kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

- Update backports patch to 20121114

Browse source 
- Bump PORTREVISION

Changes:
- CVE-2006-7243
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow
context-dependent attackers to bypass intended access restrictions by placing a
safe file extension after this character, as demonstrated by .php\0.jpg at the
end of the argument to the file_exists function

Secuity 3761df02-0f9c-11e0-becc-0022156e8794 fixed by check in fopen functions
for strlen(filename) != filename_len

- CVE-2012-4388
The sapi_header_op function in main/SAPI.c does not properly determine a pointer
during checks for %0D sequences (aka carriage return characters), which allows
remote attackers to bypass an HTTP response-splitting protection mechanism via a
crafted URL, this vulnerability exists because of an incorrect fix for
CVE-2011-1398.

- Timezone database updated to version 2012.9 (2012i)

PR:		ports/173685
Submitted by:	Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Approved by:	maintainer
Feature safe:	yes
This commit is contained in:
Florian Smeets 2012-11-25 15:42:22 +00:00
parent 032162905d
commit abbf32d4b2
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=307747
3 changed files with 6 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lang/php52/Makefile
View file

@ -7,7 +7,7 @@
PORTNAME= php52
PORTVERSION= 5.2.17
PORTREVISION= 11
PORTREVISION= 12
CATEGORIES?= lang devel www
MASTER_SITES= ${MASTER_SITE_PHP}
MASTER_SITE_SUBDIR= distributions
@ -26,7 +26,7 @@ USE_BZIP2= yes
MAKE_JOBS_SAFE= yes
# BACKPORTS patch for lang/php52 and all php52-extensions
PATCHFILES= php52-backports-security-20120911.patch
PATCHFILES= php52-backports-security-20121114.patch
PATCH_SITES+= http://php52-backports.googlecode.com/files/
.if !defined(PKGNAMESUFFIX)

4
lang/php52/distinfo
View file

@ -1,7 +1,7 @@
SHA256 (php-5.2.17.tar.bz2) = e81beb13ec242ab700e56f366e9da52fd6cf18961d155b23304ca870e53f116c
SIZE (php-5.2.17.tar.bz2) = 9092312
SHA256 (php52-backports-security-20120911.patch) = 4911e2a5abb72d0558b2baf07ff64ca054d71219bde183e41b591894fb7cb1f6
SIZE (php52-backports-security-20120911.patch) = 356599
SHA256 (php52-backports-security-20121114.patch) = 59dc139b9acf86bbb2e281696765de513c3bec7d43392a10b5f3b36a9881ab00
SIZE (php52-backports-security-20121114.patch) = 410829
SHA256 (php-5.2.14-fpm-0.5.14-freebsd.patch.gz) = 354ce451417d14ef47761ae55147e9cee30fa0ff6f59447da021194c539f4d7f
SIZE (php-5.2.14-fpm-0.5.14-freebsd.patch.gz) = 43550
SHA256 (suhosin-patch-5.2.16-0.9.7.patch.gz) = aae115a318d80b3f32cedf876e7a8e4b932febb1b0c743c0b398003ebe122f91

9
security/vuxml/vuln.xml
View file

@ -16626,7 +16626,7 @@ Note: Please add new entries to the beginning of this file.
</package>
<package>
<name>php52</name>
<range><ge>0</ge></range>
<range><lt>5.2.17_12</lt></range>
</package>
</affects>
<description>
@ -16645,11 +16645,6 @@ Note: Please add new entries to the beginning of this file.
<p>Paths with NULL in them (foo\0bar.txt) are now considered
as invalid (CVE-2006-7243).</p>
</blockquote>
<blockquote cite="http://www.freebsd.org/cgi/query-pr.cgi?pr=ports/171583">
<p>The php52 backports maintainer reports that this issue is unlikely
to be fixed in 5.2 due to design roadblocks. Users are strongly
encouraged to upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
@ -16660,7 +16655,7 @@ Note: Please add new entries to the beginning of this file.
<dates>
<discovery>2010-12-10</discovery>
<entry>2011-01-13</entry>
<modified>2012-09-19</modified>
<modified>2012-11-25</modified>
</dates>
</vuln>