From owner-cvs-all@FreeBSD.ORG  Thu Apr 28 07:27:40 2005
Return-Path: <owner-cvs-all@FreeBSD.ORG>
Delivered-To: cvs-all@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 1A2A716A4CE; Thu, 28 Apr 2005 07:27:40 +0000 (GMT)
Received: from redqueen.evilcoder-services.org
	(redqueen.evilcoder-services.org [217.148.169.55])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id C11F443D3F; Thu, 28 Apr 2005 07:27:39 +0000 (GMT)
	(envelope-from remko@freebsd.org)
Received: from localhost (localhost [127.0.0.1])652F72954DB;
	Thu, 28 Apr 2005 09:27:38 +0200 (CEST)
Received: from redqueen.evilcoder-services.org ([127.0.0.1])
	(amavisd-new, port 10024)
	with ESMTP id 55444-02; Thu, 28 Apr 2005 09:27:38 +0200 (CEST)
Message-ID: <42709069.5010703@FreeBSD.org>
Date: Thu, 28 Apr 2005 09:27:37 +0200
From: Remko Lodder <remko@FreeBSD.org>
User-Agent: Mozilla Thunderbird 1.0.2 (Macintosh/20050317)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Greg Lewis <glewis@FreeBSD.org>
References: <200504272031.j3RKVXdX057038@repoman.freebsd.org>
In-Reply-To: <200504272031.j3RKVXdX057038@repoman.freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by the evilcoder-services.org maildomain
cc: cvs-ports@FreeBSD.org
cc: cvs-all@FreeBSD.org
cc: ports-committers@FreeBSD.org
Subject: Re: cvs commit: ports/java/jdk13/filespatch-j2sdk1.3.1-jar-Main.java
 patch-j2sdk1.3.1-resources-jar.properties
X-BeenThere: cvs-all@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS commit messages for the entire tree <cvs-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-all>
List-Post: <mailto:cvs-all@freebsd.org>
List-Help: <mailto:cvs-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-all>,
	<mailto:cvs-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Apr 2005 07:27:40 -0000

Greg Lewis wrote:
> glewis      2005-04-27 20:31:33 UTC
> 
>   FreeBSD ports repository
> 
>   Added files:
>     java/jdk13/files     patch-j2sdk1.3.1-jar-Main.java 
>                          patch-j2sdk1.3.1-resources-jar.properties 
>   Log:
>   . Ensure that when files are extracted that their fully resolved path lies
>     in or below the current working directory.  Fixes a security problem with
>     jar(1).
>   
>     This fix may change to be compatible with whatever fix Sun applies when
>     they release the next version of 1.5.
>   
>   Revision  Changes    Path
>   1.1       +56 -0     ports/java/jdk13/files/patch-j2sdk1.3.1-jar-Main.java (new)
>   1.1       +11 -0     ports/java/jdk13/files/patch-j2sdk1.3.1-resources-jar.properties (new)

Thanks for fixing the vulnerability. Could you please add it the
next time to your commit? The portmgr team gave as a guideline:

Security: CAN-<whatever>
Security: http://vuxml.FreeBSD.org/<id>
etc.

Oh and perhaps you can mention in your commit that this did not
solve the browser plugin vulnerability.

Thanks!

-- 
Kind regards,

      Remko Lodder  ** remko@elvandar.org
      Reporter DSINET  **  remko@DSINet.org
      Founder Tienervaders  ** remko@tienervaders.org
      FreeBSD Documentation Project  ** remko@FreeBSD.org