From owner-svn-ports-head@FreeBSD.ORG Mon Mar 18 20:46:52 2013 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id DC207C4; Mon, 18 Mar 2013 20:46:52 +0000 (UTC) (envelope-from flo@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id C29129B4; Mon, 18 Mar 2013 20:46:52 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r2IKkqBX089587; Mon, 18 Mar 2013 20:46:52 GMT (envelope-from flo@svn.freebsd.org) Received: (from flo@localhost) by svn.freebsd.org (8.14.6/8.14.5/Submit) id r2IKkqqq089580; Mon, 18 Mar 2013 20:46:52 GMT (envelope-from flo@svn.freebsd.org) Message-Id: <201303182046.r2IKkqqq089580@svn.freebsd.org> From: Florian Smeets Date: Mon, 18 Mar 2013 20:46:52 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r314596 - in head: lang/php53 security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 20:46:52 -0000 Author: flo Date: Mon Mar 18 20:46:51 2013 New Revision: 314596 URL: http://svnweb.freebsd.org/changeset/ports/314596 Log: Update to 5.3.23 Security: 1d23109a-9005-11e2-9602-d43d7e0c7c02 Modified: head/lang/php53/Makefile head/lang/php53/distinfo head/security/vuxml/vuln.xml Modified: head/lang/php53/Makefile ============================================================================== --- head/lang/php53/Makefile Mon Mar 18 20:44:42 2013 (r314595) +++ head/lang/php53/Makefile Mon Mar 18 20:46:51 2013 (r314596) @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= php53 -PORTVERSION= 5.3.22 +PORTVERSION= 5.3.23 PORTREVISION?= 0 CATEGORIES?= lang devel www MASTER_SITES= ${MASTER_SITE_PHP} @@ -63,7 +63,7 @@ PATCH_SITES+= ${MASTER_SITE_LOCAL} \ PATCH_SITE_SUBDIR= flo .if ${PORT_OPTIONS:MSUHOSIN} -PATCHFILES+= suhosin-patch-5.3.x-0.9.10.2.patch.gz +PATCHFILES+= suhosin-patch-5.3.x-0.9.10.3.patch.gz PLIST_SUB+= SUHOSIN="" .else PLIST_SUB+= SUHOSIN="@comment " Modified: head/lang/php53/distinfo ============================================================================== --- head/lang/php53/distinfo Mon Mar 18 20:44:42 2013 (r314595) +++ head/lang/php53/distinfo Mon Mar 18 20:46:51 2013 (r314596) @@ -1,6 +1,6 @@ -SHA256 (php-5.3.22.tar.bz2) = 2da5fefdd24dafd8a94b6e41ba2c308ee216f97b3d605abde513d0cdc680d588 -SIZE (php-5.3.22.tar.bz2) = 11366482 -SHA256 (suhosin-patch-5.3.x-0.9.10.2.patch.gz) = 886bc7d7816fcce93792bd4a847731c460460b4f3987e0a5f6bf44b1979f5daa -SIZE (suhosin-patch-5.3.x-0.9.10.2.patch.gz) = 40806 +SHA256 (php-5.3.23.tar.bz2) = 69473eae7c752987a8fc7619bae9f7121cfe7c6603a2ebf13c8e036dff6a4944 +SIZE (php-5.3.23.tar.bz2) = 11410987 +SHA256 (suhosin-patch-5.3.x-0.9.10.3.patch.gz) = 40a5de284f3bec4e5f7d54093ff23fd909030f84852fb2157780d41378932b82 +SIZE (suhosin-patch-5.3.x-0.9.10.3.patch.gz) = 40957 SHA256 (php-5.3.x-mail-header.patch) = 5a677448b32d9f592703e2323a33facdb45e5c237dcca04aaea8ec3287f7db84 SIZE (php-5.3.x-mail-header.patch) = 3325 Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Mar 18 20:44:42 2013 (r314595) +++ head/security/vuxml/vuln.xml Mon Mar 18 20:46:51 2013 (r314596) @@ -51,6 +51,43 @@ Note: Please add new entries to the beg --> + + php5 -- Multiple vulnerabilities + + + php5 + 5.4.13 + + + php53 + 5.3.23 + + + + +

The PHP development team reports:

+
+

PHP does not validate the relationship between the soap.wsdl_cache_dir + directive and the open_basedir directive, which allows remote attackers to + bypass intended access restrictions by triggering the creation of cached + SOAP WSDL files in an arbitrary directory.

+

The SOAP parser in PHP allows remote attackers to read arbitrary files + via a SOAP WSDL file containing an XML external entity declaration in + conjunction with an entity reference, related to an XML External Entity + (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.

+
+ + + + CVE-2013-1635 + CVE-2013-1643 + + + 2013-03-04 + 2013-03-18 + + + piwigo -- CSRF/Path Traversal