From owner-freebsd-ports@FreeBSD.ORG Tue Oct 10 18:05:01 2006 Return-Path: X-Original-To: freebsd-ports@freebsd.org Delivered-To: freebsd-ports@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E358016A40F for ; Tue, 10 Oct 2006 18:05:01 +0000 (UTC) (envelope-from a.pirko@inode.at) Received: from mx.inode.at (lb01nat19.inode.at [62.99.145.19]) by mx1.FreeBSD.org (Postfix) with ESMTP id C8E1243D60 for ; Tue, 10 Oct 2006 18:05:00 +0000 (GMT) (envelope-from a.pirko@inode.at) Received: from [85.124.24.137] (port=2968 helo=[192.168.1.11]) by smartmx-17.inode.at with esmtp (Exim 4.50) id 1GXLyL-0001fI-9J; Tue, 10 Oct 2006 20:04:57 +0200 Message-ID: <452BE0C6.9010208@inode.at> Date: Tue, 10 Oct 2006 20:04:54 +0200 From: Armin Pirkovitsch User-Agent: Thunderbird 1.5.0.7 (X11/20060916) MIME-Version: 1.0 To: Matt Craig References: <452BDD83.9060804@nmsu.edu> In-Reply-To: <452BDD83.9060804@nmsu.edu> X-Enigmail-Version: 0.94.0.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Cc: freebsd-ports@freebsd.org Subject: Re: php4 update fails X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Oct 2006 18:05:02 -0000 Matt Craig wrote: > [...] > ===> Cleaning for php4-4.4.4 > ===> php4-4.4.4 has known vulnerabilities: > => php -- open_basedir Race Condition Vulnerability. > Reference: > > > => Please update your ports tree and try again. > *** Error code 1 > I also tried portupgrade Nfp, removing the package with pkg_delete php4 > and adding it back again with pkg_add -r php4, and I get the same > thing. Doing a make install yields the same results as well. I also > get the same thing after updating the ports tree with cvsup. > > Is it possible that php4 will not update because of the open_basedir > Race Condition Vulnerability? If so it fails to mention that. Just follow the url stated in the error - if you look more closely all listed php ports are concerned and each port with a >=0 means that there is no patch yet - which means that any attempt to install it will fail. The only way to override a vulnaritbility is to set DISABLE_VULNERABILITIES - however this shouldn't be used careless. -- Armin Pirkovitsch a.pirko@inode.at