From owner-freebsd-ports-bugs@FreeBSD.ORG Sat Nov 17 17:50:00 2012 Return-Path: Delivered-To: freebsd-ports-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id AEEB83C5 for ; Sat, 17 Nov 2012 17:50:00 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id 7F1F28FC0C for ; Sat, 17 Nov 2012 17:50:00 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id qAHHo0tm011879 for ; Sat, 17 Nov 2012 17:50:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id qAHHo05r011878; Sat, 17 Nov 2012 17:50:00 GMT (envelope-from gnats) Resent-Date: Sat, 17 Nov 2012 17:50:00 GMT Resent-Message-Id: <201211171750.qAHHo05r011878@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Svyatoslav Lempert Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 296193C1 for ; Sat, 17 Nov 2012 17:49:07 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id E70FA8FC08 for ; Sat, 17 Nov 2012 17:49:06 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.5/8.14.5) with ESMTP id qAHHn6JA083010 for ; Sat, 17 Nov 2012 17:49:06 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.5/8.14.5/Submit) id qAHHn6SM083009; Sat, 17 Nov 2012 17:49:06 GMT (envelope-from nobody) Message-Id: <201211171749.qAHHn6SM083009@red.freebsd.org> Date: Sat, 17 Nov 2012 17:49:06 GMT From: Svyatoslav Lempert To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: ports/173684: [update] lang/php52 to 5.2.17_12 (20121114) X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 17 Nov 2012 17:50:00 -0000 >Number: 173684 >Category: ports >Synopsis: [update] lang/php52 to 5.2.17_12 (20121114) >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Sat Nov 17 17:50:00 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Svyatoslav Lempert >Release: 9.1-PRERELEASE >Organization: >Environment: >Description: - Update backports patch to 20121114 - Bump PORTREVISION Changes: - CVE-2006-7243 PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function Secuity 3761df02-0f9c-11e0-becc-0022156e8794 fixed by check in fopen functions for strlen(filename) != filename_len - CVE-2012-4388 The sapi_header_op function in main/SAPI.c does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, this vulnerability exists because of an incorrect fix for CVE-2011-1398. - Timezone database updated to version 2012.9 (2012i) Note: I have no more wishes to support PHP 5.2.17 and strongly recommend updating to the latest vendor-supported version (php53/php5) >How-To-Repeat: >Fix: Patch attached with submission follows: diff -Nru php52.old/Makefile php52/Makefile --- php52.old/Makefile 2012-09-20 03:02:43.000000000 +0000 +++ php52/Makefile 2012-11-14 18:24:50.000000000 +0000 @@ -7,7 +7,7 @@ PORTNAME= php52 PORTVERSION= 5.2.17 -PORTREVISION= 11 +PORTREVISION= 12 CATEGORIES?= lang devel www MASTER_SITES= ${MASTER_SITE_PHP} MASTER_SITE_SUBDIR= distributions @@ -26,7 +26,7 @@ MAKE_JOBS_SAFE= yes # BACKPORTS patch for lang/php52 and all php52-extensions -PATCHFILES= php52-backports-security-20120911.patch +PATCHFILES= php52-backports-security-20121114.patch PATCH_SITES+= http://php52-backports.googlecode.com/files/ .if !defined(PKGNAMESUFFIX) diff -Nru php52.old/distinfo php52/distinfo --- php52.old/distinfo 2012-09-20 03:02:43.000000000 +0000 +++ php52/distinfo 2012-11-14 18:26:51.000000000 +0000 @@ -1,7 +1,7 @@ SHA256 (php-5.2.17.tar.bz2) = e81beb13ec242ab700e56f366e9da52fd6cf18961d155b23304ca870e53f116c SIZE (php-5.2.17.tar.bz2) = 9092312 -SHA256 (php52-backports-security-20120911.patch) = 4911e2a5abb72d0558b2baf07ff64ca054d71219bde183e41b591894fb7cb1f6 -SIZE (php52-backports-security-20120911.patch) = 356599 +SHA256 (php52-backports-security-20121114.patch) = 59dc139b9acf86bbb2e281696765de513c3bec7d43392a10b5f3b36a9881ab00 +SIZE (php52-backports-security-20121114.patch) = 410829 SHA256 (php-5.2.14-fpm-0.5.14-freebsd.patch.gz) = 354ce451417d14ef47761ae55147e9cee30fa0ff6f59447da021194c539f4d7f SIZE (php-5.2.14-fpm-0.5.14-freebsd.patch.gz) = 43550 SHA256 (suhosin-patch-5.2.16-0.9.7.patch.gz) = aae115a318d80b3f32cedf876e7a8e4b932febb1b0c743c0b398003ebe122f91 >Release-Note: >Audit-Trail: >Unformatted: