March 2018 - CRUX - lists.crux.nu

ports/opt (3.4): [notify] qpdf: upate to 8.0.2
by crux＠crux.nu 07 Mar '18

07 Mar '18

commit 8b3174a372d526daa10d7aebff72ce142b2d6565 Author: Juergen Daubert <jue(a)jue.li> Date: Wed Mar 7 19:12:52 2018 +0100 [notify] qpdf: upate to 8.0.2 ABI has been changed, rebuild of direct dependent ports required. Check with revdep. diff --git a/qpdf/.footprint b/qpdf/.footprint index d30f6beff..3b1568f83 100644 --- a/qpdf/.footprint +++ b/qpdf/.footprint @@ -18,6 +18,7 @@ drwxr-xr-x root/root usr/include/qpdf/ -rw-r--r-- root/root usr/include/qpdf/Pl_DCT.hh -rw-r--r-- root/root usr/include/qpdf/Pl_Discard.hh -rw-r--r-- root/root usr/include/qpdf/Pl_Flate.hh +-rw-r--r-- root/root usr/include/qpdf/Pl_QPDFTokenizer.hh -rw-r--r-- root/root usr/include/qpdf/Pl_RunLength.hh -rw-r--r-- root/root usr/include/qpdf/Pl_StdioFile.hh -rw-r--r-- root/root usr/include/qpdf/PointerHolder.hh @@ -37,9 +38,9 @@ drwxr-xr-x root/root usr/include/qpdf/ drwxr-xr-x root/root usr/lib/ -rw-r--r-- root/root usr/lib/libqpdf.a -rwxr-xr-x root/root usr/lib/libqpdf.la -lrwxrwxrwx root/root usr/lib/libqpdf.so -> libqpdf.so.18.2.1 -lrwxrwxrwx root/root usr/lib/libqpdf.so.18 -> libqpdf.so.18.2.1 --rwxr-xr-x root/root usr/lib/libqpdf.so.18.2.1 +lrwxrwxrwx root/root usr/lib/libqpdf.so -> libqpdf.so.21.0.2 +lrwxrwxrwx root/root usr/lib/libqpdf.so.21 -> libqpdf.so.21.0.2 +-rwxr-xr-x root/root usr/lib/libqpdf.so.21.0.2 drwxr-xr-x root/root usr/lib/pkgconfig/ -rw-r--r-- root/root usr/lib/pkgconfig/libqpdf.pc drwxr-xr-x root/root usr/share/ diff --git a/qpdf/.md5sum b/qpdf/.md5sum index 9d58071ac..c1225261a 100644 --- a/qpdf/.md5sum +++ b/qpdf/.md5sum @@ -1 +1 @@ -d6f5aab023905499aaf4b47f63387667 qpdf-7.1.1.tar.gz +74a9c61be4e899f92c1d8598cec06108 qpdf-8.0.2.tar.gz diff --git a/qpdf/.signature b/qpdf/.signature index fb4a0e2f8..82d30ffec 100644 --- a/qpdf/.signature +++ b/qpdf/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/Z1injXUiqh46ItVJUofAM9N5Lu7Vkl5zwcAuWnRnxXsTzLJgCVzYkFkKHtUeKETyciiGLWbLXoGKS/3A0liNwc= -SHA256 (Pkgfile) = f0648985ad445479de2be84ce561cdc7fb2ce525ea2347f9e6ebf71f87428ff7 -SHA256 (.footprint) = f1e22e82d78a5bb65d970eeb5a0ba348b8ef32293f30fe91ec3f8616ff332e27 -SHA256 (qpdf-7.1.1.tar.gz) = 8a0dbfa000a5c257abbc03721c7be277920fe0fcff08202b61c9c2464eedf2fa +RWSE3ohX2g5d/TVZFw3298lEDRqegeL2/Gt/t5vAA+EPthv5CvxywfV6IV3jz2Taq0YB09Pn56QmRWuNJWBLlUi1UvhQX3szDwE= +SHA256 (Pkgfile) = 1985f17d022c7927f7e13715e85d6665cdfb3ebcea9533e9e4fd0bf7e11d3737 +SHA256 (.footprint) = 07acd7462444a5e8da3078a20e77de4a19f28215d528b07f0e5448bcf4466e09 +SHA256 (qpdf-8.0.2.tar.gz) = b09e1730b515956903866619b466da359cc051ae8c9d8690d8e7a2aca493c8c1 diff --git a/qpdf/Pkgfile b/qpdf/Pkgfile index 68132ecc4..17387792a 100644 --- a/qpdf/Pkgfile +++ b/qpdf/Pkgfile @@ -4,7 +4,7 @@ # Depends on: zlib libjpeg-turbo name=qpdf -version=7.1.1 +version=8.0.2 release=1 source=(http://downloads.sourceforge.net/project/$name/$name/$version/$name…

1 0

ports/opt (3.3): [notify] qpdf: upate to 8.0.2
by crux＠crux.nu 07 Mar '18

07 Mar '18

commit 8b3174a372d526daa10d7aebff72ce142b2d6565 Author: Juergen Daubert <jue(a)jue.li> Date: Wed Mar 7 19:12:52 2018 +0100 [notify] qpdf: upate to 8.0.2 ABI has been changed, rebuild of direct dependent ports required. Check with revdep. diff --git a/qpdf/.footprint b/qpdf/.footprint index d30f6beff..3b1568f83 100644 --- a/qpdf/.footprint +++ b/qpdf/.footprint @@ -18,6 +18,7 @@ drwxr-xr-x root/root usr/include/qpdf/ -rw-r--r-- root/root usr/include/qpdf/Pl_DCT.hh -rw-r--r-- root/root usr/include/qpdf/Pl_Discard.hh -rw-r--r-- root/root usr/include/qpdf/Pl_Flate.hh +-rw-r--r-- root/root usr/include/qpdf/Pl_QPDFTokenizer.hh -rw-r--r-- root/root usr/include/qpdf/Pl_RunLength.hh -rw-r--r-- root/root usr/include/qpdf/Pl_StdioFile.hh -rw-r--r-- root/root usr/include/qpdf/PointerHolder.hh @@ -37,9 +38,9 @@ drwxr-xr-x root/root usr/include/qpdf/ drwxr-xr-x root/root usr/lib/ -rw-r--r-- root/root usr/lib/libqpdf.a -rwxr-xr-x root/root usr/lib/libqpdf.la -lrwxrwxrwx root/root usr/lib/libqpdf.so -> libqpdf.so.18.2.1 -lrwxrwxrwx root/root usr/lib/libqpdf.so.18 -> libqpdf.so.18.2.1 --rwxr-xr-x root/root usr/lib/libqpdf.so.18.2.1 +lrwxrwxrwx root/root usr/lib/libqpdf.so -> libqpdf.so.21.0.2 +lrwxrwxrwx root/root usr/lib/libqpdf.so.21 -> libqpdf.so.21.0.2 +-rwxr-xr-x root/root usr/lib/libqpdf.so.21.0.2 drwxr-xr-x root/root usr/lib/pkgconfig/ -rw-r--r-- root/root usr/lib/pkgconfig/libqpdf.pc drwxr-xr-x root/root usr/share/ diff --git a/qpdf/.md5sum b/qpdf/.md5sum index 9d58071ac..c1225261a 100644 --- a/qpdf/.md5sum +++ b/qpdf/.md5sum @@ -1 +1 @@ -d6f5aab023905499aaf4b47f63387667 qpdf-7.1.1.tar.gz +74a9c61be4e899f92c1d8598cec06108 qpdf-8.0.2.tar.gz diff --git a/qpdf/.signature b/qpdf/.signature index fb4a0e2f8..82d30ffec 100644 --- a/qpdf/.signature +++ b/qpdf/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/Z1injXUiqh46ItVJUofAM9N5Lu7Vkl5zwcAuWnRnxXsTzLJgCVzYkFkKHtUeKETyciiGLWbLXoGKS/3A0liNwc= -SHA256 (Pkgfile) = f0648985ad445479de2be84ce561cdc7fb2ce525ea2347f9e6ebf71f87428ff7 -SHA256 (.footprint) = f1e22e82d78a5bb65d970eeb5a0ba348b8ef32293f30fe91ec3f8616ff332e27 -SHA256 (qpdf-7.1.1.tar.gz) = 8a0dbfa000a5c257abbc03721c7be277920fe0fcff08202b61c9c2464eedf2fa +RWSE3ohX2g5d/TVZFw3298lEDRqegeL2/Gt/t5vAA+EPthv5CvxywfV6IV3jz2Taq0YB09Pn56QmRWuNJWBLlUi1UvhQX3szDwE= +SHA256 (Pkgfile) = 1985f17d022c7927f7e13715e85d6665cdfb3ebcea9533e9e4fd0bf7e11d3737 +SHA256 (.footprint) = 07acd7462444a5e8da3078a20e77de4a19f28215d528b07f0e5448bcf4466e09 +SHA256 (qpdf-8.0.2.tar.gz) = b09e1730b515956903866619b466da359cc051ae8c9d8690d8e7a2aca493c8c1 diff --git a/qpdf/Pkgfile b/qpdf/Pkgfile index 68132ecc4..17387792a 100644 --- a/qpdf/Pkgfile +++ b/qpdf/Pkgfile @@ -4,7 +4,7 @@ # Depends on: zlib libjpeg-turbo name=qpdf -version=7.1.1 +version=8.0.2 release=1 source=(http://downloads.sourceforge.net/project/$name/$name/$version/$name…

1 0

ports/opt (3.3): [notify] jscon-c: update to 0.13.1
by crux＠crux.nu 07 Mar '18

07 Mar '18

commit e522fe5530b2d4766ab4d18f906f542a71cec3d7 Author: Juergen Daubert <jue(a)jue.li> Date: Wed Mar 7 12:21:11 2018 +0100 [notify] jscon-c: update to 0.13.1 ABI has been changed, rebuild of direct dependent ports required. Check with revdep. diff --git a/json-c/.footprint b/json-c/.footprint index b6eba3bcd..ba42b07f1 100644 --- a/json-c/.footprint +++ b/json-c/.footprint @@ -19,8 +19,8 @@ drwxr-xr-x root/root usr/include/json-c/ drwxr-xr-x root/root usr/lib/ -rw-r--r-- root/root usr/lib/libjson-c.a -rwxr-xr-x root/root usr/lib/libjson-c.la -lrwxrwxrwx root/root usr/lib/libjson-c.so -> libjson-c.so.3.0.1 -lrwxrwxrwx root/root usr/lib/libjson-c.so.3 -> libjson-c.so.3.0.1 --rwxr-xr-x root/root usr/lib/libjson-c.so.3.0.1 +lrwxrwxrwx root/root usr/lib/libjson-c.so -> libjson-c.so.4.0.0 +lrwxrwxrwx root/root usr/lib/libjson-c.so.4 -> libjson-c.so.4.0.0 +-rwxr-xr-x root/root usr/lib/libjson-c.so.4.0.0 drwxr-xr-x root/root usr/lib/pkgconfig/ -rw-r--r-- root/root usr/lib/pkgconfig/json-c.pc diff --git a/json-c/.md5sum b/json-c/.md5sum index 510532872..cbe27d281 100644 --- a/json-c/.md5sum +++ b/json-c/.md5sum @@ -1 +1 @@ -11fc5d90c77375e5fc8401e8b9efbf21 json-c-0.13.tar.gz +04969ad59cc37bddd83741a08b98f350 json-c-0.13.1.tar.gz diff --git a/json-c/.signature b/json-c/.signature index 20f5dcca1..72000f845 100644 --- a/json-c/.signature +++ b/json-c/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/bsj+i0kdzi+tu9kMtnZYEVibDajZDk6fg9rSg91/zza9TCnVW5NDNMULq9wM/GoYzQ19mpnlBbNff/yAhYl1gQ= -SHA256 (Pkgfile) = 9e715a9f0ed8745d393d4b0ab04c12adde6abc7dd6034f7de1a336f8f0766a1f -SHA256 (.footprint) = ebaab5998f8acd72b588424f8def0b70ea22837add42c687d13bc39140633e28 -SHA256 (json-c-0.13.tar.gz) = 0316780be9ad16c42d7c26b015a784fd5df4b0909fef0aba51cfb13e492ac24d +RWSE3ohX2g5d/XF9S27SBnQ2YHIa1Q4SxQ1m/bEIDb0W3Niun4e96tbc43lgYr8tmypcZ/4V55uhV6MPpk28G9dS4YwrfAQEyAk= +SHA256 (Pkgfile) = ab8ddf9bac77dc3aa29834617d4262ab1f44c91fbd27926b8043190a9f7ff2e4 +SHA256 (.footprint) = 5f6ef28f05475ff602ee92b592378c460a60a5b4df6725a8ac1ab18ab29a4283 +SHA256 (json-c-0.13.1.tar.gz) = b87e608d4d3f7bfdd36ef78d56d53c74e66ab278d318b71e6002a369d36f4873 diff --git a/json-c/Pkgfile b/json-c/Pkgfile index 58b268556..08e34d3cd 100644 --- a/json-c/Pkgfile +++ b/json-c/Pkgfile @@ -3,7 +3,7 @@ # Maintainer: Juergen Daubert, jue at crux dot nu name=json-c -version=0.13 +version=0.13.1 release=1 source=(https://s3.amazonaws.com/json-c_releases/releases/$name-$version.ta…

1 0

ports/opt (3.3): [notify] libvorbis: security fixes for: CVE-2017-14160, CVE-2017-14632, and CVE-2017-14633 closes FS#1595
by crux＠crux.nu 06 Mar '18

06 Mar '18

commit f0344af4ee764125b3c263d74fd866fcc0610dec Author: Danny Rawlins <monster.romster(a)gmail.com> Date: Wed Mar 7 01:15:29 2018 +1100 [notify] libvorbis: security fixes for: CVE-2017-14160, CVE-2017-14632, and CVE-2017-14633 closes FS#1595 diff --git a/libvorbis/.md5sum b/libvorbis/.md5sum index e3dcf5477..8bbbeef92 100644 --- a/libvorbis/.md5sum +++ b/libvorbis/.md5sum @@ -1 +1,4 @@ +943275d84d55dfa072ec3a2566fd9bfa CVE-2017-14160.patch +d32bb2a15cde558464ff6b1a7199d9c6 CVE-2017-14632.patch +d54deff7374d7205441cf5e4dfd32bee CVE-2017-14633.patch 28cb28097c07a735d6af56e598e1c90f libvorbis-1.3.5.tar.xz diff --git a/libvorbis/.signature b/libvorbis/.signature index e0f6c770a..15a02858a 100644 --- a/libvorbis/.signature +++ b/libvorbis/.signature @@ -1,5 +1,8 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/UIMCRs21S+z38O3cqsSsk5E910XdPfJ54oGNA8VPRaNuGeoJTyDTksoe26yejpyCVC/SSXubHVGihLKojs03AE= -SHA256 (Pkgfile) = 493517cd1f5498d39bff632f5becea6dd7ecb18455d73313d6de32c527cc83b0 +RWSE3ohX2g5d/XBLjepyAeVAsv0mpvzium7JjPBpyQUlW+ZuPdO7oz0ATE3bC1nBn5EHSwuxsNGum4EOVduL32Cr08X2/7IVtwk= +SHA256 (Pkgfile) = 833e8c8db431ef3375b53fa800a7d06a33a9b6e62913ff5ec6c8dd5d8c1b51ad SHA256 (.footprint) = 709e3fdd589a25de7fa9ca41700639d37f7dae5eba48fe6cffa354efd8625b37 SHA256 (libvorbis-1.3.5.tar.xz) = 54f94a9527ff0a88477be0a71c0bab09a4c3febe0ed878b24824906cd4b0e1d1 +SHA256 (CVE-2017-14633.patch) = d1a44c7a683b3d1ab2bd645ef4ee21002cb1c7466975073381ed1e533153e328 +SHA256 (CVE-2017-14632.patch) = 2fed965880686a145c0da6abbb08224d0ed26e4bf1b1c3a8f7b5d2d33f6bc8e7 +SHA256 (CVE-2017-14160.patch) = f93bf45de3a21db0fa9bb9cd25edefb1182bf24d61028a86cbf45fbcd11fbdf5 diff --git a/libvorbis/CVE-2017-14160.patch b/libvorbis/CVE-2017-14160.patch new file mode 100644 index 000000000..9ad9d18f7 --- /dev/null +++ b/libvorbis/CVE-2017-14160.patch @@ -0,0 +1,58 @@ +From 98a60969315dba8c1e8231f561e1551670bc80ae Mon Sep 17 00:00:00 2001 +Message-Id: <98a60969315dba8c1e8231f561e1551670bc80ae.1511192857.git.agx(a)sigxcpu.org> +From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx(a)sigxcpu.org> +Date: Wed, 15 Nov 2017 13:12:00 +0100 +Subject: [PATCH] CVE-2017-14160: make sure we don't overflow + +--- + lib/psy.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/lib/psy.c b/lib/psy.c +index 422c6f1e..8bbf6cf3 100644 +--- a/lib/psy.c ++++ b/lib/psy.c +@@ -599,7 +599,7 @@ static void bark_noise_hybridmp(int n,const long *b, + XY[i] = tXY; + } + +- for (i = 0, x = 0.f;; i++, x += 1.f) { ++ for (i = 0, x = 0.f; i < n; i++, x += 1.f) { + + lo = b[i] >> 16; + if( lo>=0 ) break; +@@ -621,12 +621,11 @@ static void bark_noise_hybridmp(int n,const long *b, + noise[i] = R - offset; + } + +- for ( ;; i++, x += 1.f) { ++ for ( ; i < n; i++, x += 1.f) { + + lo = b[i] >> 16; + hi = b[i] & 0xffff; + if(hi>=n)break; +- + tN = N[hi] - N[lo]; + tX = X[hi] - X[lo]; + tXX = XX[hi] - XX[lo]; +@@ -651,7 +650,7 @@ static void bark_noise_hybridmp(int n,const long *b, + + if (fixed <= 0) return; + +- for (i = 0, x = 0.f;; i++, x += 1.f) { ++ for (i = 0, x = 0.f; i < n; i++, x += 1.f) { + hi = i + fixed / 2; + lo = hi - fixed; + if(lo>=0)break; +@@ -670,7 +669,7 @@ static void bark_noise_hybridmp(int n,const long *b, + + if (R - offset < noise[i]) noise[i] = R - offset; + } +- for ( ;; i++, x += 1.f) { ++ for ( ; i < n; i++, x += 1.f) { + + hi = i + fixed / 2; + lo = hi - fixed; +-- +2.15.0 + diff --git a/libvorbis/CVE-2017-14632.patch b/libvorbis/CVE-2017-14632.patch new file mode 100644 index 000000000..9ff5a8ca1 --- /dev/null +++ b/libvorbis/CVE-2017-14632.patch @@ -0,0 +1,51 @@ +From c1c2831fc7306d5fbd7bc800324efd12b28d327f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx(a)sigxcpu.org> +Date: Wed, 15 Nov 2017 18:22:59 +0100 +Subject: [PATCH] CVE-2017-14632: vorbis_analysis_header_out: Don't clear opb + if not initialized + +If the number of channels is not within the allowed range +we call oggback_writeclear altough it's not initialized yet. + +This fixes + + =23371== Invalid free() / delete / delete[] / realloc() + ==23371== at 0x4C2CE1B: free (vg_replace_malloc.c:530) + ==23371== by 0x829CA31: oggpack_writeclear (in /usr/lib/x86_64-linux-gnu/libogg.so.0.8.2) + ==23371== by 0x84B96EE: vorbis_analysis_headerout (info.c:652) + ==23371== by 0x9FBCBCC: ??? (in /usr/lib/x86_64-linux-gnu/sox/libsox_fmt_vorbis.so) + ==23371== by 0x4E524F1: ??? (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) + ==23371== by 0x4E52CCA: sox_open_write (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) + ==23371== by 0x10D82A: open_output_file (sox.c:1556) + ==23371== by 0x10D82A: process (sox.c:1753) + ==23371== by 0x10D82A: main (sox.c:3012) + ==23371== Address 0x68768c8 is 488 bytes inside a block of size 880 alloc'd + ==23371== at 0x4C2BB1F: malloc (vg_replace_malloc.c:298) + ==23371== by 0x4C2DE9F: realloc (vg_replace_malloc.c:785) + ==23371== by 0x4E545C2: lsx_realloc (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) + ==23371== by 0x9FBC9A0: ??? (in /usr/lib/x86_64-linux-gnu/sox/libsox_fmt_vorbis.so) + ==23371== by 0x4E524F1: ??? (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) + ==23371== by 0x4E52CCA: sox_open_write (in /usr/lib/x86_64-linux-gnu/libsox.so.2.0.1) + ==23371== by 0x10D82A: open_output_file (sox.c:1556) + ==23371== by 0x10D82A: process (sox.c:1753) + ==23371== by 0x10D82A: main (sox.c:3012) + +as seen when using the testcase from CVE-2017-11333 with +008d23b782be09c8d75ba8190b1794abd66c7121 applied. However the error was +there before. +--- + lib/info.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/info.c b/lib/info.c +index 7bc4ea42..8d0b2edd 100644 +--- a/lib/info.c ++++ b/lib/info.c +@@ -589,6 +589,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v, + private_state *b=v->backend_state; + + if(!b||vi->channels<=0||vi->channels>256){ ++ b = NULL; + ret=OV_EFAULT; + goto err_out; + } diff --git a/libvorbis/CVE-2017-14633.patch b/libvorbis/CVE-2017-14633.patch new file mode 100644 index 000000000..069927c7b --- /dev/null +++ b/libvorbis/CVE-2017-14633.patch @@ -0,0 +1,31 @@ +From a79ec216cd119069c68b8f3542c6a425a74ab993 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx(a)sigxcpu.org> +Date: Tue, 31 Oct 2017 18:32:46 +0100 +Subject: [PATCH] CVE-2017-14633: Don't allow for more than 256 channels + +Otherwise + + for(i=0;i<vi->channels;i++){ + /* the encoder setup assumes that all the modes used by any + specific bitrate tweaking use the same floor */ + int submap=info->chmuxlist[i]; + +overreads later in mapping0_forward since chmuxlist is a fixed array of +256 elements max. +--- + lib/info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/info.c b/lib/info.c +index fe759edf..7bc4ea42 100644 +--- a/lib/info.c ++++ b/lib/info.c +@@ -588,7 +588,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v, + oggpack_buffer opb; + private_state *b=v->backend_state; + +- if(!b||vi->channels<=0){ ++ if(!b||vi->channels<=0||vi->channels>256){ + ret=OV_EFAULT; + goto err_out; + } diff --git a/libvorbis/Pkgfile b/libvorbis/Pkgfile index 6036da968..6461bb154 100644 --- a/libvorbis/Pkgfile +++ b/libvorbis/Pkgfile @@ -1,21 +1,28 @@ # Description: Vorbis codec library -# URL: http://www.xiph.org/ogg/vorbis/ -# Maintainer: Jose V Beneyto, sepen at crux dot nu -# Packager: Tilman Sauerbeck, tilman at crux dot nu +# URL: https://www.xiph.org/ogg/vorbis/ +# Maintainer: Danny Rawlins, crux at romster dot me # Depends on: libogg name=libvorbis version=1.3.5 -release=1 -source=(http://downloads.xiph.org/releases/vorbis/$name-$version.tar.xz) +release=2 +source=(https://downloads.xiph.org/releases/vorbis/$name-$version.tar.xz + CVE-2017-14633.patch + CVE-2017-14632.patch + CVE-2017-14160.patch) build() { - cd $name-$version + cd $name-$version - ./configure --prefix=/usr + # https://security-tracker.debian.org/tracker/source-package/libvorbis + patch -p1 -i $SRC/CVE-2017-14633.patch + patch -p1 -i $SRC/CVE-2017-14632.patch + patch -p1 -i $SRC/CVE-2017-14160.patch - make - make DESTDIR=$PKG install + ./configure --prefix=/usr - rm -rf $PKG/usr/share/doc + make + make DESTDIR=$PKG install + + rm -rf $PKG/usr/share/doc }

1 0

ports/compat-32 (3.3): [notify] xorg-libxcb-32: 1.12 -> 1.13 new dependency libinput-32
by crux＠crux.nu 06 Mar '18

06 Mar '18

commit 6619f1c3e6e26412189a63a27820042939ada8ad Author: Danny Rawlins <monster.romster(a)gmail.com> Date: Tue Mar 6 23:49:21 2018 +1100 [notify] xorg-libxcb-32: 1.12 -> 1.13 new dependency libinput-32 diff --git a/xorg-libxcb-32/.footprint b/xorg-libxcb-32/.footprint index e9905d2..11dd0d5 100644 --- a/xorg-libxcb-32/.footprint +++ b/xorg-libxcb-32/.footprint @@ -90,6 +90,11 @@ lrwxrwxrwx root/root usr/lib32/libxcb-xfixes.so.0 -> libxcb-xfixes.so.0.0.0 lrwxrwxrwx root/root usr/lib32/libxcb-xinerama.so -> libxcb-xinerama.so.0.0.0 lrwxrwxrwx root/root usr/lib32/libxcb-xinerama.so.0 -> libxcb-xinerama.so.0.0.0 -rwxr-xr-x root/root usr/lib32/libxcb-xinerama.so.0.0.0 +-rw-r--r-- root/root usr/lib32/libxcb-xinput.a +-rwxr-xr-x root/root usr/lib32/libxcb-xinput.la +lrwxrwxrwx root/root usr/lib32/libxcb-xinput.so -> libxcb-xinput.so.0.1.0 +lrwxrwxrwx root/root usr/lib32/libxcb-xinput.so.0 -> libxcb-xinput.so.0.1.0 +-rwxr-xr-x root/root usr/lib32/libxcb-xinput.so.0.1.0 -rw-r--r-- root/root usr/lib32/libxcb-xkb.a -rwxr-xr-x root/root usr/lib32/libxcb-xkb.la lrwxrwxrwx root/root usr/lib32/libxcb-xkb.so -> libxcb-xkb.so.1.0.0 @@ -134,6 +139,7 @@ drwxr-xr-x root/root usr/lib32/pkgconfig/ -rw-r--r-- root/root usr/lib32/pkgconfig/xcb-xf86dri.pc -rw-r--r-- root/root usr/lib32/pkgconfig/xcb-xfixes.pc -rw-r--r-- root/root usr/lib32/pkgconfig/xcb-xinerama.pc +-rw-r--r-- root/root usr/lib32/pkgconfig/xcb-xinput.pc -rw-r--r-- root/root usr/lib32/pkgconfig/xcb-xkb.pc -rw-r--r-- root/root usr/lib32/pkgconfig/xcb-xtest.pc -rw-r--r-- root/root usr/lib32/pkgconfig/xcb-xv.pc diff --git a/xorg-libxcb-32/.md5sum b/xorg-libxcb-32/.md5sum index 3030981..424e2eb 100644 --- a/xorg-libxcb-32/.md5sum +++ b/xorg-libxcb-32/.md5sum @@ -1 +1 @@ -28e552bd78bc1050b6b26ca1db0e5bb6 libxcb-1.12.tar.bz2 +c2b6cf928afa16b0047c974e7aaa783f libxcb-1.13.tar.bz2 diff --git a/xorg-libxcb-32/.signature b/xorg-libxcb-32/.signature index 2245761..f99b02b 100644 --- a/xorg-libxcb-32/.signature +++ b/xorg-libxcb-32/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/compat-32.pub -RWSwxGo/zH7eXbMcGNWyUC9V+1XsJIoxRHK3bMULEvfvQBuiiv1yzdzsNFrQ4O2H9sRu/Gi7rnSvnSyVB6hqwFkIpd+yTCNpnAk= -SHA256 (Pkgfile) = 19743344c78eee388773ea4f2a61b3c6518c2553e62ec91fc8aa0b1538f9d33e -SHA256 (.footprint) = feef86813c3c049a3b230ecd4b5bffe4287d4c00f0bb2a1f76c032f1f3074487 -SHA256 (libxcb-1.12.tar.bz2) = 4adfb1b7c67e99bc9c2ccb110b2f175686576d2f792c8a71b9c8b19014057b5b +RWSwxGo/zH7eXUir6VF9IOFLbDOWD+GVm9jIgoVkoaMBkjyKIkOFFzrino8leDRkcij7FO2x/34aHp9hEofjkklqH/7W4/R0Vg0= +SHA256 (Pkgfile) = 1e4a99f4db0e11063c597a1c7e9983da20d42c7daa9ef076f5edf31d2bb0b1d0 +SHA256 (.footprint) = 4963f8450d364caef9345fd27a74ca200a9b5aa6733746444b95da82ab322c85 +SHA256 (libxcb-1.13.tar.bz2) = 188c8752193c50ff2dbe89db4554c63df2e26a2e47b0fa415a70918b5b851daa diff --git a/xorg-libxcb-32/Pkgfile b/xorg-libxcb-32/Pkgfile index 4dceacc..772a844 100644 --- a/xorg-libxcb-32/Pkgfile +++ b/xorg-libxcb-32/Pkgfile @@ -1,17 +1,19 @@ # Description: X11 client-side library # URL: http://xcb.freedesktop.org # Maintainer: CRUX compat-32 Team, compat-32-ports at crux dot nu -# Depends on: xorg-xcb-proto-32 xorg-libxdmcp-32 xorg-libxau-32 libxslt-32 libpthread-stubs-32 xorg-libxcb +# Depends on: xorg-xcb-proto-32 xorg-libxdmcp-32 xorg-libxau-32 libxslt-32 libpthread-stubs-32 libinput-32 xorg-libxcb name=xorg-libxcb-32 -version=1.12 +version=1.13 release=1 source=(https://www.x.org/releases/individual/xcb/libxcb-$version.tar.bz2) build() { cd libxcb-$version - ./configure --prefix=/usr --libdir=/usr/lib32 + ./configure \ + --prefix=/usr \ + --libdir=/usr/lib32 make make DESTDIR=$PKG install

1 0

ports/compat-32 (3.3): [notify] libinput-32: initial import for xorg-libxcb-32
by crux＠crux.nu 06 Mar '18

06 Mar '18

commit f6a6c2841e703b60902819c5b24ce39e565bde82 Author: Danny Rawlins <monster.romster(a)gmail.com> Date: Tue Mar 6 23:47:18 2018 +1100 [notify] libinput-32: initial import for xorg-libxcb-32 diff --git a/libinput-32/.32bit b/libinput-32/.32bit new file mode 100644 index 0000000..e69de29 diff --git a/libinput-32/.footprint b/libinput-32/.footprint new file mode 100644 index 0000000..bcff023 --- /dev/null +++ b/libinput-32/.footprint @@ -0,0 +1,7 @@ +drwxr-xr-x root/root usr/ +drwxr-xr-x root/root usr/lib32/ +lrwxrwxrwx root/root usr/lib32/libinput.so -> libinput.so.10 +lrwxrwxrwx root/root usr/lib32/libinput.so.10 -> libinput.so.10.13.0 +-rwxr-xr-x root/root usr/lib32/libinput.so.10.13.0 +drwxr-xr-x root/root usr/lib32/pkgconfig/ +-rw-r--r-- root/root usr/lib32/pkgconfig/libinput.pc diff --git a/libinput-32/.md5sum b/libinput-32/.md5sum new file mode 100644 index 0000000..6a72bef --- /dev/null +++ b/libinput-32/.md5sum @@ -0,0 +1 @@ +b3d009f36691cb9c340a18109df837ef libinput-1.10.1.tar.xz diff --git a/libinput-32/.signature b/libinput-32/.signature new file mode 100644 index 0000000..eb19049 --- /dev/null +++ b/libinput-32/.signature @@ -0,0 +1,5 @@ +untrusted comment: verify with /etc/ports/compat-32.pub +RWSwxGo/zH7eXdPIGPPprC/ZJNHGIQiuhE1F52TCiuHncBIA6jtr7H/gt0L7YEfIMSaEHm1OMe2rdwIWMOZN0WVc+tYU2PlHJww= +SHA256 (Pkgfile) = 593df15657dcf6bf907277a036ba435bd4d6e031ff57d1b1afc62b3cc6dc9b3f +SHA256 (.footprint) = 443a1d2ce220ec5895c13c4d95bf28f36f2ab95bbd7b4ae2adaede2db4d66670 +SHA256 (libinput-1.10.1.tar.xz) = 877522d76575e1945c7b3a9eb92cab90d5ad0379c4ef0dbe13054e489d4c6665 diff --git a/libinput-32/Pkgfile b/libinput-32/Pkgfile new file mode 100644 index 0000000..4182bb9 --- /dev/null +++ b/libinput-32/Pkgfile @@ -0,0 +1,33 @@ +# Description: A library that handles input devices for display servers +# URL: http://wayland.freedesktop.org/libinput/doc/latest/index.html +# Maintainer: CRUX compat-32 Team, compat-32-ports at crux dot nu +# Depends on: mtdev-32 eudev-32 xorg-libevdev-32 libinput + +name=libinput-32 +version=1.10.1 +release=1 +source=(https://www.freedesktop.org/software/${name%-*}/${name%-*}-$version.tar.xz) + +build() { + cd ${name%-*}-$version + + meson build \ + --prefix /usr \ + --libdir=/usr/lib32 \ + --libexecdir /usr/lib32 \ + --buildtype release \ + -Ddebug-gui=false \ + -Ddocumentation=false \ + -Dtests=false \ + -Dlibwacom=false \ + -Dudev-dir=/lib/udev + + DESTDIR=$PKG ninja -C build -j ${JOBS:-1} install + + install -d $PKG/etc/udev + mv $PKG/lib/udev/hwdb.d $PKG/etc/udev + + chmod -R g-w $PKG + + rm -r $PKG/{etc,lib} $PKG/usr/{bin,include,lib32/libinput,share} +}

1 0

ports/compat-32 (3.3): [notify] xorg-libevdev-32: initial import for libinput-32
by crux＠crux.nu 06 Mar '18

06 Mar '18

commit 4e913735b74fc2b82c3f50e05577796fe346f8da Author: Danny Rawlins <monster.romster(a)gmail.com> Date: Tue Mar 6 23:45:09 2018 +1100 [notify] xorg-libevdev-32: initial import for libinput-32 diff --git a/xorg-libevdev-32/.32bit b/xorg-libevdev-32/.32bit new file mode 100644 index 0000000..e69de29 diff --git a/xorg-libevdev-32/.footprint b/xorg-libevdev-32/.footprint new file mode 100644 index 0000000..4fac873 --- /dev/null +++ b/xorg-libevdev-32/.footprint @@ -0,0 +1,9 @@ +drwxr-xr-x root/root usr/ +drwxr-xr-x root/root usr/lib32/ +-rw-r--r-- root/root usr/lib32/libevdev.a +-rwxr-xr-x root/root usr/lib32/libevdev.la +lrwxrwxrwx root/root usr/lib32/libevdev.so -> libevdev.so.2.1.19 +lrwxrwxrwx root/root usr/lib32/libevdev.so.2 -> libevdev.so.2.1.19 +-rwxr-xr-x root/root usr/lib32/libevdev.so.2.1.19 +drwxr-xr-x root/root usr/lib32/pkgconfig/ +-rw-r--r-- root/root usr/lib32/pkgconfig/libevdev.pc diff --git a/xorg-libevdev-32/.md5sum b/xorg-libevdev-32/.md5sum new file mode 100644 index 0000000..d777768 --- /dev/null +++ b/xorg-libevdev-32/.md5sum @@ -0,0 +1 @@ +4f1cfaee8d75ea3fbbfeb99a98730952 libevdev-1.5.7.tar.xz diff --git a/xorg-libevdev-32/.signature b/xorg-libevdev-32/.signature new file mode 100644 index 0000000..803ed88 --- /dev/null +++ b/xorg-libevdev-32/.signature @@ -0,0 +1,5 @@ +untrusted comment: verify with /etc/ports/compat-32.pub +RWSwxGo/zH7eXculTngPgjHyauyNf320ZtXuJWazfnl66ffNaZXRCaBEuRM0c1mTZGDeKuNgiqyKWwgfFGGaZ1a/rX6m85go9g0= +SHA256 (Pkgfile) = 6c6887646bae33db3660c2f0c976ae56afe60e732cd52a368be3b7e8e2b80737 +SHA256 (.footprint) = d5bd715bc3bc2905b31775d88cff69279ea36cbf2f7eb0cd11076fe3bc40cac2 +SHA256 (libevdev-1.5.7.tar.xz) = a1e59e37a2f0d397ffd7e83b73af0e638db83b8dd08902ef0f651a21cc1dd422 diff --git a/xorg-libevdev-32/Pkgfile b/xorg-libevdev-32/Pkgfile new file mode 100644 index 0000000..6b8b10f --- /dev/null +++ b/xorg-libevdev-32/Pkgfile @@ -0,0 +1,22 @@ +# Description: Wrapper library for evdev devices +# URL: http://xorg.freedesktop.org +# Maintainer: CRUX compat-32 Team, compat-32-ports at crux dot nu +# Depends on: python-32 xorg-libevdev + +name=xorg-libevdev-32 +version=1.5.7 +release=2 +source=(https://www.freedesktop.org/software/libevdev/libevdev-$version.tar.xz) + +build() { + cd libevdev-$version + + ./configure \ + --prefix=/usr \ + --libdir=/usr/lib32 + + make + make DESTDIR=$PKG install + + rm -r $PKG/usr/{bin,include,share} +}

1 0

ports/compat-32 (3.3): [notify] mtdev-32: initial import for libinput-32
by crux＠crux.nu 06 Mar '18

06 Mar '18

commit acb949f2b78e78dc86810ef7a57e3fdcf62214ba Author: Danny Rawlins <monster.romster(a)gmail.com> Date: Tue Mar 6 23:44:04 2018 +1100 [notify] mtdev-32: initial import for libinput-32 diff --git a/mtdev-32/.32bit b/mtdev-32/.32bit new file mode 100644 index 0000000..e69de29 diff --git a/mtdev-32/.footprint b/mtdev-32/.footprint new file mode 100644 index 0000000..311f126 --- /dev/null +++ b/mtdev-32/.footprint @@ -0,0 +1,9 @@ +drwxr-xr-x root/root usr/ +drwxr-xr-x root/root usr/lib32/ +-rw-r--r-- root/root usr/lib32/libmtdev.a +-rwxr-xr-x root/root usr/lib32/libmtdev.la +lrwxrwxrwx root/root usr/lib32/libmtdev.so -> libmtdev.so.1.0.0 +lrwxrwxrwx root/root usr/lib32/libmtdev.so.1 -> libmtdev.so.1.0.0 +-rwxr-xr-x root/root usr/lib32/libmtdev.so.1.0.0 +drwxr-xr-x root/root usr/lib32/pkgconfig/ +-rw-r--r-- root/root usr/lib32/pkgconfig/mtdev.pc diff --git a/mtdev-32/.md5sum b/mtdev-32/.md5sum new file mode 100644 index 0000000..02367df --- /dev/null +++ b/mtdev-32/.md5sum @@ -0,0 +1 @@ +7fdbc6d16cf6fcc2c5c4537f84141cf8 mtdev-1.1.5.tar.gz diff --git a/mtdev-32/.signature b/mtdev-32/.signature new file mode 100644 index 0000000..64764cd --- /dev/null +++ b/mtdev-32/.signature @@ -0,0 +1,5 @@ +untrusted comment: verify with /etc/ports/compat-32.pub +RWSwxGo/zH7eXcjI77ex9WHeNyw+XF5BbEi3mE4qyA3QHYzxcff4wPAk0dw19brlC2Xhp8zEM3cEGZFZ1YNT2XfL7w5kj/fxpQI= +SHA256 (Pkgfile) = 0a3008dcc0ce8f23cdf4b35b6bb6b85a9533fdf3f22111a3a78908ba9520a25d +SHA256 (.footprint) = f4bd905d88fb0eb14fafd80145c3229f038cf06a618968c168aa99598be897ec +SHA256 (mtdev-1.1.5.tar.gz) = a662924dd09cf538c8df66514da345e40c3cbfa880cc7262bc3b55ee46d0c1f4 diff --git a/mtdev-32/Pkgfile b/mtdev-32/Pkgfile new file mode 100644 index 0000000..c86bbbb --- /dev/null +++ b/mtdev-32/Pkgfile @@ -0,0 +1,22 @@ +# Description: Kernel multi-touch transformation library +# URL: http://launchpad.net/mtdev +# Maintainer: CRUX compat-32 Team, compat-32-ports at crux dot nu +# Depends on: mtdev + +name=mtdev-32 +version=1.1.5 +release=1 +source=(https://launchpad.net/${name%-*}/trunk/$version/+download/${name%-*}-$version.tar.gz) + +build() { + cd ${name%-*}-$version + + ./configure \ + --prefix=/usr \ + --libdir=/usr/lib32 + + make + make DESTDIR=$PKG install + + rm -r $PKG/usr/{bin,include} +}

1 0

ports/opt (3.4): [notify] php: security update to 5.6.34
by crux＠crux.nu 06 Mar '18

06 Mar '18

commit 2dfb8df07ecccf4a47af9d884ba583dcc48ffaf1 Author: Juergen Daubert <jue(a)jue.li> Date: Mon Mar 5 15:20:32 2018 +0100 [notify] php: security update to 5.6.34 diff --git a/mod_php/.md5sum b/mod_php/.md5sum index 8d427149c..d32c77dff 100644 --- a/mod_php/.md5sum +++ b/mod_php/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/mod_php/.signature b/mod_php/.signature index 01f050ad3..4baec7126 100644 --- a/mod_php/.signature +++ b/mod_php/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/ZPUFkc0JovTFgUyElWzXGwKi0lQElC+jkDkeBfq5WYRRAdsJVkNnVz4GM1R7Pui4h+oqZC+aidGZuIZe9HVwQ4= -SHA256 (Pkgfile) = 290189806d4473289b17c9ba0600e720e91830d9ab5f119e7785cd53143c355a +RWSE3ohX2g5d/e/7OsX72z1nsjWX/jn0SIbyQ5d6E1FCoTymxzjL29ZFlyrIxqIJCsGkG17kojtJmhnbWXBgpUCfWeOOy+Wa4QQ= +SHA256 (Pkgfile) = c9ee6da496d89e0122623614463a5d303a95b4917665c8728aa4b59a8049ce6d SHA256 (.footprint) = c964ecc21b4b699f0bd50a1ce6c2ef4dbd57291b2c11a0b2eab93ae056f2a1e4 -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/mod_php/Pkgfile b/mod_php/Pkgfile index a82564afc..66cba3460 100644 --- a/mod_php/Pkgfile +++ b/mod_php/Pkgfile @@ -4,7 +4,7 @@ # Depends on: apache name=mod_php -version=5.6.33 +version=5.6.34 release=1 source=(http://php.net/distributions/php-$version.tar.xz) diff --git a/php-fcgi/.md5sum b/php-fcgi/.md5sum index 4d242ae92..44c5fbbe3 100644 --- a/php-fcgi/.md5sum +++ b/php-fcgi/.md5sum @@ -1,2 +1,2 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz cdaab91680ba17cbf31b21d1b64dcd6a php-fcgi diff --git a/php-fcgi/.signature b/php-fcgi/.signature index a03707a52..feeb8b12c 100644 --- a/php-fcgi/.signature +++ b/php-fcgi/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/R0IRzv804VFk1rFNmBYrbT4tnAq6T6RUWoLfAXiY+ROZaI8DyNPqjV7R2Vd+smgY8Hm/BIftSPWq5Y76kQXlQs= -SHA256 (Pkgfile) = de17e473f3d95f79a81d64307cfd51cc2bd6b83c64f14a73cf3be5c4688ef609 +RWSE3ohX2g5d/a1ImUBSO3Dq2SfMQl+Om51jfxSp6LuR77xW9o+krfTTp4it2tN1g+4W3w5Nly2qYWp2vrdKTK5+tRWVApZWfwc= +SHA256 (Pkgfile) = 2930337d8e38f8870be446d91b204360d6feb635bfd1353c1594c85b4c02e46e SHA256 (.footprint) = 073d817f449e60b58f4c904bd4ef54ddad9bd0ab946ee178956622bf76d5501b -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 SHA256 (php-fcgi) = 058feaf2d8ad8ed61a4191512eb2151b8ed87fd92ce469ee8bab1812c0cb6471 diff --git a/php-fcgi/Pkgfile b/php-fcgi/Pkgfile index f1f9a745a..e772947f1 100644 --- a/php-fcgi/Pkgfile +++ b/php-fcgi/Pkgfile @@ -4,7 +4,7 @@ # Depends on: libpcre libxml2 name=php-fcgi -version=5.6.33 +version=5.6.34 release=1 source=(http://php.net/distributions/php-$version.tar.xz php-fcgi) diff --git a/php-fpm/.md5sum b/php-fpm/.md5sum index 43b08f8a5..39a41dec2 100644 --- a/php-fpm/.md5sum +++ b/php-fpm/.md5sum @@ -1,2 +1,2 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz 954d95b7f645f3435815195aeeac6949 php-fpm diff --git a/php-fpm/.signature b/php-fpm/.signature index cf7d5af71..d361b919d 100644 --- a/php-fpm/.signature +++ b/php-fpm/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/a7mSyCDimIACyc3/TpySuPP4ZcnYf5+FJYL+KYwEC/WXcIDf0Kg3hJjlma2tHKzJpIjJ77q+OwVvIW/KWgY7AA= -SHA256 (Pkgfile) = 4af9db42e3a50e57ecb1bbf4b7bd8429225b78d228e5b51c12d0690894d45b28 +RWSE3ohX2g5d/ZjUw5lG0Z7cRPMegDdAIyE3Lnzuv8OcgOAyQsYCKN/AlNzPapMyY7XdsRr4xHF0A9PhIMYU4z7elpH0lQnq2A4= +SHA256 (Pkgfile) = 8166eee043ac3a8a3be435d791a9e0fcaaafb71c082f5e63aa8a6e2eedac8f0e SHA256 (.footprint) = 5b8ceed2150bdbf3d6cc01b0ef712a5c917367f58dd3181377af29ad11283be4 -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 SHA256 (php-fpm) = a1fde2295e819a33d492cfdeca8d4e0e8de08b8d051c95c4758ba01da38354b7 diff --git a/php-fpm/Pkgfile b/php-fpm/Pkgfile index 2a2851402..3c4783dfa 100644 --- a/php-fpm/Pkgfile +++ b/php-fpm/Pkgfile @@ -4,7 +4,7 @@ # Depends on: libpcre libxml2 name=php-fpm -version=5.6.33 +version=5.6.34 release=1 source=(http://php.net/distributions/php-$version.tar.xz php-fpm) diff --git a/php-ftp/.md5sum b/php-ftp/.md5sum index 8d427149c..d32c77dff 100644 --- a/php-ftp/.md5sum +++ b/php-ftp/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/php-ftp/.signature b/php-ftp/.signature index a56eea8d0..a31705858 100644 --- a/php-ftp/.signature +++ b/php-ftp/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/TDgMU/aRJVxgJGZqz0ldntgI+i7u7r2UezhKtbNPcDYXsy4NbmVAOiqKiV2KdoyI3sXtNOT9rZ0rf+WXhkcOQ8= -SHA256 (Pkgfile) = dc083141d577ae0910ed2a6cc57f0f7dab6e9b2cb5abeeea86dbe8f182b72925 +RWSE3ohX2g5d/eRDwXRZ5MDi/jTWVrMforD2kClk7CprTWmTTraw7qRx0FrvRiUeZPbjx65RUgL3BjA4j1lY/vQSvMcnl60YNww= +SHA256 (Pkgfile) = 76ce3c96242b1a758e8e5ee8c048164d101c54cf9a5f7518a0e7d9f2e85367b1 SHA256 (.footprint) = 4b6e9e791f10bb007a541c6a4cfe6a189d549592939bdf3e04c5bd0f25a4bfa0 -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/php-ftp/Pkgfile b/php-ftp/Pkgfile index 1e400e367..01bd25f0d 100644 --- a/php-ftp/Pkgfile +++ b/php-ftp/Pkgfile @@ -5,7 +5,7 @@ # Depends on: name=php-ftp -version=5.6.33 +version=5.6.34 release=1 source=(http://www.php.net/distributions/php-$version.tar.xz) diff --git a/php-gd/.md5sum b/php-gd/.md5sum index 8d427149c..d32c77dff 100644 --- a/php-gd/.md5sum +++ b/php-gd/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/php-gd/.signature b/php-gd/.signature index aa27f1f58..2126f34a5 100644 --- a/php-gd/.signature +++ b/php-gd/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/apW8nOzisd/uD1cnZHzoYAO7kLbs8DZAqUyTQ2SPMiElMTcSLlBElXyMeKkFQYHHOknp8eZbCWrcO5dfqR++g4= -SHA256 (Pkgfile) = 87ab0ec7e927f81b7f4bf7f890ffc5c809f62440b5f1a0ce1e9a1770f9df69a4 +RWSE3ohX2g5d/QF6NeWSlBbd57u5Vf/SgZvGSkvARkjONmsk57Nswo7K3eGRFN1dss9Qn8Ou3Xgs+rsjTN++ODrsJUG2Hi0z5wU= +SHA256 (Pkgfile) = f8b00f2f64a2bed53ec10abb5a15601b3ab08e214f49fba8771bb48cb7fc01e0 SHA256 (.footprint) = 09e41333252c613bbc54155a95e91919aedf35e3fe90607f941528ac9f1a39bb -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/php-gd/Pkgfile b/php-gd/Pkgfile index 85c36878f..dfd8efbba 100644 --- a/php-gd/Pkgfile +++ b/php-gd/Pkgfile @@ -5,7 +5,7 @@ # Depends on: libgd name=php-gd -version=5.6.33 +version=5.6.34 release=1 source=(http://www.php.net/distributions/php-$version.tar.xz) diff --git a/php-gettext/.md5sum b/php-gettext/.md5sum index 8d427149c..d32c77dff 100644 --- a/php-gettext/.md5sum +++ b/php-gettext/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/php-gettext/.signature b/php-gettext/.signature index c7b5df6af..c784dd3eb 100644 --- a/php-gettext/.signature +++ b/php-gettext/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/UtTJovUQKp7vP/1BugsH0u1pLR4C+ds0dgH8oe+jr3Biof4JlMY+7UgUlZMwrKQtBLoE2jwGfuY1B1PlBClDgc= -SHA256 (Pkgfile) = 7c8f5fa5f1e2f6af143108890e01bbec80a0b5161c946e8c2ee7ff524b158e2d +RWSE3ohX2g5d/agLlcobvSHpegOzrdmAxrzfz6MoMcV4b4TupFHsTyN05mY6z8s1u5wVXrJtmKapv1z1Hvl1SgNx90TUv3xRNgY= +SHA256 (Pkgfile) = d678b7de541fa4c575e7298a032f14e32501e87c60bf0957f9e286d9b7276c4d SHA256 (.footprint) = f2188408bdd37cf12c2eb9ef545b934e6a10d8faf52d3b961cd6c7649bdfaf9a -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/php-gettext/Pkgfile b/php-gettext/Pkgfile index 3d63cb5de..2253d5307 100644 --- a/php-gettext/Pkgfile +++ b/php-gettext/Pkgfile @@ -5,7 +5,7 @@ # Depends on: name=php-gettext -version=5.6.33 +version=5.6.34 release=1 source=(http://www.php.net/distributions/php-$version.tar.xz) diff --git a/php-mysql/.md5sum b/php-mysql/.md5sum index 8d427149c..d32c77dff 100644 --- a/php-mysql/.md5sum +++ b/php-mysql/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/php-mysql/.signature b/php-mysql/.signature index 7cb3b18af..f26297d57 100644 --- a/php-mysql/.signature +++ b/php-mysql/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/WjxGpcb+EA5nGHbrYTLa7dKPsrxJS/RByyfNOSgoEipGKBZzQbWdwvh3EpYWwaZd9Xzl2sY/zPe8L9kkRRJAQo= -SHA256 (Pkgfile) = a12fb1ebdb740ba151a63171bdabb6f266ae9c49126f8abb6591035a76f5f3ed +RWSE3ohX2g5d/RB1xYUe4emk3387b2IKO9IYmuvYWcyvno1PCkCIFJBtwaggd4skVglBF7Mqjs62bIEFyvWQ8J0Uuq37XTTm2wo= +SHA256 (Pkgfile) = 1178aafeb8cd6f5ebbd45cbdbf1101b8b7c7dcf70372becff33e5087ef8d766b SHA256 (.footprint) = 4dd3e707e3020b35147ba1ebdf629cbeaa4da75c01c769261626a1d91e0e5f0e -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/php-mysql/Pkgfile b/php-mysql/Pkgfile index 9c867315f..ecf5b4080 100644 --- a/php-mysql/Pkgfile +++ b/php-mysql/Pkgfile @@ -4,7 +4,7 @@ # Depends on: mysql name=php-mysql -version=5.6.33 +version=5.6.34 release=1 source=(http://php.net/distributions/php-$version.tar.xz) diff --git a/php-sockets/.md5sum b/php-sockets/.md5sum index 8d427149c..d32c77dff 100644 --- a/php-sockets/.md5sum +++ b/php-sockets/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/php-sockets/.signature b/php-sockets/.signature index 67536d329..61da121e4 100644 --- a/php-sockets/.signature +++ b/php-sockets/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/eLZtQupdEYpVdOhLgJd3+76KbJ7n0D7mEHwauseaAamK4qn4cICQ85j33u4F0VkYRwjxLiQbSaVsnQbmc6AigI= -SHA256 (Pkgfile) = c109bcd40ec5e3a053fe6a9fa1faef75860da85aa83cee8b7723d310661fc806 +RWSE3ohX2g5d/blk/kY2mvh9Dtt2mpWYl8+Rtq1n1Xrsy99mYsADX7uM6cvB/Fc2NT5h7SlhxOr7SNqUrmpUvC+7+h/wqWVKtwA= +SHA256 (Pkgfile) = f6bf673d31a2c2425473a99094d71e1cc46ea73d360265a430d5378bc13c323a SHA256 (.footprint) = 1a0e33807dcda8d11408be8b6356860cac8daea5a94d4e9a87e535fbf778f04e -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/php-sockets/Pkgfile b/php-sockets/Pkgfile index 1203fe3d1..f706dd244 100644 --- a/php-sockets/Pkgfile +++ b/php-sockets/Pkgfile @@ -5,7 +5,7 @@ # Depends on: name=php-sockets -version=5.6.33 +version=5.6.34 release=1 source=(http://www.php.net/distributions/php-$version.tar.xz) diff --git a/php-sqlite3/.md5sum b/php-sqlite3/.md5sum index 8d427149c..d32c77dff 100644 --- a/php-sqlite3/.md5sum +++ b/php-sqlite3/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/php-sqlite3/.signature b/php-sqlite3/.signature index 6d846812c..ea1895523 100644 --- a/php-sqlite3/.signature +++ b/php-sqlite3/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/RukDUi/CIrgd0Liz74ltmr4xDwt7DBtnaEmhvD+ueWcDBqgJ9Ym0gH52U2OPmuHx9/4J5jFwVioNALVoo8xCAA= -SHA256 (Pkgfile) = 74761ccc865a725799f89d53187bf8085709907c3cf9595f6ffdb45870571cdd +RWSE3ohX2g5d/SEcUIaxBRTvu7qIC1GQ2mObJA0DZiRNqCzquqJUmYsSbUq4RA521CRNCzBVYkYD9WCr+jTW22hCqYFpuuMKxAE= +SHA256 (Pkgfile) = 32d9f20eb8dcf0a693141d15bd00f16a7885f2b3eaca82f5a5692ba217c9f599 SHA256 (.footprint) = e626528b1bc2b3ce187cc979172f24c489075e0bc584aeb1d082b2f7197d6e49 -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/php-sqlite3/Pkgfile b/php-sqlite3/Pkgfile index 88da8c920..d67ee74e5 100644 --- a/php-sqlite3/Pkgfile +++ b/php-sqlite3/Pkgfile @@ -4,7 +4,7 @@ # Depends on: sqlite3 name=php-sqlite3 -version=5.6.33 +version=5.6.34 release=1 source=(http://php.net/distributions/php-$version.tar.xz) diff --git a/php/.md5sum b/php/.md5sum index 8d427149c..d32c77dff 100644 --- a/php/.md5sum +++ b/php/.md5sum @@ -1 +1 @@ -ca5d8f4b2b8c19519e495ecfed625ffa php-5.6.33.tar.xz +dd28a659b88ad60797a7c102307f2edb php-5.6.34.tar.xz diff --git a/php/.signature b/php/.signature index 37b0c03ba..07f0f65a3 100644 --- a/php/.signature +++ b/php/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/eIueJTTRNuDkMAVWA+V/LHERMd59QtPQDGfa3Oq/khknkrprkUUKxKfgWdhEIjUXVfIl1ShH2N+gZUZwuD7kgI= -SHA256 (Pkgfile) = da8ee59f68dbb1bc266abd0521024784572633f98215336a7f3c08b95cb422b3 +RWSE3ohX2g5d/Z8VmvOqIdduAEuzwTKvGFzk5KztLCIC622Wn/ug5IX+dDo5cqHnBM9Yh46iw1xU138Xvz8PBadr+PSK5xb3nw8= +SHA256 (Pkgfile) = 94fd7e3e97e8cf007256e0affb884e62d4406396c1609ecd649dbb948b4b50be SHA256 (.footprint) = 65e725950334ab8815dc34d555a1a963d49b0af8df57aabe4efba07854a69adc -SHA256 (php-5.6.33.tar.xz) = 9004995fdf55f111cd9020e8b8aff975df3d8d4191776c601a46988c375f3553 +SHA256 (php-5.6.34.tar.xz) = 21453be3a045204cd2717543ef42771324f411f40962ecda4fe841930a933128 diff --git a/php/Pkgfile b/php/Pkgfile index 4783ed2d7..c70e881ce 100644 --- a/php/Pkgfile +++ b/php/Pkgfile @@ -4,7 +4,7 @@ # Depends on: libpcre libxml2 curl db gdbm name=php -version=5.6.33 +version=5.6.34 release=1 source=(http://php.net/distributions/php-$version.tar.xz)

1 0

ports/opt (3.4): [notify] python: security fix for CVE-2018-1000030, closes FS#1593
by crux＠crux.nu 06 Mar '18

06 Mar '18

commit 44a2a4397f72c46d9233396e33b20440e169967b Author: Juergen Daubert <jue(a)jue.li> Date: Mon Mar 5 14:00:09 2018 +0100 [notify] python: security fix for CVE-2018-1000030, closes FS#1593 see https://nvd.nist.gov/vuln/detail/CVE-2018-1000030 diff --git a/python/.md5sum b/python/.md5sum index 827b1afbb..2522becf5 100644 --- a/python/.md5sum +++ b/python/.md5sum @@ -1,2 +1,3 @@ +ff653e9e002ca0e3d4a828988e52edd3 CVE-2018-1000030.patch 1f6db41ad91d9eb0a6f0c769b8613c5b Python-2.7.14.tar.xz 387d5f6d00d2be01ecb87216cac0f88c pyconfig.h diff --git a/python/.signature b/python/.signature index 79f65e271..660b6eece 100644 --- a/python/.signature +++ b/python/.signature @@ -1,6 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/epCMlUlFvQyaIBzosMEyP+lGSzf7nv8h9yrdisRjDKb2xLBIKFHVun/04RwTZIvn0CBZvxCeIfrt5e8O4HPwQQ= -SHA256 (Pkgfile) = 1fb4bf0238ad36a48a801d2d37d04e2c9650697dff1939f2781dc74f72058491 +RWSE3ohX2g5d/boQipBgLcfxZlqFZR09X30s/Z5MGSa539QoTYA6+7gBtc/kPgMKpF6e8opocX6wAQjcf9trsFzX4XMdoJaRFwY= +SHA256 (Pkgfile) = 68fdadc03201267d440d69f8cd2e02a028887cf0b274d02ca17c52095aa8c663 SHA256 (.footprint) = cad0b763c2deaad518b7c81ea32fbbe025df03c1548002336ef818ca9f4cf7ce SHA256 (Python-2.7.14.tar.xz) = 71ffb26e09e78650e424929b2b457b9c912ac216576e6bd9e7d204ed03296a66 +SHA256 (CVE-2018-1000030.patch) = f7ff89ad24d529532b4dfa6bd601d8f7368c3ae3950dae539ecc11e5e09b3ecb SHA256 (pyconfig.h) = 081426cb9524c2e156a71bb035c25a67e44d389afc6f7e091bcf86a7f4e2002f diff --git a/python/Pkgfile b/python/Pkgfile index 3645f5e98..3120ef84a 100644 --- a/python/Pkgfile +++ b/python/Pkgfile @@ -5,12 +5,17 @@ name=python version=2.7.14 -release=1 +release=2 source=(http://www.python.org/ftp/$name/$version/Python-$version.tar.xz \ + CVE-2018-1000030.patch pyconfig.h) build () { cd Python-$version + + # fix for CVE-2018-1000030 + # see https://bugs.python.org/issue31530 + patch -p1 -i $SRC/CVE-2018-1000030.patch # set OPT to the python default without -O3 # our CFLAGS are used as well

1 0