Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"
MIME-Version: 1.0
Date: Tue, 13 Oct 2015 18:02:11 +0000
From: "Sergey Svishchev" <shattered@netbsd.org>
Subject: CVS commit: pkgsrc/audio/ezstream
To: pkgsrc-changes@NetBSD.org
Reply-To: shattered@netbsd.org
Message-Id: <20151013180211.0A83F98@cvs.netbsd.org>
Sender: pkgsrc-changes-owner@NetBSD.org
Precedence: bulk

Module Name:	pkgsrc
Committed By:	shattered
Date:		Tue Oct 13 18:02:10 UTC 2015

Modified Files:
	pkgsrc/audio/ezstream: Makefile distinfo

Log Message:
Update to 0.6.0.  Changes:

 * This release contains a SECURITY FIX for a command injection vulnerability
   that was found and reported by Alexandre Rebert:

   The previous handling of metadata placeholders allowed for arbitrary shell
   commands to be trivially injected and executed as the ezstream user, via
   malicious media files.

 * This release requires users to ADJUST their CONFIGURATION:

   To protect against the injection vulnerability above, metadata is now
   properly quoted and escaped from the shell. This means that any extra
   quoting must be removed from configuration files.

   Remove all quoting from metadata placeholders in <encode/> and <decode/>
   commands, e.g. replace "@M@" with @M@, and "@T@" with @T@, etc. Without
   these changes, stream metadata will look both wrong and the injection
   vulnerability may be re-introduced.


To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.8 pkgsrc/audio/ezstream/Makefile
cvs rdiff -u -r1.2 -r1.3 pkgsrc/audio/ezstream/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.