Chagnelog:
Security vulnerabilities fixed in Firefox ESR 45.6
#CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
#CVE-2016-9895: CSP bypass using marquee tag
#CVE-2016-9897: Memory corruption in libGLES
#CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
#CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
#CVE-2016-9904: Cross-origin information leak in shared atoms
#CVE-2016-9905: Crash in EnumerateSubDocuments
#CVE-2016-9901: Data from Pocket server improperly sanitized before execution
#CVE-2016-9902: Pocket extension does not validate the origin of events
#CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
Upstream changes:
Version 0.12
------------
Released on December 21st 2016, codename Punsch.
- the cli command now responds to `--version`.
- Mimetype guessing and ETag generation for file-like objects in ``send_file``
has been removed, as per issue ``#104``. See pull request ``#1849``.
- Mimetype guessing in ``send_file`` now fails loudly and doesn't fall back to
``application/octet-stream``. See pull request ``#1988``.
- Make ``flask.safe_join`` able to join multiple paths like ``os.path.join``
(pull request ``#1730``).
- Revert a behavior change that made the dev server crash instead of returning
a Internal Server Error (pull request ``#2006``).
- Correctly invoke response handlers for both regular request dispatching as
well as error handlers.
- Disable logger propagation by default for the app logger.
- Add support for range requests in ``send_file``.
- ``app.test_client`` includes preset default environment, which can now be
directly set, instead of per ``client.get``.
Version 0.11.2
--------------
Bugfix release, unreleased
- Fix crash when running under PyPy3, see pull request ``#1814``.
Version 0.11.1
--------------
Bugfix release, released on June 7th 2016.
- Fixed a bug that prevented ``FLASK_APP=foobar/__init__.py`` from working. See
pull request ``#1872``.
lib: Accept and ignore content-length: 0 in 204 response for now
build: Use pkg-config to detect libxml2
build: Require c-ares to compile applications under src
build: Add Windows CI via AppVeyor (Patch from Alexis La Goutte)
examples: Delete tiny-nghttpd
nghttpx: Retry h1 backend request if first write fails (GH-757)
nghttpx: Keep reading after backend write failed (GH-756)
nghttpx: Add frontend-keep-alive-timeout option (GH-755)
nghttpx: New error log format (GH-749)
nghttpx: Fix bug that fetch-ocsp-response does not work with OpenSSL 1.1.0 (GH-742)
nghttpx: Backend API call allows non-numeric host with dns parameter (GH-731)
nghttpx: Lookup backend host name dynamically (GH-721)
nghttpx: Accept and ignore content-length: 0 in 204 response for now (GH-735)
nghttpx: Wait for child process to exit
Upstream changes:
7.13 2016-12-23
- Deprecated Mojo::Message::Response::is_status_class in favor of new is_*
methods.
- Added result method to Mojo::Transaction.
- Added is_client_error, is_error, is_info, is_redirect, is_server_error and
is_success methods to Mojo::Message::Response.
- Fixed bug where Morbo could not handle broken symlinks. (Grinnz)
7.12 2016-12-18
- Added button_to and csrf_button_to helpers to
Mojolicious::Plugin::TagHelpers.
- Removed experimental status from Mojo::IOLoop::Subprocess.
- Removed experimental status from subprocess method in Mojo::IOLoop.
Upstream changes:
5.90114 - 2016-12-19
- Fixed regression introduced in the last version (5.90113) which caused
application to hang when the action private name contained a string
like 'foo/bar..html'. If you are running 5.90113 you should consider this
a required update.
- Tweaked travis CI script.
5.90113 - 2016-12-15
- Fixed issue with $controller->action_for when targeting an action in
a namespace nested inside the current controller and the current controller
is a 'root' controller.
- Enhanced $controller->action_for so that you can reference the 'parent'
controller via relative path (eg ->action_for('../foo')).
- Backcompat fix for people that made the mistake of doing $c->{stash}
- Sort controllers in setup_actions so cross-controller precedence is
consistent.
Upstream changes:
0.204002 2016-12-21 15:40:02-06:00 America/Chicago
[ BUG FIXES ]
* GH #975: Fix "public_dir" configuration to work, just like
DANCER_PUBLIC. (Sawyer X)
[ ENHANCEMENTS ]
* You can now call '$self->find_plugin(...)' within a plugin
in order to find a plugin, in order to use its DSL in your
custom plugin. (Sawyer X)
[ DOCUMENTATION ]
* GH #1282: Typo in Cookbook. (Kurt Edmiston)
* GH #1214: Update Migration document. (Sawyer X)
* GH #1286: Clarify hook behavior when disabling layout (biafra)
* GH #1280: Update documentation to use specific parameter
keywords (Hunter McMillen)
Upstream changes:
2.26 Thu Dec 29 22:36:54 CST 2016
Stable release. No changes from previous release.
2.25_02 Tue Dec 27 14:34:22 CST 2016
[FIXES]
html_fragment_ok() was not properly excluding document-level errors.
It was effectively the same as html_ok().
2.25_01 Fri Dec 23 22:36:17 CST 2016
[ENHANCEMENTS]
Added two new types of errors to let you know you're using the
API incorrectly. You should be parsing files like this:
my $lint = HTML::Lint->new;
$lint->newfile( $filename );
$lint->parse( $line );
$lint->eof();
my @errors = $lint->errors();
If you neglect to call ->parse or ->eof, you'll get an error returned
in the list of errors from ->errors().
[FIXES]
Test::HTML::Lint::html_fragment_ok() was not properly calling ->eof.
Changelog:
Tomcat 8.0.39 (violetagg)
Catalina
Fix: When creating a new Connector via JMX, ensure that both HTTP/1.1 and AJP/1.3 connectors can be created. (markt)
Fix: Include the Context name in the log message when an item cannot be added to the cache. (markt)
Fix: Exclude JAR files in /WEB-INF/lib from the static resource cache. (markt)
Fix: When calling getResourceAsStream() on a directory, ensure that null is returned. (markt)
Fix: 60161: Allow creating subcategories of the container logger, and use it for the rewrite valve. (remm)
Fix: Correctly test for control characters when reading the provided shutdown password. (markt)
Fix: When configuring the JMX remote listener, specify the allowed types for the credentials. (markt)
Coyote
Fix: Correct the HTTP header parser so that DEL is not treated as a valid token character. (markt)
Fix: 60319: When using an Executor, disconnect it from the Connector attributes maxThreads, minSpareThreads and threadPriority to enable the configuration settings to be consistently reported. These Connector attributes will be reported as -1 when an Executor is in use. The values used by the executor may be set and obtained via the Executor. (markt)
Fix: If an I/O error occurs during async processing on a non-container thread, ensure that the onError() event is triggered. (markt)
Fix: Improve detection of I/O errors during async processing on non-container threads and trigger async error handling when they are detected. (markt)
Add: Add additional checks for valid characters to the HTTP request line parsing so invalid request lines are rejected sooner. (markt)
Web applications
Fix: Correct a typo in HTTP Connector How-To. Issue reported via comments.apache.org. (violetagg)
Fix: Fix default value of validationInterval attribute in jdbc-pool. (kfujino)
Fix: Correct a typo in CGI How-To. Issue reported via comments.apache.org. (violetagg)
Tribes
Fix: When the proxy node sends a backup retrieve message, ensure that using the channelSendOptions that has been set rather than the default channelSendOptions. (kfujino)
Other
Update: Update the ECJ compiler to version 4.5.1. (markt)
Fix: Remove classes from tomcat-util-scan.jar that are duplicates of those in tomcat-util.jar. (markt)
2016-10-10 Tomcat 8.0.38 (markt)
Catalina
Add: 59961: Add an option to the StandardJarScanner to control whether or not JAR Manifests are scanned for additional class path entries. (markt)
Fix: 60013: Refactor the previous fix to align the behaviour of the Rewrite Valve with mod_rewrite. As part of this, provide an implementation for the B and NE flags and improve the handling for the QSA flag. Includes multiple test cases by Santhana Preethiand a patch by Tiago Oliveira. (markt)
Fix: 60087: Refactor the web resources handling to use the Tomcat specific war:file:... URL protocol to refer to WAR files and their contents rather than the standard jar:file:... form since some components of the JRE, such as JAR verification, give unexpected results when the standard form is used. A side-effect of the refactoring is that when using packed WARs, it is now possible to reference a WAR and/or specific JARs within a WAR in the security policy file used when running under a SecurityManager. (markt)
Fix: 60116: Fix a problem with the rewrite valve that caused back references evaluated in conditions to be forced to lower case when using the NC flag. (markt)
Fix: Ensure Digester.useContextClassLoader is considered in case the class loader is used. (violetagg)
Fix: 60117: Ensure that the name of LogLevel is localized when using OneLineFormatter. Patch provided by Tatsuya Bessho. (kfujino)
Fix: 60146: Improve performance for resource retrieval by making calls to WebResource.getInputStream() trigger caching if the resource is small enough. Patch provided by mohitchugh. (markt)
Add: 60151: Improve the exception error messages when a ResourceLink fails to specify the type, specifies an unknown type or specifies the wrong type. (markt)
Fix: 60167: Ignore empty lines in /etc/passwd files when using the PasswdUserDatabase. (markt)
Fix: 60170: Exclude the compressed test file index.html.br from RAT analysis. Patch provided by Gavin McDonald. (markt)
Fix: When starting web resources, ensure that class resources are only started once. (markt)
Fix: Improve the access checks for linked global resources to handle the case where the current class loader is a child of the web application class loader. (markt)
Fix: 60199: Log a warning if deserialization issues prevent a session attribute from being loaded. (markt)
Coyote
Fix: Correctly handle a call to AsyncContext.complete() from a non-container thread when non-blocking I/O is being used. (markt)
Add: Refactor the code that implements the requirement that a call to complete() or dispatch() made from a non-container thread before the container initiated thread that called startAsync() completes must be delayed until the container initiated thread has completed. Rather than implementing this by blocking the non-container thread, extend the internal state machine to track this. This removes the possibility that blocking the non-container thread could trigger a deadlock. (markt)
Fix: 60123: Avoid potential threading issues that could cause excessively large vales to be returned for the processing time of a current request. (markt)
Fix: 60174: Log instances of HeadersTooLargeException during request processing. (markt)
Jasper
Fix: 60101: Remove preloading of the class that was deleted. (violetagg)
Web applications
Add: Expand the documentation for the nested elements within a Resources element to clarify the behaviour of different configuration options with respect to the order in which resources are searched. (markt)
Add: Add an example of using the classesToInitialize attribute of the JreMemoryLeakPreventionListener to the documentation web application. Based on a patch by Cris Berneburg. (markt)
Fix: 60192: Correct a typo in the status output of the Manager application. Patch provided by Radhakrishna Pemmasani. (markt)
jdbc-pool
Fix: Notify jmx when returning the connection that has been marked suspect. (kfujino)
Fix: Ensure that the POOL_EMPTY notification has been added to the jmx notification types. (kfujino)
Fix: 60099: Ensure that use all method arguments as a cache key when using StatementCache. (kfujino)
Fix: 60139: Correct Javadocs for PoolConfiguration.getValidationInterval and setValidationInterval. Reported by Phillip Webb. (kfujino)
Other
Fix: Update the download location for Objenesis. (violetagg)
Fix: 60164: Replace log4j-core*.jar with log4j-web*.jar since it is log4j-web*.jar that contains the ServletContainerInitializer. (markt)
Add: Add documentation to the bin/catalina.bat script to remind users that environment variables don't affect the configuration of Tomcat when run as a Windows Service. Based upon a documentation patch by James H.H. Lampert. (schultz)
Update: Update the packaged version of the Tomcat Native Library to 1.2.10 to pick up the latest Windows binaries built with OpenSSL 1.0.2j. (markt)
2016-09-05 Tomcat 8.0.37 (markt)
Catalina
Fix: 57705: Add debug logging for requests denied by the remote host and remote address valves and filters. Based on a patch by Graham Leggett. (markt)
Add: 59399: Add a new option to the Realm implementations that ship with Tomcat that allows the HTTP status code used for HTTP -> HTTPS redirects to be controlled per Realm. (markt)
Update: Change the default of the sessionCookiePathUsesTrailingSlash attribute of the Context element to false since the problems caused when a Servlet is mapped to /* are more significant than the security risk of not enabling this option by default. (markt)
Fix: Do not attempt to start web resources during a web application's initialisation phase since the web application is not fully configured at that point and the web resources may not be correctly configured. (markt)
Fix: 59708: Modify the LockOutRealm logic. Valid authentication attempts during the lock out period will no longer reset the lock out timer to zero. (markt)
Fix: Improve error handling around user code prior to calling InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: 59813: Ensure that circular relations of the Class-Path attribute from JAR manifests will be processed correctly. (violetagg)
Fix: Ensure that reading the singleThreadModel attribute of a StandardWrapper via JMX does not trigger initialisation of the associated servlet. With some frameworks this can trigger an unexpected initialisation thread and if initilisation is not thread-safe the initialisation can then fail. (markt)
Fix: Compatibility with rewrite from httpd for non existing headers. (jfclere)
Fix: By default, treat paths used to obtain a request dispatcher as encoded. This behaviour can be changed per web application via the dispatchersUseEncodedPaths attribute of the Context. (markt)
Fix: 59839: Apply roleSearchAsUser to all nested searches in JNDIRealm. (fschumacher)
Fix: 59859: Fix resource leak in WebDAV servlet. Based on patch by Coty Sutherland. (fschumacher)
Add: Provide a mechanism that enables the container to check if a component (typically a web application) has been granted a given permission when running under a SecurityManager without the current execution stack having to have passed through the component. Use this new mechanism to extend SecurityManager protection to the system property replacement feature of the digester. (markt)
Add: When retrieving an object via a ResourceLink, ensure that the object obtained is of the expected type. (markt)
Fix: 59824: Mark the RewriteValve as supporting async processing by default. (markt)
Fix: 59862: Allow nested jar files scanning to be filtered with the system property tomcat.util.scan.StandardJarScanFilter.jarsToSkip. Patch is provided by Terence Bandoian. (violetagg)
Fix: 59866: When scanning WEB-INF/classes for annotations, don't scan the contents of WEB-INF/classes/META-INF (if present) since classes will never be loaded from that location. (markt)
Fix: 59888: Correctly handle tabs and spaces in quoted version one cookies when using the Rfc6265CookieProcessor. (markt)
Fix: 59912: Fix an edge case in input stream handling where an IOException could be thrown when reading a POST body. (markt)
Fix: 59960: Fix Javadoc so it builds with Java 8. Patch by Coty Sutherland. (markt)
Fix: 59966: Do not start the web application if the error page configuration in web.xml is invalid. (markt)
Fix: Switch the CGI servlet to the standard logging mechanism and remove support for the debug attribute. (markt)
Fix: Changes to the allowLinking attribute of a StandardRoot instance now invalidate the cache if caching is enabled. (markt)
Add: Add a new initialisation parameter, envHttpHeaders, to the CGI Servlet to mitigate httpoxy (CVE-2016-5388) by default and to provide a mechanism that can be used to mitigate any future, similar issues. (markt)
Add: When adding and removing ResourceLinks dynamically, ensure that the global resource is only visible via the ResourceLinkFactory when it is meant to be. (markt)
Fix: 60008: When processing CORs requests, treat any origin with a URI scheme of file as a valid origin. (markt)
Fix: Improve handling of exceptions during a Lifecycle events triggered by a state transition. The exception is now caught and the component is now placed into the FAILED state. (markt)
Fix: 60013: Fix encoding issues when using the RewriteValve with UTF-8 query strings or UTF-8 redirect URLs. (markt)
Fix: 60022: Improve handling when a WAR file and/or the associated exploded directory are symlinked into the appBase. (markt)
Fix: Fix a file descriptor leak when reading the global web.xml. (markt)
Fix: Consistently decode URL patterns provided via web.xml using the encoding of the web.xml file where specified or UTF-8 where no explicit encoding is specified. (markt)
Fix: Make timing attacks against the Realm implementations harder. (schultz)
Coyote
Fix: Improve error handling around user code prior to calling InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: Extend synchronization for NIO2 writes to avoid ConcurrentModificationException observed during testing. (markt)
Fix: 59904: Add a limit (default 200) for the number of cookies allowed per request. Based on a patch by gehui. (markt)
Fix: 59925: Correct regression in r1628368 and ensure that HTTP separators are handled as configured in the LegacyCookieProcessor. Patch provided by Kyohei Nakamura. (markt)
Fix: OpenSSL now disables 3DES by default so reflect this when using OpenSSL syntax to select ciphers. (markt)
Jasper
Fix: Improve error handling around user code prior to calling InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: Improve the error handling for custom tags to ensure that the tag is returned to the pool or released and destroyed once used. (markt)
Fix: 60032: Fix handling of method calls that use varargs within EL value expressions. (markt)
Fix: Ignore engineOptionsClass and scratchdir when running under a security manager. (markt)
Fix: Fixed StringIndexOutOfBoundsException. Based on a patch provided by wuwen via Github. (violetagg)
WebSocket
Fix: Improve error handling around user code prior to calling InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: 59908: Ensure that a reason phrase is included in the close message if a session is closed due to a timeout. (markt)
Web Applications
Fix: Do not log an additional case of IOExceptions in the error handler for the Drawboard WebSocket example when the root cause is the client disconnecting since the logs add no value. (markt)
Fix: 59642: Mention the localDataSource in the DataSourceRealm section of the Realm How-To. (markt)
Fix: Follow-up to the fix for 59399. Ensure that the new attribute transportGuaranteeRedirectStatus is documented for all Realms. Also document the NullRealm and when it is automatically created for an Engine. (markt)
Fix: Fix the description of maxAge attribute in jdbc-pool doc. This attribute works both when a connection is returned and when a connection is borrowed. (kfujino)
Fix: 59774: Correct the prefix values in the documented examples for configuring the AccessLogValve. Patch provided by Mike Noordermeer. (markt)
Fix: 59868: Clarify the documentation for the Manager web application to make clearer that the host name and IP address in the server section are the primary host name and IP address. (markt)
Fix: MBeans Descriptors How-To is moved to mbeans-descriptors-howto.html. Patch provided by Radoslav Husar. (violetagg)
Fix: Update NIO Connector configuration documentation with an information about socket.directSslBuffer. (violetagg)
Fix: 60034: Correct a typo in the Manager How-To page of the documentation web application. (markt)
Tribes
Add: Add log message when the ping has timed-out. (kfujino)
Fix: If the ping message has been received at the AbstractReplicatedMap#leftOver method, ensure that notify the member is alive than ignore it. (kfujino)
jdbc-pool
Fix: Fix the duplicated connection release when connection verification failed. (kfujino)
Fix: Ensure that do not remove the abandoned connection that has been already released. (kfujino)
Fix: In order to avoid the unintended skip of PoolCleaner, remove the check code of the execution interval in the task that has been scheduled. (kfujino)
Fix: 59850: Ensure that the ResultSet is closed when enabling the StatementCache interceptor. (kfujino)
Fix: 59923: Reduce the default value of validationInterval in order to avoid the potential issue that continues to return an invalid connection after database restart. (kfujino)
Fix: Ensure that the ResultSet is returned as Proxy object when enabling the StatementDecoratorInterceptor. (kfujino)
Fix: 60043: Ensure that the suspectTimeout works without removing connection when the removeAbandoned is disabled. (kfujino)
Fix: Add log message of when returning the connection that has been marked suspect. (kfujino)
Fix: Correct Javadoc for ConnectionPool.suspect(). Based on a patch by Yahya Cahyadi. (markt)
Other
Update: 59276: Update optional Checkstyle library to 6.17. (kkolinko)
Add: Use the mirror network rather than the ASF master site to download the current ASF dependencies. (markt)
Update: Update the packaged version of the Tomcat Native Library to 1.2.8 to pick up the latest fixes and make 1.2.8 the minimum recommended version. (markt)
Fix: 59899: Update Tomcat's copy of the Java Persistence annotations to include the changes made in 2.1 / JavaEE 7. (markt)
Fix: Fixed typos in mbeans-descriptors.xml files. (violetagg)
Update: Update the internal fork of Commons BCEL to r1757132 to align with the BCEL 6 release. (markt)
Update: Update the internal fork of Commons DBCP2 to r1757164 to pick up a couple of bug fixes. (markt)
Update: Update the internal fork of Commons Codec to r1757174. Code formatting changes only. (markt)
Update: Update the internal fork of Commons FileUpload to afdedc9. This pulls in a fix to improve the performance with large multipart boundaries. (markt)
Changelog:
What's New in SeaMonkey 2.46
SeaMonkey 2.46 contains (among other changes) the following major changes relative to SeaMonkey 2.40:
SeaMonkey-specific changes
HTML5 fullscreen video (e.g. on YouTube) now works fine.
===== 6.1 (2016-12-20) =====
* Remove redundant dependency on calendar
* Permit client routing to "./"
* -y parameter for eliom-distillery (do not ask)
* Eliom_client: do not execute onload after OCaml services
* Permit suffix params in Eliom_service.create_attached_post
===== 6.0 (2016-12-08) =====
* Improve Eliom_service and Eliom_registration APIs using GADTs
* Implement client-side services, useful for mobile apps. This includes
** client-side service registration (Eliom_registration)
** client-side service routing (Eliom_client.change_page_uri)
* Transition to PPX internally
* Compatibility with
** OCaml 4.03.0 and 4.04.0
** Js_of_ocaml 2.8.2 and newer
** TyXML 4.0 and newer
* Various bugfixes and improvements
* PostgreSQL Ocsipersist backend
* Compatibility with TyXML 4.0.x
* Export OpenSSL options through configuration file
* Various small fixes and improvements
* Raise the minimum SwiftMailer version.
* Remove some left-over settings labels.
* Go back to using the stable channel of Composer now that version 1.3 has
been released.
* Reduce the filter menu width if preceded by the submit panel.
* Security: force CGI::FormBuilder->field to scalar context where
necessary, avoiding unintended function argument injection
analogous to CVE-2014-1572. In ikiwiki this could be used to
forge commit metadata, but thankfully nothing more serious.
(CVE-2016-9646)
* Security: try revert operations in a temporary working tree before
approving them. Previously, automatic rename detection could result in
a revert writing outside the wiki srcdir or altering a file that the
reverting user should not be able to alter, an authorization bypass.
(CVE-2016-10026 represents the original vulnerability.)
The incomplete fix released in 3.20161219 was not effective for git
versions prior to 2.8.0rc0.
(CVE-2016-9645 represents that incomplete solution.)
* Add CVE references for CVE-2016-10026
* Add automated test for using the CGI with git, including
CVE-2016-10026
- Build-depend on libipc-run-perl for better build-time test coverage
* Add missing ikiwiki.setup for the manual test for CVE-2016-10026
* git: don't issue a warning if the rcsinfo CGI parameter is undefined
* git: do not fail to commit changes with a recent git version
and an anonymous committer
2.2 (2016-12-21)
++++++++++++++++
- Made some changes to the UTS 46 data that should allow Jython to get around
64kb Java class limits. (Thanks, John A. Booth and Marcin Płonka.)
- In Python 2.6, skip two tests that rely on data not present in that
Python version's unicodedata module.
- Use relative imports to help downstream users.
### 4.3.1 (2016-12-22)
* Preserve uppercase characters in custom sections IDs (see #639).
* Always show the section title instead of its ID (see #640).
* Correctly handle DropZone file uploads (see #637).
* Fix the markup of the CSV importers (see #645).
* Correctly symlink the logs directory under Windows (see #634).
Fixed in 7.52.1
Bugfixes:
CVE-2016-9594: unititialized random
lib557: fix checksrc warnings
lib: fix MSVC compiler warnings
lib557.c: use a shorter MAXIMIZE representation
tests: run checksrc on debug builds
Version 7.52.0 (20 Dec 2016)
Changes:
nss: map CURL_SSLVERSION_DEFAULT to NSS default
vtls: support TLS 1.3 via CURL_SSLVERSION_TLSv1_3
curl: introduce the --tlsv1.3 option to force TLS 1.3
curl: Add --retry-connrefused
proxy: Support HTTPS proxy and SOCKS+HTTP(s)
add CURLINFO_SCHEME, CURLINFO_PROTOCOL, and %{scheme}
curl: add --fail-early
Bugfixes:
CVE-2016-9586: printf floating point buffer overflow
CVE-2016-9952: Win CE schannel cert wildcard matches too much
CVE-2016-9953: Win CE schannel cert name out of buffer read
msvc: removed a straggling reference to strequal.c
winbuild: remove strcase.obj from curl build
examples: bugfixed multi-uv.c
configure: verify that compiler groks -Werror=partial-availability
mbedtls: fix build with mbedtls versions < 2.4.0
dist: add unit test CMakeLists.txt to the tarball
curl -w: added more decimal digits to timing counters
easy: Initialize info variables on easy init and duphandle
cmake: disable poll for macOS
http2: Don't send header fields prohibited by HTTP/2 spec
ssh: check md5 fingerprints case insensitively (regression)
openssl: initial TLS 1.3 adaptions
curl_formadd.3: *_FILECONTENT and *_FILE need the file to be kept
printf: fix ".*f" handling
examples/fileupload.c: fclose the file as well
SPNEGO: Fix memory leak when authentication fails
realloc: use Curl_saferealloc to avoid common mistakes
openssl: make sure to fail in the unlikely event that PRNG seeding fails
URL-parser: for file://[host]/ URLs, the [host] must be localhost
timeval: prefer time_t to hold seconds instead of long
Curl_rand: fixed and moved to rand.c
glob: fix [a-c] globbing regression
darwinssl: fix SSL client certificate not found on MacOS Sierra
curl.1: Clarify --dump-header only writes received headers
http2: Fix address sanitizer memcpy warning
http2: Use huge HTTP/2 windows
connects: Don't mix unix domain sockets with regular ones
url: Fix conn reuse for local ports and interfaces
x509: Limit ASN.1 structure sizes to 256K
checksrc: add more checks
winbuild: add config option ENABLE_NGHTTP2
http2: check nghttp2_session_set_local_window_size exists
http2: Fix crashes when parent stream gets aborted
CURLOPT_CONNECT_TO: Skip non-matching "connect-to" entries
URL parser: reject non-numerical port numbers
CONNECT: reject TE or CL in 2xx responses
CONNECT: read responses one byte at a time
curl: support zero-length argument strings in config files
openssl: don't use OpenSSL's ERR_PACK
curl.1: generated with the new man page system
curl_easy_recv: Improve documentation and example program
Curl_getconnectinfo: avoid checking if the connection is closed
CIPHERS.md: attempt to document TLS cipher names
[ Joey Hess ]
* inline: Prevent creating a file named ".mdwn" when the
postform is submitted with an empty title.
[ Simon McVittie ]
* Security: tell `git revert` not to follow renames. If it does, then
renaming a file can result in a revert writing outside the wiki srcdir
or altering a file that the reverting user should not be able to alter,
an authorization bypass. Thanks, intrigeri
* cgitemplate: remove some dead code. Thanks, blipvert
* Restrict CSS matches against header class to not break
Pandoc tables with header rows. Thanks, karsk
* Make pagestats output more deterministic. Thanks, intrigeri
Version 3.5.20 (2016-12-19)
---------------------------
### Fixed
Correctly show running repeated events in the event list (see #8588).
### Fixed
Improve the PHP 7.1 compatibility.
### Fixed
Keep the root nodes order in the page selector (see #8577).
### Fixed
Do not output invalid option values in widget error messages (see #8594).
Thanks to Pascal Gerundt for finding and reporting the issue.
### Fixed
Correctly parse english dates in MooTools (see #8573).
This release fixes several security problems, some of them are already
handled in pkgsrc. Please refer CHANGES file in detail.
*) SECURITY: CVE-2016-8740 (cve.mitre.org)
mod_http2: Mitigate DoS memory exhaustion via endless
CONTINUATION frames.
[Naveen Tiwari <naveen.tiwari@asu.edu> and CDF/SEFCOM at Arizona State
University, Stefan Eissing]
*) SECURITY: CVE-2016-5387 (cve.mitre.org)
core: Mitigate [f]cgi "httpoxy" issues.
[Dominic Scheirlinck <dominic vendhq.com>, Yann Ylavic]
*) SECURITY: CVE-2016-2161 (cve.mitre.org)
mod_auth_digest: Prevent segfaults during client entry allocation when
the shared memory space is exhausted.
[Maksim Malyutin <m.malyutin dsec.ru>, Eric Covener, Jacob Champion]
*) SECURITY: CVE-2016-0736 (cve.mitre.org)
mod_session_crypto: Authenticate the session data/cookie with a
MAC (SipHash) to prevent deciphering or tampering with a padding
oracle attack. [Yann Ylavic, Colm MacCarthaigh]
*) SECURITY: CVE-2016-8743 (cve.mitre.org)
Enforce HTTP request grammar corresponding to RFC7230 for request lines
and request headers, to prevent response splitting and cache pollution by
malicious clients or downstream proxies. [William Rowe, Stefan Fritsch]
Update DEPENDS(upstream dropped php-5.3 support)
Upstream changes:
Version 9.1.3 Dec 13 2016
[major] UI: File list now works properly with many hidden entries - core/#26518
[major] Transfer ownership fails in some sharing scenario - core/#26523
[major] Transfer ownership fails if external storage with user-specified password - core/#26530
[major] Transfer ownership fails with file shares with invalid permissions - core/#26541
[major] Transfer ownership must skip trashed shares - core/#26525
[major] Versions on external storage never expire - core/#24161
[major] Properly convert public upload OCS params - core/#26691
[major] Properly load object store apps at install time when required in config - core/#26299
[major] Fix issue in sharing API that can happen with Galera Cluster - core/#26700
[major] Cannot delete file in share link from global external storage - core/#25618
[major] Fix issue where first run wizard made web UI unusable in IE11 - core/#26438
[major] Cannot upload to federated share when only create/update permission given - core/#26173
[major] Auth header in new DAV endpoint can break with Windows Webdav - core/#26412
[minor] Transfer ownership don't bail out on error - core/#26524
[minor] Don't scan received shares in OCC files scan or background jobs - core/#26590
[minor] Remove useless warning in log when accessing public shares - core/#25455
[minor] Fix disappearance of share info when clicking favorite star - core/#26241
[minor] Don't bother fetching preview images if previews disabled in config.php - core/#26705
Version 9.1.2 Nov 8 2016
Core: Adjusted documentation link to issue template - core/#26087
Core: Display feedback in users page when changing password - core/#25532
Core: Fix mime type detection in hidden directories - core/#26133
Core: Change forum URL to central - core/#25644
Core: Fix share array format passed to "post_unshareFromSelf" hook - core/#26390
Core: Release mount info memory after running background jobs - core/#26223
Core: Improve users page performance by not sorting after every add - core/#26234
Core: Escape special chars in some queries - core/#25429
Core: Redirect to two factor challenge page when only a single provider exists - core/#26134
Core: Fix bogus PasswordLoginForbidden DAV error when logging in as non-existing user - core/#26123
Core: Change the minimum log level to FATAL - core/#26131
Core: Fix issue with "(2)" appearing on shares when querying avatar with wrong casing - core/#26271
Core: Enabling an app now also analyzes dependencies at this time instead of only at install - core/#26295
Core: Reuse cached app info to avoid high load on some environments - core/#25603
Core: Show warning instead of exception when trying to run ownCloud on Windows - core/#26208
Core: Fix misleading SSL/TLS SMTP email configuration - core/#26447
Core: Fix malformed attribute in files app page - core/#26480
DAV: Improve chunk assembly performance for new DAV endpoint - core/#26062
DAV: New chunking now returns Etag and OC-Etag on the final MOVE - core/#25682
DAV: Do not print exception messages in HTML - core/#26460
DAV: Sanitize length headers when validating quota - core/#26366
Files: Allow uploading empty files in the web UI - core/#19116
Files: Properly translate file summary in lists - core/#26221
Files: Exclude more invalid chars in path - core/#26461
Sharing: Let the share owner increase permissions - core/#25542
Federation: Fix sharing with remote user names containing spaces - core/#25955
Federation: Save some memory in sync job by releasing mount info after each user - core/#26204
Federation: Fix federated address book syncing by using the correct background job name - core/#26202
CalDAV: Add Schedule and IMip plugins when receiving webdav v1 api calendar calls - core/#23600
CardDAV: Unset photo before setting a new one - core/#26242
CardDAV: Fix for birthday entries - core/#25636
CardDAV: Limit image export mime types - core/#26459
Updater: Fix web UI update in some environments - updater/#378
Updater: Retrigger integrity check after update - updater/#405
User_LDAP: Added OCC command to update group mappings - user_ldap/#14
User_LDAP: Fix issue with "(2)" appearing on shares when refreshing users in some scenarios - core/#25718
User_external: Double verify the SMB response - apps/#2198
Firstrunwizard: Only display the wizard when in files app - firstrunwizard/#52
Gallery: Do not display technical error messages - gallery/#707
Changes to squid-3.5.23 (16 Dec 2016):
- Bug 4627: fix generate-host-certificates and dynamic_cert_mem_cache_size docs
- Bug 4620: NetBSD build error with --enable-ipf-transparent
- Bug 4567: Strange IPv6 shown in access.log
- Bug 4406: SIGSEV in TunnelStateData::handleConnectResponse() during reconfigure and restart
- Bug 4174 partial: fix Write.cc:41 "!ccb->active()" assertion.
- Bug 4169: HIT marked as MISS when If-None-Match does not match
- Bug 4007: Hang on DNS query with dead-end CNAME
- Bug 4004 partial: Fix segfault via Ftp::Client::readControlReply
- Bug 3940 partial: hostHeaderVerify failures MISS when they should be HIT
- Bug 3533: Cache still valid after HTTP/1.1 303 See Other
- Bug 3379: Combination of If-Match and a Cache Hit result in TCP Connection Failure
- Bug 3290: authenticate_ttl not working for digest authentication
- Bug 2258: bypassing cache but not destroying cache entry
- HTTP/1.1: make Vary:* objects cacheable
- HTTP/1.1: Add registered codes entry for new 103 (Early Hints) status code
- Support IPv6 NAT with PF for NetBSD and FreeBSD
- TLS: Make key= before cert= an error instead of quietly hiding the issue
- ... and some debug updates
- ... and some build fixes
- ... and several documentation updates
Changelog:
#CVE-2016-9894: Buffer overflow in SkiaGL
#CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements
#CVE-2016-9895: CSP bypass using marquee tag
#CVE-2016-9896: Use-after-free with WebVR
#CVE-2016-9897: Memory corruption in libGLES
#CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
#CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs
#CVE-2016-9904: Cross-origin information leak in shared atoms
#CVE-2016-9901: Data from Pocket server improperly sanitized before execution
#CVE-2016-9902: Pocket extension does not validate the origin of events
#CVE-2016-9903: XSS injection vulnerability in add-ons SDK
#CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1
#CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6
use the extension .so, not ${RUBY_DLEXT}, because the files in case
are from the distribution package and therefore have a fixed extension
unrelated to the extension used on the local system. Fixes the
package build on Mac OS X.
Upstream changes:
2.24 Wed Dec 7 22:20:13 CST 2016
Official release. No changes from 2.23_01.
2.23_01 Tue Dec 6 22:48:56 CST 2016
[ENHANCEMENTS]
Added detection of unknown HTML entities, like "known &unclosed
&entities are not found". Also fixes the case where HTML::Lint
gets confused by an entity like "²" which it thought was an
unterminated "⊃" entity. Thanks, Klaus S. Madsen.
[FIXES]
Errors of the type doc-tag-required did not come out in any defined
order. They are now sorted by tag name. This was discovered
because hash randomization caused tests to fail on Perl 5.18 and
above. Thanks, Slaven Rezic, Andrew Main and Lisa Hare.
Handle some warnings that get thrown if certain values are undef.
Thanks, Yves Lavoie.
Handle characters that are not handled by HTML::Entities. (GitHub
issue #13) Thanks, Tim Landscheidt.
[INTERNALS]
Add a test to verify a fixed bug. Thanks to Lance Wicks as part of
the CPAN Pull Request Challenge.
