Fix for CVE-2017-12836

(tez)

Fix for CVE-2017-12836

(tez)

Update mit-krb5 to 1.14.5 and patch for CVE-2017-11368

(tez)

Update to 1.14.5 and patch for CVE-2017-11368

(tez)

Add patchsum for previous.

(schmonz)

Avoid unportable "rm -v".

(schmonz)

Build on systems without O_DIRECTORY.

(schmonz)

Updated graphics/gnuplot, textproc/py-tinycss2; Added devel/py-test-cache, devel/py-test-isort, devel/py-test-flake8, databases/py-unicodecsv, www/py-django-sql-explorer

(adam)

SQL Explorer aims to make the flow of data between people fast, simple, and
confusion-free.

Quickly write and share SQL queries for any Django app in a simple, usable SQL
editor, preview the results in the browser, share links to download CSV files,
and keep the information flowing!

Explorer values simplicity, intuitive use, unobtrusiveness, stability, and the
principle of least surprise.

Django SQL Explorer is inspired by any number of great query and reporting
tools out there.

(adam)

The unicodecsv is a drop-in replacement for Python 2.7's csv module which
supports unicode strings without a hassle.

(adam)

Revert wrong import

(adam)

Removed unused patch-src_SquidNew.cc

(adam)

The unicodecsv is a drop-in replacement for Python 2.7's csv module which
supports unicode strings without a hassle.

(adam)

Version 0.6
* Don't allow identifiers starting with two dashes.
* Don't use Tox for tests.
* Follow semantic versioning.

(adam)

pytest plugin to check FLAKE8 requirements.
After installing it, when you run tests with the option:
    py.test --flake8
every file ending in .py will be discovered and checked with flake8.

(adam)

py.test plugin to check import ordering using isort.

(adam)

The plugin provides two options to rerun failures, namely --lf to only re-run
the failures and --ff to run all tests but the failures from the last run
first. For cleanup (usually not needed), a --clearcache option allows to
remove all cross-session cache contents ahead of a test run.

(adam)

Changes in 5.0.7
NEW set term {pngcairo|pdfcairo} pointscale <factor>
NEW "save fit" back-ported from version 5.2 as a replacement for "update"
CHANGE deprecate "update" command (but do not remove it)
CHANGE allow placement of circles in 3D plots using axis coordinates
CHANGE ignore invalid z coordinate for 3D objects placed in "set view map"
CHANGE distinguish 'bind "shift-Button1"' from 'bind "Button1"'
CHANGE use Mingw-w64 and MSVC popen rather than built-in "fake" popen
FIX rangelimited y2 axis could produce spurious diagonal line across plot
FIX assignment of x/y dimensions in "binary record=(a,b) ... with image"
FIX negative array index caused by hidden3d degenerate polygon
FIX object clipping in "set view map"
FIX cairo terminals: scale textbox border linewidth by terminal linewidth
FIX canvas terminal: initialization of plot dimensions (affects first zoom)
FIX crash in stats if no usable data is found
FIX do not use LaTeX formatting in tabular output
FIX additional sanity checks for input data format
FIX more consistent handling of plot 'with table'
FIX incorrect, possibly empty, command string was saved for previous fit
FIX 2D images with logscale axes could fail (segfault)
FIX nested iteration containing an empty range

(adam)

Set HAS_SYSTEM_ASPRINTF in make env to fix build on NetBSD 8

(jmcneill)

Fix build on SunOS.  Patches submitted by Thomas Merkel in NetBSD/pkgsrc#9

(jperkin)

Updated devel/p5-Config-GitLike to 1.17

(mef)

Updated devel/p5-Config-GitLike to 1.17
---------------------------------------
1.17 2017-07-16
- Read and write files with non-UNIX-newlines
- Filter multiple values correctly when using `get_regexp`
- Throw an error when `get` is passed no section
- Perl 5.28.0 compatibility, by pushing '.' into @INC in Makefile.PL
  for Module::Install

(mef)

Added devel/ruby-ronn version 0.7.3

(nils)

Add & enable ruby-ronn

(nils)

Initial import of ruby-ronn, version 0.7.3, into pkgsrc.

Ronn builds manuals. It converts simple, human readable textfiles
to roff for terminal display, and also to HTML for the web.
The source format includes all of Markdown but has a more rigid
structure and syntax extensions for features commonly found in
manpages (definition lists, link notation, etc.).
The ronn-format(7) manual page defines the format in detail.

(nils)

Updated devel/p5-Config-AutoConf to 0.315

(mef)

Updated devel/p5-Config-Autoconf to 0.315
-----------------------------------------
0.315  2017-08-02
        - add check_builtin
        - perltidy code and add perltidy test (taken from MooX::Options)
        - ensure for many check_* methods that externally controlled
          ac_av_* environment variables are correctly passed into config.h
        - fix check_dirent_header to cache proving header and proving
          availability of 'DIR *' in such a header separately

(pkgsrc changes)
- Remove tweak lines for configure
| ALL_ENV+=    TMPDIR=${WRKDIR}/tmp
|
| pre-configure:
|        ${MKDIR} ${WRKDIR}/tmp

(mef)

mk/emulator: Move Linux shlibs task settings to package Makefiles.

Move the definitions of LDCONFIG_ADD_CMD and LDCONFIG_REMOVE_CMD
into suse_linux/emulator.mk.  The commands are specific to the
Linux installed, including the path to ldconfig(8), so localize
them to the package that provides it.

Move the definition of RUN_LDCONFIG out of the emulator framework
and into the packages that use them as RUN_LDCONFIG is meant to be
a package-settable variable.

Fix the path to the Linux ldconfig(8) that was used on FreeBSD to
brand the ELF format that has been incorrect for over 10 years.

In the suse_base packages, explicitly set LDCONFIG_REMOVE_CMD to
${TRUE} since the ldconfig(8) command is provided by that package
and can't be invoked at the postremove stage because it has already
been deleted from the system by then.

Bump the PKGREVISION of all the suse_base packages because the
install scripts have changed.

Bump the PKGREVISIONs of the darwin_lib and osf1_lib packages
because the install scripts no longer try to run ldconfig(8),
which is not provided in either OpenDarwin or OSF/1.

(jlam)

mk/pkgformat: Support INSTALL scripts that rely on UNPACK.

The pkginstall framework had an UNPACK action invoked early
in the PRE-INSTALL stage to unpack scriplets that were invoked
in later stages to perform extra work for installation, removal,
or both.

Add an UNPACK action that is a no-op for any scripts that don't
support the action.

(jlam)

Added textproc/ruby-rdiscount version 2.2.0.1

(nils)

add & enable ruby-rdiscount

(nils)

Initial import of ruby-rdiscount, version 2.2.0.1, into pkgsrc.

RDiscount converts documents in Markdown syntax to HTML.
It uses the excellent Discount processor by David Loren Parsons
for this purpose, and thereby inherits Discount's numerous useful
extensions to the Markdown language.

(nils)

Added devel/ruby-mustache version 1.0.5

(nils)

add & enable ruby-mustache

(nils)

Initial import of ruby-mustache, version 1.0.5, into pkgsrc.

Inspired by ctemplate and et, Mustache is a framework-agnostic way
to render logic-free views.
As ctemplates says, "It emphasizes separating logic from presentation:
it is impossible to embed application logic in this template language."
For a list of implementations (other than Ruby) and tips, see
http://mustache.github.io/.

(nils)

Updated www/py-django-reversion to 2.0.10

(adam)

2.0.10:
- Bugfix: Handling case of `None` user in request (@pawelad).
- Documentation corrections (@danielquinn).
- Bugfix: "invalid literal for int() with base 10: 'None'" for unversioned admin inline relations.

  If, after updating, you still experience this issue, run the following in a Django shell:

  .. code::

      from reversion.models import Version
      Version.objects.filter(object_id="None").delete()

  **Important:** Ensure that none of your versioned models contain a string primary key where `"None"` is a valid value
  before running this snippet!

(adam)

Note update of net/unbound to 1.6.5.

(he)

Improve patch comment, requested by joerg.

(jperkin)

Upgrade unbound to version 1.6.5.

Upstream changes:
  21 Aug 2017: Wouter
    - Fix install of trust anchor when two anchors are present, makes both
      valid.  Checks hash of DS but not signature of new key.  This fixes
      installs between sep11 and oct11 2017.
    - Tag 1.6.5

(he)

Updated sysutils/salt to 2017.7.1

(sborrill)

Update to 2017.7.1. Changelog here:
https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html

Includes a fix for CVE-2017-12791

(sborrill)

Fix -Wreserved-user-defined-literal failure using patch from Gentoo.

(jperkin)

Updated www/nghttp2 to 1.25.0, archivers/zstd to 1.3.1, www/squid3 to 3.5.27

(adam)

Squid 3.5.27:
Fix build on FreeBSD after rev.14180
Bug 4464: Reduce "!Comm::MonitorsRead(serverConnection->fd)" assertions.
Fix mgr query handoff from the original recipient to Coordinator.
Fix message packing error handling in mgr and snmp SMP Forwarders.
basic_ncsa_auth: fix hash listing wrap in man(8) page
Bug 4687: Wrong names of components in man page, section SEE ALSO
Bug 4112: ssl_engine does not accept cryptodev
Bug 4671 pt3: various GCC 7 compile errors
Replace new/delete operators using modern C++ rules.
Bug 4671 pt2: GCC 7: raise FTP Gateway CTRL channel buffer to 16KB
SourceFormat Enforcement
Bug 2833 pt3: Do not respond with HTTP/304 to unconditional requests
Bug 2833 pt2: Collapse internal revalidation requests (SMP-unaware caches), again.

(adam)

Zstandard v1.3.1
New license : BSD + GPLv2
perf: substantially decreased memory usage in Multi-threading mode
perf: Multi-threading supports up to 256 threads. Cap at 256 when more are requested
cli : improved and fixed --list command
cli : command -vV lists supported formats
build : fixed binary variants
build : fix Visual compilation for non x86/x64 targets
API exp : breaking change : ZSTD_getframeHeader() provides more information
API exp : breaking change : pinned down values of error codes
doc : fixed huffman example
new : contrib/adaptive-compression, I/O driven compression strength
new : contrib/long_distance_matching
updated : contrib/linux-kernel

(adam)

nghttp2 v1.25.0
lib: add nghttp2_rcbuf_is_static()
nghttpx: Fix bug that forwarded for is not affected by proxy protocol
nghttpx: Update mruby to 1.3.0

(adam)

print/cups{,15}: Don't make ${CUPS_CONFDIR} with INSTALLATION_DIRS.

${CUPS_CONFDIR} (${PKG_SYSCONFDIR}) may be located outside of
${PREFIX}, which causes a installation failure due to the checks
added in mk/install/install.mk.

Remove ${CUPS_CONFDIR} from INSTALLATION_DIRS since it is created
by the package install script at PRE-INSTALL time.

Fixes pkg/52481 reported by Hauke Fath.

(jlam)

databases/percona-toolkit: Remove ${WRKDIR} references in scripts.

Several Perl-generated scripts were installed with the interpreter
being in the tools directory.  Use subst.mk to fix the interpreter
path at the head of these scripts.  Add "sh" as a run-time tool
dependency since several of the scripts installed require a POSIX
shell.

Bump the PKGREVISION due to changes in the installed scripts.

(jlam)

Never use writable text segments on i386. Bump revision.

(joerg)

Updated chat/ejabberd to 17.08

(fhajny)

Update chat/ejabberd to 17.08.

Core
- Erlang/OTP 17.5 or higher is required, and 20 is now supported
- Make ejabberd_cluster modular
- Replace gen_fsm with p1_fsm to avoid warnings in OTP20+
- Fix clustering table reg_users_counter
- ext_mod: Update spec from custom and allow modules dependencies
- extauth.py: Fix to support : in passwords
- Set high water mark in lager for all backends
- Fix old route record in mnesia窶冱 route table haven窶冲 been remove
  when restarting in some cases
- ejabberd_cluster*.erl: Add copyright and fix description
- Add support of rfc6120 section 4.9.3.16 on node shutdown

Configuration
- ejabberd_c2s: Fix priority of 窶歪ertfile窶� option
- Introduce 窶鷲osts窶� modules option
- Fix ERLANG_OPTS, INET_DIST_INTERFACE and FIREWALL_WINDOW option
- Remove unused 窶藁anagers窶� option, related to the deferred XEP-0321

Commands
- Fix errors when running ejabberdctl as root
- Fix set_presence command to work in recent ejabberd
- Rename stop_all_connections to stop_s2s_connections for consistency
- Change policy of user_resources command, from user to admin
- Remove old command calling interface
- Describe more command arguments and results

Modules
- mod_http_api: Use hide_sensitive_log_data option when registering
  users
- mod_http_fileserver: Request basic auth dialog from browser
- mod_muc: Fix nick bug with MUC on riak
- mod_muc: new hooks
- mod_push: Support XEP-0357: Push Notifications
- mod_push_keepalive: New module

PubSub/PEP
- Keep disco#info on PEP compatible with XEP-0060
- Preliminary export PubSub data from Mnesia tables to SQL file
- Fix PubSub send last published items
- Fix PEP node removal
- Fix PEP node identity
- Fix disco#items on PEP service
- Fix getting cached last item
- Add import of PEP from prosody

(fhajny)

Updated devel/erlang-cache_tab to 1.0.10

(fhajny)

Update devel/erlang-cache_tab to 1.0.10.

- Fix hex packaging

(fhajny)

Updated net/erlang-esip to 1.0.15

(fhajny)

Update net/erlang-esip to 1.0.15.

Version 1.0.15
- Updating stun to version 1.0.14.
- Updating fast_tls to version 1.0.15.

Version 1.0.14
- Updating fast_tls to version 1.0.14.
- Updating stun to version 1.0.13.

(fhajny)

Updated net/erlang-stun to 1.0.14

(fhajny)

Update net/erlang-stun to 1.0.14.

Version 1.0.14
- Updating fast_tls to version 1.0.15.

Version 1.0.13
- Updating fast_tls to version 1.0.14.
- Make test not crash on R20

(fhajny)

Updated security/erlang-p1_oauth2 to 0.6.2

(fhajny)

Update security/erlang-p1_oauth2 to 0.6.2.

- Make tests works with erlang R20
- Fix Travis-CI compilation

(fhajny)

Updated net/erlang-xmpp to 1.1.14

(fhajny)

Update net/erlang-xmpp to 1.1.14.

- Update hex packaging
- Fix namespace in PubSub publishing options

(fhajny)

Updated security/erlang-fast_tls to 1.0.15

(fhajny)

Update security/erlang-fast_tls to 1.0.15

Version 1.0.15
- Fix Hex packaging

Version 1.0.14
- Improve ECDH curve handling (thanks to user pitchum)
- Fix bug in handling protocol_options option

(fhajny)

Fix nagios unability to cleanup checkresults directory

From upstream https://github.com/NagiosEnterprises/nagioscore/pull/417

Once nagios is done with a file in the checkresults directory,
it deletes it. This was done with a relative file path, causing
failures if nagios working directory is not the checkresults
directory. As a consequence, old result file remained intact,
causing system slowdowns as the directory grew and nagios spent
more and more time attempting to clean it up.

The fix is just to use an absolute path, so that it works
regardeless of current directory setting.

(manu)

Updated net/nagios-plugin-dnsrbl to 0.3

(manu)

Update nagios-plugin-dnsrbl to 0.3
- multithreaded DNS lookups to reduce latency
- updated built-in DNSRBL list

(manu)

Updated www/p5-HTTP-Cache-Transparent to 1.4

(wen)

Update to 1.4

Upstream changes:
2017-04-07 Mattias Holmlund

  Version 1.4

    Fix tests when run without internet connectivity. Patch by Mike Parker.
    Fixes https://rt.cpan.org/Ticket/Display.html?id=120584

2017-03-11 Mattias Holmlund

  Version 1.3

    Added missing Changes entry for version 1.2. No other changes.

2017-03-07 Mattias Holmlund

  Version 1.2

    Add X-No-Server-Contact header when the content returned has been
      delivered without any contact with the external server

(wen)

Updated www/p5-HTML-Scrubber to 0.17

(wen)

Update to 0.17

Upstream changes:
0.17      2017-06-27 14:03:47+01:00 Europe/London

0.16      2017-06-25 20:30:15+01:00 Europe/London (TRIAL RELEASE)
    - Add missing testing prereqs  (github pr#9 paultcochrane)
    - Extend list of Perls in Travis config  (github pr#10 paultcochrane)
    - Avoid pod-spell test failure from ABSTRACT text  (github pr#11 paultcochrane)
    - Minor documentation fixes  (github pr#12 paultcochrane)
    - Purge trailing whitespace in Travis config    (github pr#13 paultcochrane)
    - Fix perlcritic issues  (github pr#14 paultcochrane)
    - Fix stale URLs  (github pr#15 paultcochrane)
    - Remove invalid end tags for empty elements (RT120384)
      (github pr#16 paultcochrane)
    - Rework Dist::Zilla config to be more portable

(wen)

Update to netqmail-1.06-qbiffutmpx-20170820.patch. Should fix EL7 bulk
build. No functional change elsewhere.

(schmonz)

Updated textproc/py-markdown to 2.6.9, archivers/lz4 to 1.8.0

(adam)

LZ4 v1.8.0
cli : fix : do not modify /dev/null permissions, reported by @Maokaman1
cli : added GNU separator -- specifying that all following arguments are files
cli : restored -BX command enabling block checksum
API : added LZ4_compress_HC_destSize(), by @remittor
API : added LZ4F_resetDecompressionContext()
API : lz4frame : negative compression levels trigger fast acceleration, request by @llchan
API : lz4frame : can control block checksum and dictionary ID
API : fix : expose obsolete decoding functions, reported by @cyfdecyf
API : experimental : lz4frame_static.h : new dictionary compression API
build : fix : static lib installation, by @ido
build : dragonFlyBSD, OpenBSD, NetBSD supported
build : LZ4_MEMORY_USAGE can be modified at compile time, through external define
doc : Updated LZ4 Frame format to v1.6.0, restoring Dictionary-ID field in header
doc : lz4's API manual in .html format, by @inikep

(adam)

version 2.6.9:
a bug-fix release

(adam)

Updated devel/py-hypothesis to 3.18.5, devel/py-typing to 3.6.2

(adam)

Sync with Python 3.6.2

(adam)

Depend on py-typing only for Python < 3.6

(adam)

Re-written backports.abc condition for Python < 3.5

(adam)

3.18.5:
This is a bugfix release for ~hypothesis.strategies.integers. Previously the strategy would hit an internal assertion if passed non-integer bounds for min_value and max_value that had no integers between them. The strategy now raises InvalidArgument instead.

(adam)

- stow 2.2.2 (updated by <markd> on 2017-01-19)

(leot)

Add LICENSE (GNU GPL 2)

While here also indent some definitions (NFC).

(leot)

Add xmlto build dependency to i3 since it is used to build the docs.
While here sort the buildlink3 entries.

(nros)

Updated emulators/PC6001VX to 2.31.0

(tsutsui)

Update PC6001VX to 2.31.0.

Upstream changes:

2.31.0 2017/08/19

* make file dialog and setting dialog fullscreen for low resolution devices
  when the ALWAYSFULLSCREEN flag is specified on build
* fix sound call method which was not thread safe
* rewrite documents with asciidoc
* (Windows) update build procedure
  make 64 bit version buildable
  recommend to use fixed MSYS2 version
  PATH setting no longer necessary
* (UNIX) fix pro file to build on non-Linux UNIX systems
* (non Windows) use absolute path for config files etc.
* (Android) temporary workaround for access issue of file access on a SD card

(tsutsui)

Fix xine detection from disabling PaX MPROTECT for conftest test program
during configure stage

* Fix packageing on NetBSD/i386 (8.99.1)
  Original problem is reported by mlh

(ryoon)

Updated multimedia/ffmpeg2 to 2.8.12nb1

(ryoon)

Disable Pax MPROTECT for bin/ffmpeg2 on NetBSD/i386 (8.99.1)

* Bump PKGREVISION

(ryoon)

Updated shells/fish to 2.6.0

(fhajny)

Update shells/fish to 2.6.0.

Notable fixes and improvements:

- Jobs running in the background can now be removed from the list
  of jobs with the new disown builtin, which behaves like the same
  command in other shells.
- Command substitutions now have access to the terminal, like in
  other shells. This allows tools like fzf to work properly.
- In cases where the operating system does not report the size of
  the terminal, the COLUMNS and LINES environment variables are
  used; if they are unset, a default of 80x24 is assumed.
- New French and improved German translations.
- fish no longer depends on the which external command.

For full release notes see:

  http://www.fishshell.com/release_notes.html

(fhajny)

Updated mail/thunderbird-l10n to 52.3.0

(ryoon)

Update to 52.3.0

* Sync with mail/thunderbird-52.3.0

(ryoon)

Updated mail/thunderbird to 52.3.0

(ryoon)

Update to 52.3.0

Changelog:
    Fixed
    Unwanted inline images shown in rogue SPAM messages

    Fixed
    Deleting message from the POP3 server not working when maildir storage was used

    Fixed
    Message disposition flag (replied / forwarded) lost when reply or forwarded message was stored as draft and draft was sent later

    Fixed
    Inline images not scaled to fit when printing

    Fixed
    Selected text from another message sometimes included in a reply

    Fixed
    No authorisation prompt displayed when inserting image into email body although image URL requires authentication

    Fixed
    Large attachments taking a long time to open under some circumstances

    Fixed
    Various security fixes

(ryoon)

Updated www/firefox52-l10n to 52.3.0

(ryoon)

Update to 52.3.0

* Sync with www/firefox-52.3.0

(ryoon)

Updated www/firefox52 to 52.3.0

(ryoon)

Update to 52.3.0

Changelog:
#CVE-2017-7798: XUL injection in the style editor in devtools

Reporter
    Frederik Braun
Impact
    critical

Description

The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool.
References

    Bug 1371586, 1372112

#CVE-2017-7800: Use-after-free in WebSockets during disconnection

Reporter
    Looben Yang
Impact
    critical

Description

A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash.
References

    Bug 1374047

#CVE-2017-7801: Use-after-free with marquee during window resizing

Reporter
    Nils
Impact
    critical

Description

A use-after-free vulnerability can occur while re-computing layout for a marquee element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash.
References

    Bug 1371259

#CVE-2017-7809: Use-after-free while deleting attached editor DOM node

Reporter
    Nils
Impact
    high

Description

A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash.
References

    Bug 1380284

#CVE-2017-7784: Use-after-free with image observers

Reporter
    Nils
Impact
    high

Description

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash.
References

    Bug 1376087

#CVE-2017-7802: Use-after-free resizing image elements

Reporter
    Nils
Impact
    high

Description

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed.
References

    Bug 1378147

#CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM

Reporter
    Nils
Impact
    high

Description

A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash.
References

    Bug 1356985

#CVE-2017-7786: Buffer overflow while painting non-displayable SVG

Reporter
    Nils
Impact
    high

Description

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash.
References

    Bug 1365189

#CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements

Reporter
    SkyLined
Impact
    high

Description

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data.
References

    Bug 1353312

#CVE-2017-7787: Same-origin policy bypass with iframes through page reloads

Reporter
    Oliver Wagner
Impact
    high

Description

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure.
References

    Bug 1322896

#CVE-2017-7807: Domain hijacking through AppCache fallback

Reporter
    Mathias Karlsson
Impact
    high

Description

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory.
References

    Bug 1376459

#CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID

Reporter
    Fraser Tweedale
Impact
    high

Description

A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash.
References

    Bug 1368652

#CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher

Reporter
    Stephen Fewer
Impact
    high

Description

The destructor function for the WindowsDllDetourPatcher class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation.
Note: This attack only affects Windows operating systems. Other operating systems are not affected.
References

    Bug 1372849

#CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts

Reporter
    Jose Mar鱈a Acu単a
Impact
    moderate

Description

On pages containing an iframe, the data: protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content.
References

    Bug 1365875

#CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections

Reporter
    Arthur Edelstein
Impact
    moderate

Description

An error in the WindowsDllDetourPatcher where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP his attack only affects Windows operating systems. Other operating systems are not affected.
References

    Bug 1344034

#CVE-2017-7803: CSP containing 'sandbox' improperly applied

Reporter
    Rhys Enniks
Impact
    moderate

Description

When a page��er directives are ignored. This results in the incorrect enforcement of CSP.
References

    Bug 1377426

#CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3

Reporter
    Mozilla developers and community
Impact
    critical

Descrlla developers and community members Masayuki Nakano, Gary Kwong, Ronald Crane, Andrew McCreight, Tyson Smith, Bevis Tseng, Christian Holler, Bryce Van Dyk, Dragana Damjanovic, Kartikaya Gupta, Philipp, Tristan Bourvon, and Andi-Bogdan Postelnicu reported presume that with enough effort that some of these could be exploited to run arbitrary code.
References

    Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3

(ryoon)

Fix TEXLIVE_REV

(markd)

Updated pkgtools/pkgtasks to 1.14.

(jlam)

mk/pkgtasks: Fix postinstall check to not skip last set of files.

The postinstall check was improperly skipping the last N items
listed in CONF_FILES (and related) variables when verifying that
there is a multiple of N items listed.  Fix the bounds check.

(jlam)

mk/pkgtasks: Sometimes avoid error if source files don't exist.

The shell code used to check for the existence of the source files
listed in the various CONF_FILES (and related) variables has been
refactored out into a separate macro variable.  In addition, the
macro has been modified to only emit a warning if the source file
is not in ${PREFIX} and can't be found on the host system.

This supports using /dev/null as a source file, which is a common
idiom for creating an empty target file, even if ${DESTDIR} is
non-empty.

(jlam)

Bump dependency on pkgtasks to version that supports TASK_VERBOSE.

Pass TASK_VERBOSE=all to the install and deinstall scripts if
PKG_VERBOSE is defined by the user.

(jlam)

Run pkg_add(1) and pkg_delete(1) using ${SETENV} ${PKGTOOLS_ENV}.

PKGTOOLS_ENV allows for passing environment variables to the
package install and deinstall scripts.

(jlam)

Update pkgtools/pkgtasks to 1.14.

Use TASK_VERBOSE environment variable to select which tasks should
emit output when invoked.

(jlam)

mk/pkgtasks: Substitute for variables unconditionally in scripts.

Replace @VAR@ with ${VAR} unconditionally in scripts, even if they
values are empty.  This will allow for fall-through to using the
pkgtasks hard-coded defaults, usually found by searching the PATH
contents, and it avoids having ugly "@VAR@" in the generated
scripts.

(jlam)

Substitute the correct string for GTK3_UPDATE_ICON_CACHE.

(jlam)