Commit graph

21407 commits

Author SHA1 Message Date
Dmitry Marakasov
c58a8fa1f4 - Document CVE-2015-3258 (cups-filters buffer overflow vulnerability)
PR:		201134
Submitted by:	cyberbotx@cyberbotx.com
Differential Revision:
2015-06-30 23:56:39 +00:00
Xin LI
ae2318a842 Document ntp remote control message DoS vulnerability. 2015-06-30 20:56:29 +00:00
Michael Moll
d2b4b98560 security/rubygem-gssapi: update to 1.2.0
Approved by:	swills (mentor), Joe Benden (maintainer, timeout)
Differential Revision:	https://reviews.freebsd.org/D2916
2015-06-30 20:43:12 +00:00
Dmitry Marakasov
72a2abb73a - Update to 0.8.1
PR:		201179
Submitted by:	tkato432@yahoo.com
Differential Revision:
2015-06-30 20:17:59 +00:00
Dan Langille
afa20d30bc remove BROKEN. Port now builds with django16
Approved by:            wg (mentor)
2015-06-30 18:28:13 +00:00
Rene Ladan
282f56dd8d Remove expired ports:
2015-06-30 devel/rubygem-mash: Deprecated by upstream. Use devel/rubygem-hashie instead
2015-06-30 net/rubygem-bunny060: Use net/rubygem-bunny instead
2015-06-30 security/rubygem-hmac: Duplicate of security/rubygem-ruby-hmac
2015-06-30 www/ruby-amazon: Rendered obsolete by upstream since Amazon shut down access to AWS API v3 (2008-03-31). Use www/ruby-aws instead
2015-06-30 16:39:45 +00:00
Dan Langille
54833e1033 security/py-crits must use django v1.6 and will not work with v1.8
Two dependencies bring in www/py-django so I have created two new slave ports which
use www/py-django16

* devel/py-django-tastypie-mongoengine allowed you to select django 1.6 or 1.8 in the options It now uses only 1.8
* add slave port devel/py-django16-tastypie-mongoengine which uses django 1.6
* www/py-django-tastypie now sets RUN_DEPENDS only if not already set
* add slave www/py-django16-tastypie which uses django 1.6

Approved by:            mat (mentor)
Differential Revision:  https://reviews.freebsd.org/D2913
2015-06-30 15:39:41 +00:00
Wesley Shields
b705efc8b5 Update to 3.4.0. 2015-06-30 13:48:43 +00:00
Wesley Shields
79f85557ff Update to 3.4.0. 2015-06-29 20:23:22 +00:00
Adam Weinberger
26f58ed1c0 After r390893, chmod u+w/u-w for stripping perl XS modules is unnecessary,
and in fact now leads to incorrect permissions.

Remove all instances of it from perl@ ports.
2015-06-29 15:47:44 +00:00
Steve Wills
832d8722e0 security/vault: add missing line to rc script 2015-06-29 13:38:25 +00:00
Sunpoet Po-Chuan Hsieh
da19147d37 - Add NO_ARCH 2015-06-28 17:57:53 +00:00
Sunpoet Po-Chuan Hsieh
3c81d00b20 - Update to 1.70
Changes:	http://search.cpan.org/dist/Net-SSLeay/Changes
2015-06-28 09:45:29 +00:00
Dmitry Marakasov
9d8944598b - Mark ONLY_FOR_ARCHS: uses x86 assembly
- Optionize EXAMPLES
2015-06-26 21:34:35 +00:00
Pawel Pekala
c7b9866617 - Make xsel run dependency optional - it makes clipboard pasting
not working under some conditions [1]
- Make xdotool also optional
- Add NO_ARCH

PR:		200931 [1]
Submitted by:	Sascha Holzleiter <sascha@root-login.org> [1]
Approved by:	maintainer [1]
2015-06-26 19:49:15 +00:00
Juergen Lock
4bf59b9fdf Document qemu pcnet guest to host escape vulnerability - CVE-2015-3209
PR:		201064
Submitted by:	koobs
Security:	https://vuxml.FreeBSD.org/freebsd/acd5d037-1c33-11e5-be9c-6805ca1d3bb1.html
2015-06-26 19:13:31 +00:00
John Marino
b07e9251a8 security/clambc is not jobs safe.
This has failed on me at least twice recently.  Here's the last fail:
Assembler messages:
Fatal error: llvm[3]: Compiling Mangler.cpp for Release build
can't create /wrkdirs/security/clambc/work/clamav-bytecode-compiler-
  clambc-0.98.5rc1/obj/lib/Target/ClamBC/Release/version.o: No such file
  or directory
2015-06-26 19:02:45 +00:00
Steve Wills
1a16ad2949 security/vault: create port
Vault is a tool for securely accessing secrets. A secret is anything that you
want to tightly control access to, such as API keys, passwords, certificates,
and more. Vault provides a unified interface to any secret, while providing
tight access control and recording a detailed audit log.

WWW: https://vaultproject.io/
2015-06-26 17:02:42 +00:00
Xin LI
98c0e54a89 Document CVE-2014-3120, CVE-2014-6439, CVE-2015-1427, CVE-2015-3337,
and CVE-2015-4165 (various Elasticsearch vulnerabilities).

PR:		ports/201008
Submitted by:	Jason Unovitch
2015-06-26 04:35:45 +00:00
Dmitry Marakasov
49e64cca97 - Mark BROKEN on 9.x:
/usr/bin/make  all-recursive
Making all in po
Error expanding embedded variable.
*** [all-recursive] Error code 1

- Fix plist for disabled NLS case

Approved by:	portmgr blanket
Submitted by:	pkg-fallout
2015-06-25 22:06:10 +00:00
Xin LI
40718f9572 security/afl: Update to 1.83b
While at it, reset maintainer to ports@ as the port now
contains LICENSE goo whose meaning remains a mystery.

PR:		201107
Submitted by:	Fabian Keil <fk fabiankeil de> (maintainer)
2015-06-25 19:41:27 +00:00
Dmitry Marakasov
bf590da6ca - Mark BROKEN on 9.x:
config.h:249: error: expected identifier or '(' before '/' token
config.h:249: error: stray '#' in program

Approved by:	portmgr blanket
Submitted by:	pkg-fallout
2015-06-25 13:37:05 +00:00
Dmitry Marakasov
a976c75dca - Mark BROKEN on 9.x:
aead.cc:84:32: error: 'EVP_aes_128_ctr' was not declared in this scope

Approved by:	portmgr blanket
Submitted by:	pkg-fallout
2015-06-25 13:35:42 +00:00
Kubilay Kocak
5f31c61931 security/py-libnacl: Update to 1.4.3
- Update to 1.4.3
- Patch setup.py so test command is supported
- Add regression-test target

Changes:

  https://libnacl.readthedocs.org/en/latest/topics/releases/1.4.3.html

Based on:

PR:		200830
Submitted by:	Christer Edwards <christer dot edwards gmail com>
2015-06-25 05:48:02 +00:00
Xin LI
72fb5fd16e Split CVE-2015-4152 to its own entry as the affected port is logstash only.
While there also document CVE-2014-4326 (already fixed) for logstash.

PR:		ports/201001
Submitted by:	Jason Unovitch
2015-06-24 20:35:39 +00:00
Xin LI
1a71a0432f Add entry for logstash-forwarder/logstash.
PR:		ports/201065
Submitted by:	Jason Unovitch
2015-06-24 20:17:20 +00:00
Bryan Drewery
07d4a6adef Support changed ETCDIR in pkg-plist 2015-06-24 19:35:58 +00:00
Jan Beich
ea5d1656ea Aggressively mark more consumers of bundled dcraw as vulnerable
ljpeg_start() originates from dcraw, no need to list every package with
copy of it at the expense of readability.
2015-06-24 18:54:36 +00:00
Bryan Drewery
366d32fba5 Allow user overriding ETCDIR 2015-06-24 18:37:59 +00:00
Bryan Drewery
43be3ffdf0 Update to 20150624 snapshot 2015-06-24 17:59:51 +00:00
Sunpoet Po-Chuan Hsieh
00ebccf31a - Update to 1.4.11
- Add NO_ARCH

Changes:	https://github.com/google/oauth2client/blob/master/CHANGELOG.md
2015-06-24 17:41:21 +00:00
Dmitry Marakasov
2c89fd1b3e - Update to 1.80b
- While here, add LICENSE

PR:		201091
Submitted by:	fk@fabiankeil.de (maintainer)
2015-06-24 16:51:15 +00:00
Adam Weinberger
bd48f30188 Convert all p5-Test-use-ok dependencies to p5-Test-Simple, but only on
perl < 5.22. For www/p5-Catalyst-Controller-BindLex, change it from a
BUILD/RUN depend to TEST, as it is only used for the test target, and bump
PORTREVISION on that port.
2015-06-24 16:29:25 +00:00
Johannes Jost Meixner
d709b0fc86 Document linux-*-flashplugin11 CVE.
Reported by:	kwm
Reviewed by:	kwm
Security:	d02f6b01-1a3f-11e5-8bd6-c485083ca99c
Security:	CVE-2015-3113
Sponsored by:	Perceivon Hosting Inc.
2015-06-24 09:01:07 +00:00
Sunpoet Po-Chuan Hsieh
219b5528e6 - Add LICENSE
Approved by:	portmgr (blanket)
2015-06-23 20:26:32 +00:00
Ruslan Makhmatkhanov
9b5e54b8b5 Remove expired port
Functionality of py-backports.ssl_match_hostname is available in Python standard
library as ssl.match_hostname() since Python 2.7.9 [1].

[1] https://docs.python.org/2.7/library/ssl.html#ssl.match_hostname
2015-06-23 18:31:28 +00:00
Sunpoet Po-Chuan Hsieh
315ee05035 - Add NO_ARCH 2015-06-23 12:22:40 +00:00
Sunpoet Po-Chuan Hsieh
c69c71a5ff - Update to 1.2.1
- Add NO_ARCH

Changes:	https://github.com/toyokazu/omniauth-shibboleth/commits/master
2015-06-23 12:22:14 +00:00
Xin LI
2aa9f59daf Fix entry date. 2015-06-23 00:15:18 +00:00
Xin LI
9d0b4cf5d6 Document rubygem-bson DoS and possible injection vulnerability.
PR:		201061
Submitted by:	Jason Unovitch
2015-06-23 00:13:58 +00:00
Xin LI
f9f83a6deb Document 3 vulnerabilities with PHP that affected 4 extensions.
PR:		200926
Submitted by:	Jason Unovitch
2015-06-22 23:39:34 +00:00
Xin LI
1814e54078 Reflect version range change after r390340. While I'm there, also fix
the CVE-2015-4556 entry because it's not yet fixed in the ports tree and
add a reference to the PR while there.

PR:		200980
Submitted by:	Vitaly Magerya (with changes suggested by Jason Unovitch)
2015-06-22 23:22:23 +00:00
Jimmy Olgeni
cced5ca8fe Document vulnerabilities in devel/ipython < 3.2.0. 2015-06-22 22:28:05 +00:00
Baptiste Daroussin
c9066f6ae0 Remove deprecated USE_RCORDER which was already off except if one enforced
WITH_RCORDER
2015-06-22 19:43:42 +00:00
Ruslan Makhmatkhanov
ea0d346031 security/py-backports.ssl_match_hostname: add comment on blocker PR
Add comment on PR 201050 that blocking removal of this port. I tried to
contact maintainer couple of days ago, but still got no response, so just
created an PR to have a chance to commit this by timeout.
2015-06-22 19:33:51 +00:00
Rene Ladan
5dcea86754 Document new vulnerabilities in www/chromium < 43.0.2357.130
Obtained from:	http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html
2015-06-22 19:23:46 +00:00
Xin LI
2931ed1db6 Document rubygem-paperclip validation bypass vulnerabilitiy.
PR:		200979
Submitted by:	Jason Unovitch
2015-06-22 07:13:46 +00:00
Xin LI
58c3a2a130 Document lang/chicken vulnerabilities CVE-2014-9651 and CVE-2015-4556.
PR:		200980
Submitted by:	Jason Unovitch
2015-06-22 07:02:20 +00:00
Xin LI
3c6e62d8c9 Document cacti multiple vulnerabilities (affects < 0.8.8c) and
multiple XSS/SQL injection vulnerabilities (affects < 0.8.8d).

PR:		200963
Submitted by:	Jason Unovitch
2015-06-22 06:44:54 +00:00
Baptiste Daroussin
6bd636a8b6 Convert to USES=autoreconf 2015-06-21 16:14:16 +00:00