root/root usr/lib/pkgconfig/poppler-cpp.pc diff --git a/poppler/.md5sum b/poppler/.md5sum index a990a9ea4..8f35bcec2 100644 --- a/poppler/.md5sum +++ b/poppler/.md5sum @@ -1 +1 @@ -42b801f2defaccb6b6cf1bf783ee1552 poppler-0.62.0.tar.xz +66a54da4896b1408611699feda5c1821 poppler-0.63.0.tar.xz diff --git a/poppler/.signature b/poppler/.signature index 16de522f5..d9309cac2 100644 --- a/poppler/.signature +++ b/poppler/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/ZOpJR2K1zD2XS24ujTnyeiemuiNW/jJbGJJpXxl/OgLFMbXlXahCXu6QqjP7mIjuLpOjdCiZ+4xeztLctslXAc= -SHA256 (Pkgfile) = 54b98f56e6183497b7ddc9e19d83fbdba97b5b9d42b407fab82bb5f70083e2b6 -SHA256 (.footprint) = aecdc6cd89696ee4b4e47dcd33bcde0e923971b37079e1f8b5f6d03d83541ae8 -SHA256 (poppler-0.62.0.tar.xz) = 5b9a73dfd4d6f61d165ada1e4f0abd2d420494bf9d0b1c15d0db3f7b83a729c6 +RWSE3ohX2g5d/dz/5NZi6COFh1kHuX9s7Qurdp59lxcrV2x729iodmvLGIOqXFtJB/IYiWzDbqeD3IVpxXMzxefqRjEl4TvNjAs= +SHA256 (Pkgfile) = 410f44e34d56291a75849b0017d0a0fa7e939524a9759067bcb5ee43ac7ec31f +SHA256 (.footprint) = 0739c74d2dcf82d94e03937bf3827140b81b2f780667ca361e4bae0a0f6b8a3e +SHA256 (poppler-0.63.0.tar.xz) = 27cc8addafc791e1a26ce6acc2b490926ea73a4f89196dd8a7742cff7cf8a111 diff --git a/poppler/Pkgfile b/poppler/Pkgfile index 7b14966be..974765a44 100644 --- a/poppler/Pkgfile +++ b/poppler/Pkgfile @@ -4,7 +4,7 @@ # Depends on: cmake cairo lcms2 name=poppler -version=0.62.0 +version=0.63.0 release=1 source=(https://poppler.freedesktop.org/poppler-$version.tar.xz)

1 0

ports/opt (3.3): [notify] firefox: updated to 52.7.2esr. Fix for CVE-2018-5146
by crux＠crux.nu 17 Mar '18

17 Mar '18

commit d469e49ff2452863fd423042b92895f1b2ee5136 Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Sat Mar 17 05:44:32 2018 +0100 [notify] firefox: updated to 52.7.2esr. Fix for CVE-2018-5146 diff --git a/firefox/.md5sum b/firefox/.md5sum index 8ed3a9bd9..5f0661db0 100644 --- a/firefox/.md5sum +++ b/firefox/.md5sum @@ -1,3 +1,3 @@ -5e8d73d94ec686b7920c483e5d7f7816 firefox-52.7.0esr.source.tar.xz +0f1cfb1276ec3504e114e60836b80f70 firefox-52.7.2esr.source.tar.xz afe61c7760e835bd12d5dfd40af4ec84 firefox-install-dir.patch cf6971669f70b440cb6ff8df8b2722ae firefox.desktop diff --git a/firefox/.signature b/firefox/.signature index 97f67e3b0..84313841c 100644 --- a/firefox/.signature +++ b/firefox/.signature @@ -1,7 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/cFC2kfZHsH+qu0bkfgpSSKQSxcd6HS93WfWCtMI2VVBefl813PrJABNTiXz7QCjkN45tqjhkNQeHUtxPEGOhgI= -SHA256 (Pkgfile) = c63d53e9c91311917b941974109901b9fcf85a8d4d37cc2222332824f6c80162 +RWSE3ohX2g5d/b8yonhxUV65mj2usPMmv/xob0ED18KOQ6SoFm4+eJjpb2ORzsiHMCUUTD4RMjkVzs5GmL3ip+HjsYdBrLGPwQA= +SHA256 (Pkgfile) = 2650d2ff8fc02e8786377e4a3277375041894f62b20ab68c3599753502b534ee SHA256 (.footprint) = 8dfd3449f8d0a00b2ebc71e998a948728b63356ea7ab0cc10c2e2f79d1df0e07 -SHA256 (firefox-52.7.0esr.source.tar.xz) = 293c8394ed7dab1ea833c50a7b19a2fa3432e7c2f9edd891403bca12fc0fed33 +SHA256 (firefox-52.7.2esr.source.tar.xz) = 659260afe0016d0ef46862ce08035e22b38fafc536d73e5bfefd0cbd9ae6fb05 SHA256 (firefox-install-dir.patch) = 32c0102521b7296627ba457575c742746400680c3aecd18be8b1b382dccdc0ce SHA256 (firefox.desktop) = 8ba3439f3dfc5cab883641969c93d8d15f8f20d7188d9568346b2edad52d6f91 diff --git a/firefox/Pkgfile b/firefox/Pkgfile index 13da9ea50..04512e0d0 100644 --- a/firefox/Pkgfile +++ b/firefox/Pkgfile @@ -4,7 +4,7 @@ # Depends on: nss, autoconf-2.13, unzip, zip, libidl, gtk, gtk3, alsa-lib, xorg-libxt, yasm name=firefox -version=52.7.0esr +version=52.7.2esr release=1 source=(https://ftp.mozilla.org/pub/firefox/releases/$version/source/firefo… firefox-install-dir.patch firefox.desktop)

1 0