suhosin-patch is provided as modified one; only copyright year.
PHP 5.3.9 Released!
[10-Jan-2012] The PHP development team would like to announce the immediate
availability of PHP 5.3.9. This release focuses on improving the stability of
the PHP 5.3.x branch with over 90 bug fixes, some of which are security
related.
Security Enhancements and Fixes in PHP 5.3.9:
* Added max_input_vars directive to prevent attacks based on hash
collisions. (CVE-2011-4885)
* Fixed bug #60150 (Integer overflow during the parsing of invalid
exif header). (CVE-2011-4566)
Key enhancements in PHP 5.3.9 include:
* Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd
argument to is_a and is_subclass_of).
* Fixed bug #55609 (mysqlnd cannot be built shared)
* Many changes to the FPM SAPI module
For a full list of changes in PHP 5.3.9, see the ChangeLog. For source
downloads please visit our downloads page, Windows binaries can be found on
windows.php.net/download/.
All users are strongly encouraged to upgrade to PHP 5.3.9.
* Extract kterm-6.2.0.NFS-xauth.patch and kterm-6.2.0-termios-wd0.2.patch
from kterm-620-0213-20030825.diff.gz.
* Convert to use kterm-6.2.0.ext06.patch.gz.
** Drop Korean EUC mode.
** Add UTF-8 support.
** Improve JIS X0213 support.
- Bug Fixes
The following vulnerabilities have been fixed.
o wnpa-sec-2012-01
Laurent Butti discovered that Wireshark failed to properly
check record sizes for many packet capture file formats. (Bug
6663, bug 6666, bug 6667, bug 6668, bug 6669, bug 6670)
Versions affected: 1.4.0 to 1.4.10, 1.6.0 to 1.6.4.
o wnpa-sec-2012-02
Wireshark could dereference a NULL pointer and crash. (Bug
6634)
Versions affected: 1.4.0 to 1.4.10, 1.6.0 to 1.6.4.
o wnpa-sec-2012-03
The RLC dissector could overflow a buffer. (Bug 6391)
Versions affected: 1.4.0 to 1.4.10, 1.6.0 to 1.6.4.
The following bugs have been fixed:
o "Closing File!" Dialog Hangs. (Bug 3046)
o Sub-fields of data field should appear in exported PDML as
children of the data field instead of as siblings to it. (Bug
3809)
o Incorrect time differences displayed with time reference set.
(Bug 5580)
o Wrong packet type association of SNMP trap after TFTP
transfer. (Bug 5727)
o SSL/TLS decryption needs wireshark to be rebooted. (Bug 6032)
o Export HTTP Objects -> save all crashes Wireshark. (Bug 6250)
o Wireshark Netflow dissector complains there is no template
found though the template is exported. (Bug 6325)
o DCERPC EPM tower UUID must be interpreted always as little
endian. (Bug 6368)
o Crash if no recent files. (Bug 6549)
o IPv6 frame containing routing header with 0 segments left
calculates wrong UDP checksum. (Bug 6560)
o IPv4 UDP/TCP Checksum incorrect if routing header present.
(Bug 6561)
o Incorrect Parsing of SCPS Capabilities Option introduced in
response to bug 6194. (Bug 6562)
o Various crashes after loading NetMon2.x capture file. (Bug
6578)
o Fixed compilation of dumpcap on some systems (when
MUST_DO_SELECT is defined). (Bug 6614)
o SIGSEGV in SVN 40046. (Bug 6634)
o Wireshark dissects TCP option 25 as an "April 1" option. (Bug
6643)
o ZigBee ZCL Dissector reports invalid status. (Bug 6649)
o ICMPv6 DNSSL option malformed on padding. (Bug 6660)
o Wrong tvb_get_bits function call in packet-csn1.c. (Bug 6708)
o [UDP] - Length Field of Pseudo Header while computing CheckSum
is not correct. (Bug 6711)
o pcapio.c: bug in libpcap_write_interface_description_block.
(Bug 6719)
o Memory leaks in various dissectors.
o Bytes highlighted in wrong Byte pane when field selected in
Details pane.
- Updated Protocol Support
BGP, BMC CSN1, DCERPC EPM, DCP(ETSI) DMP DTLS GSM Management, H245
HPTEAM, ICMPv6, IEEE 802.15.4 IPSEC IPv4, IPv6, ISAKMP KERBEROS
LDSS NFS RLC, RPC-NETLOGON RRC RTMPT SIGCOMP SSL SYSLOG TCP, UDP,
XML ZigBee ZCL
- New and Updated Capture File Support
Accellent 5Views, AIX iptrace, HP-UX nettl, I4B, Microsoft Network
Monitor, Novell LANalyzer, PacketLogger, Pcap-ng, Sniffer,
Tektronix K12, WildPackets {Airo,Ether}Peek.
===============================================================================
Changes in 1.4.1
===============================================================================
# OVERALL: Several improvements to the ARMCI API implementation
within MPICH2.
# Build system: Added beta support for DESTDIR while installing
MPICH2.
# PM/PMI: Upgrade hwloc to 1.2.1rc2.
# PM/PMI: Initial support for the PBS launcher.
# Several other minor bug fixes, memory leak fixes, and code cleanup.
A full list of changes is available using:
svn log -r8675:HEAD https://svn.mcs.anl.gov/repos/mpi/mpich2/tags/release/mpich2-1.4.1
... or at the following link:
https://trac.mcs.anl.gov/projects/mpich2/log/mpich2/tags/release/mpich2-1.4.1?action=follow_copy&rev=HEAD&stop_rev=8675&mode=follow_copy
===============================================================================
Changes in 1.4
===============================================================================
# OVERALL: Improvements to fault tolerance for collective
operations. Thanks to Rui Wang @ ICT for reporting several of these
issues.
# OVERALL: Improvements to the universe size detection. Thanks to
Yauheni Zelenko for reporting this issue.
# OVERALL: Bug fixes for Fortran attributes on some systems. Thanks
to Nicolai Stange for reporting this issue.
# OVERALL: Added new ARMCI API implementation (experimental).
# OVERALL: Added new MPIX_Group_comm_create function to allow
non-collective creation of sub-communicators.
# FORTRAN: Bug fixes in the MPI_DIST_GRAPH_ Fortran bindings.
# PM/PMI: Support for a manual "none" launcher in Hydra to allow for
higher-level tools to be built on top of Hydra. Thanks to Justin
Wozniak for reporting this issue, for providing several patches for
the fix, and testing it.
# PM/PMI: Bug fixes in Hydra to handle non-uniform layouts of hosts
better. Thanks to the MVAPICH group at OSU for reporting this issue
and testing it.
# PM/PMI: Bug fixes in Hydra to handle cases where only a subset of
the available launchers or resource managers are compiled
in. Thanks to Satish Balay @ Argonne for reporting this issue.
# PM/PMI: Support for a different username to be provided for each
host; this only works for launchers that support this (such as
SSH).
# PM/PMI: Bug fixes for using Hydra on AIX machines. Thanks to
Kitrick Sheets @ NCSA for reporting this issue and providing the
first draft of the patch.
# PM/PMI: Bug fixes in memory allocation/management for environment
variables that was showing up on older platforms. Thanks to Steven
Sutphen for reporting the issue and providing detailed analysis to
track down the bug.
# PM/PMI: Added support for providing a configuration file to pick
the default options for Hydra. Thanks to Saurabh T. for reporting
the issues with the current implementation and working with us to
improve this option.
# PM/PMI: Improvements to the error code returned by Hydra.
# PM/PMI: Bug fixes for handling "=" in environment variable values in
hydra.
# PM/PMI: Upgrade the hwloc version to 1.2.
# COLLECTIVES: Performance and memory usage improvements for MPI_Bcast
in certain cases.
# VALGRIND: Fix incorrect Valgrind client request usage when MPICH2 is
built for memory debugging.
# BUILD SYSTEM: "--enable-fast" and "--disable-error-checking" are once
again valid simultaneous options to configure.
# TEST SUITE: Several new tests for MPI RMA operations.
# Several other minor bug fixes, memory leak fixes, and code cleanup.
A full list of changes is available using:
svn log -r7838:HEAD https://svn.mcs.anl.gov/repos/mpi/mpich2/tags/release/mpich2-1.4
... or at the following link:
https://trac.mcs.anl.gov/projects/mpich2/log/mpich2/tags/release/mpich2-1.4?action=follow_copy&rev=HEAD&stop_rev=7838&mode=follow_copy
===============================================================================
Changes in 1.3.2
===============================================================================
# OVERALL: MPICH2 now recognizes the OSX mach_absolute_time as a
native timer type.
# OVERALL: Performance improvements to MPI_Comm_split on large
systems.
# OVERALL: Several improvements to error returns capabilities in the
presence of faults.
# PM/PMI: Several fixes and improvements to Hydra's process binding
capability.
# PM/PMI: Upgrade the hwloc version to 1.1.1.
# PM/PMI: Allow users to sort node lists allocated by resource
managers in Hydra.
# PM/PMI: Improvements to signal handling. Now Hydra respects Ctrl-Z
signals and passes on the signal to the application.
# PM/PMI: Improvements to STDOUT/STDERR handling including improved
support for rank prepending on output. Improvements to STDIN
handling for applications being run in the background.
# PM/PMI: Split the bootstrap servers into "launchers" and "resource
managers", allowing the user to pick a different resource manager
from the launcher. For example, the user can now pick the "SLURM"
resource manager and "SSH" as the launcher.
# PM/PMI: The MPD process manager is deprecated.
# PM/PMI: The PLPA process binding library support is deprecated.
# WINDOWS: Adding support for gfortran and 64-bit gcc libs.
# Several other minor bug fixes, memory leak fixes, and code cleanup.
A full list of changes is available using:
svn log -r7457:HEAD https://svn.mcs.anl.gov/repos/mpi/mpich2/tags/release/mpich2-1.3.2
... or at the following link:
https://trac.mcs.anl.gov/projects/mpich2/log/mpich2/tags/release/mpich2-1.3.2?action=follow_copy&rev=HEAD&stop_rev=7457&mode=follow_copy
Gruber's SmartyPants plugin for various CMSs.
SmartyPants is a web publishing utility that translates plain ASCII
punctuation characters into "smart" typographic punctuation HTML
entities. SmartyPants can perform the following transformations:
* Straight quotes ( " and ' ) into "curly" quote HTML entities
* Backticks-style quotes (``like this'') into "curly" quote HTML entities
* Dashes (-- and ---) into en- and em-dash entities
* Three consecutive dots (...) into an ellipsis entity
Thomas's problem might be modular-vs-native-x11 related. To address this,
I've explicitely disabled freetype in the !x11 case so that a native
one doesn't get picked up.
Changes from previous:
----------------------
0.91: 17 May 2011
- Support calling commands noninteractively (patch by Christian Kuelker)
- Support calling $term->run() multiple times (patch by Ryan Gies)
- Now clients can call process_a_cmd manually (patch by Martin Kluge)
- Undeprecate Term::ReadLine::Perl since it works on Windows.
0.9: 20 Mar 2011
- Relicensed from the somewhat ambiguous Perl license to the MIT license.
- Add eof_exit_hooks, patch by Lester Hightower
- Remove complete_history callback. It was an odd, ShellUI-specific feature.
- Remove history expansion (!!, !$, ^o^n). That implementation was too buggy.
- Fix bug: completion suggestion wasn't printed with Term::ReadLine::Gnu.
- Deprecate Term::ReadLine::Perl. Use Term::ReadLine::Gnu.
New in version 1.0.55
* enhancements to building SBCL using make.sh:
+ --fancy can be specified to enable all supported feature
enhancements.
+ --with-<feature> and --without-<feature> can be used to
specify which features to build with.
+ --arch option can be used to specify the architecture to
build for. (Mainly useful for building 32-bit SBCL's on
x86-64 hosts, not full-blows cross-compilation.)
* enhancement: extended package prefix syntax
<pkgname>::<form-in-package> which allows specifying name
of the default interning package for the whole form.
* enhancement: when *READ-EVAL* is true, arrays with element
type other than T can be printed readably using #.-based
syntax. (Thanks to Robert Brown)
* enhancement: MAKE-ALIEN signals a storage-condition instead
of returning a null alien when malloc() fails. (#891268)
* enhancement: SB-EXT:PRINT-UNREADABLY restart for
PRINT-NOT-READABLE conditions can be conveniently accessed
through function with the same name, analogously to CONTINUE.
* enhancement: SB-EXT:*SUPPRESS-PRINT-ERRORS* can be used to
suppress errors from the printer by type, causing an error
marker to be printed instead. (Thanks to Attila Lendvai)
* enhancement: BACKTRACE and DESCRIBE now bind *PRINT-CIRCLE*
to T, and generally behave better when errors occur during
printing.
* enhancement: the test runner now takes a --report-skipped-tests
argument to report the individual tests skipped as well as the
number of skipped tests.
* enhancement: undefined functions now appear in backtraces as
("undefined function") instead of ("bogus stack frame") on
x86oids.
* enhancement: detected deadlocks no longer cause stderr to be
spammed, and deadlock errors are reported in an easier-to-decipher
manner.
* enhancement: DESCRIBE on type designators reports the
expansion in more cases.
* enhancement: SBCL now provides either an explicit :BIG-ENDIAN
or :LITTLE-ENDIAN in *FEATURES*, instead of :BIG-ENDIAN being
implied by lack of the :LITTLE-ENDIAN feature. (Thanks to
Luis Oliveira, #901661)
* enhancement: better disassembly of segment-prefixes on x86
and other instruction prefixes (e.g. LOCK) on x86 and x86-64.
* optimization: FIND and POSITION on bit-vectors are orders of
magnitude faster (assuming KEY and TEST are not used, or are
sufficiently trivial.)
* optimization: SUBSEQ on vectors of unknown element type is
substantially faster. (#902537)
* optimization: specialized arrays with non-zero :INITIAL-ELEMENT
can be stack-allocated. (#902351)
* optimization: the compiler is smarter about representation
selection for floating point constants used in full calls.
* optimization: the compiler no longer refuses to coerce large
fixnums to single floats inline, except on x86 where this
limitation is still necessary.
* bug fix: deadlock detection could report the same deadlock
twice, for two different threads. Now a single deadlock is
reported exactly once.
* bug fix: interval-arithmetic division during type derivation
did not account for signed zeros.
* bug fix: compiler error when typechecking a call to a
function with non-constant keyword arguments.
* bug fix: misoptimization of TRUNCATE causing erratic behaviour.
* bug fix: condition slot accessors no longer cause undefined
function style-warnings when used in the :REPORT clause of
the DEFINE-CONDITION form that defines them. (#896379)
* bug fix: DEFGENERIC warns about unsupported declarations, as
specified by ANSI. (#894202)
* bug fix: SUBTYPEP tests involving forward-referenced classes
no longer bogusly report NIL, T.
* bug fix: bogus style-warnings for DEFMETHOD forms that both
declared some required arguments ignored and performed
assignments to others. (#898331)
* bug fix: *EVALUATOR-MODE* :COMPILE treated (LET () ...)
identically to (LOCALLY ...) leading to internally
inconsistent toplevel-formness.
* bug fix: non-toplevel DEFSTRUCT signaled a style warning for
unknown type.
* bug fix: redefining a function whose previous definition
contained an unknown type no longer causes a style-warning. (#806243)
* bug fix: undefined functions now appear in backtraces as
("undefined function") instead of ("bogus stack frame") on non-x86oids.
* bug fix: backtraces are no longer cut off at ("undefined
function") when called under certain circumstances (involving a
caller-allocated stack frame) on PPC.
* bug fix: RUN-PROGRAM leaked a file-descriptor per call on
non-Windows systems. (regression since 1.0.53)
* bug fix: GC deadlocks from dladdr() on certain platforms.
* bug fix: broken standard streams no longer automatically
cause recursive errors on debugger entry.
* bug fix: build ignored --dynamic-space-size=<size> argument
to make.sh (regression since 1.0.53)
* bug fix: attempts to stack allocate a required argument to a
function with an external entry point caused compiler-errors.
* bug fix: compiler notes for failed stack allocation for a
function argument no longer claim to be unable to stack
allocate the function.
* bug fix: COERCE now signals a type-error on several
coercions to subtypes of CHARACTER that are forbidden
according to ANSI. (#841312)
* bug fix: missing failure-to-stack-allocate compiler notes
for some forms of MAKE-ARRAY with dynamic-extent. (#902351)
* bug fix: some of the compile-time side-effects of DEFCLASS
were not caught by package locks.
