Fri Jan 20 03:23:34 2012 UTC ()
Update php-suhosin package to 0.9.33 to fix security problem.

                         SektionEins GmbH
                        www.sektioneins.de

                     -= Security  Advisory =-

     Advisory: Suhosin PHP Extension Transparent Cookie Encryption Stack
Buffer Overflow
 Release Date: 2012/01/19
Last Modified: 2012/01/19
       Author: Stefan Esser [stefan.esser[at]sektioneins.de]

  Application: Suhosin Extension <= 0.9.32.1
     Severity: A possible stack buffer overflow in Suhosin extension's
               transparent cookie encryption that can only be triggered
               in an uncommon and weakened Suhosin configuration can lead
               to arbitrary remote code execution, if the FORTIFY_SOURCE
               compile option was not used when Suhosin was compiled.
         Risk: Medium
Vendor Status: Suhosin Extension 0.9.33 was released which fixes this
vulnerability
    Reference: http://www.suhosin.org/
               https://github.com/stefanesser/suhosin


(taca)
diff -r1.4 -r1.5 pkgsrc/security/php-suhosin/Makefile
diff -r1.3 -r1.4 pkgsrc/security/php-suhosin/distinfo
cvs diff -r1.4 -r1.5 pkgsrc/security/php-suhosin/Makefile (expand / switch to unified diff)

--- pkgsrc/security/php-suhosin/Makefile 2011/12/17 13:46:28 1.4
+++ pkgsrc/security/php-suhosin/Makefile 2012/01/20 03:23:34 1.5
@@ -1,21 +1,20 @@ @@ -1,21 +1,20 @@
1# $NetBSD: Makefile,v 1.4 2011/12/17 13:46:28 obache Exp $ 1# $NetBSD: Makefile,v 1.5 2012/01/20 03:23:34 taca Exp $
2# 2#
3 3
4MODNAME= suhosin 4MODNAME= suhosin
5DISTNAME= suhosin-${PECL_VERSION} 5DISTNAME= suhosin-${PECL_VERSION}
6PECL_VERSION= 0.9.32.1 6PECL_VERSION= 0.9.33
7PECL_LEGACY_VERSION_SCHEME= yes 7PECL_LEGACY_VERSION_SCHEME= yes
8CATEGORIES= www 8CATEGORIES= www
9MASTER_SITES= http://download.suhosin.org/ 9MASTER_SITES= http://download.suhosin.org/
10EXTRACT_SUFX= .tar.gz 
11 10
12MAINTAINER= cg@cgall.de 11MAINTAINER= cg@cgall.de
13HOMEPAGE= http://www.hardened-php.net/suhosin/index.html 12HOMEPAGE= http://www.hardened-php.net/suhosin/index.html
14COMMENT= Advanced protection system for PHP installations 13COMMENT= Advanced protection system for PHP installations
15 14
16PKG_DESTDIR_SUPPORT= user-destdir 15PKG_DESTDIR_SUPPORT= user-destdir
17 16
18CONFIGURE_ARGS= --enable-${MODNAME} 17CONFIGURE_ARGS= --enable-${MODNAME}
19 18
20.include "../../lang/php/ext.mk" 19.include "../../lang/php/ext.mk"
21.include "../../mk/bsd.pkg.mk" 20.include "../../mk/bsd.pkg.mk"
cvs diff -r1.3 -r1.4 pkgsrc/security/php-suhosin/distinfo (expand / switch to unified diff)

--- pkgsrc/security/php-suhosin/distinfo 2010/12/19 02:22:15 1.3
+++ pkgsrc/security/php-suhosin/distinfo 2012/01/20 03:23:34 1.4
@@ -1,5 +1,5 @@ @@ -1,5 +1,5 @@
1$NetBSD: distinfo,v 1.3 2010/12/19 02:22:15 taca Exp $ 1$NetBSD: distinfo,v 1.4 2012/01/20 03:23:34 taca Exp $
2 2
3SHA1 (php-suhosin/suhosin-0.9.32.1.tar.gz) = 93fcb1d5f96691c4c50808a14dd3d6d4bbfea451 3SHA1 (php-suhosin/suhosin-0.9.33.tgz) = abb30c22e7fe341955b42ec71ed597c43439e2b8
4RMD160 (php-suhosin/suhosin-0.9.32.1.tar.gz) = 6184eef336b9d3d5c885a7d1dcbf20d97b055e8d 4RMD160 (php-suhosin/suhosin-0.9.33.tgz) = 9c60b695b226ddcbe5562b1576228780123eb372
5Size (php-suhosin/suhosin-0.9.32.1.tar.gz) = 119117 bytes 5Size (php-suhosin/suhosin-0.9.33.tgz) = 104488 bytes