From owner-freebsd-stable@FreeBSD.ORG Wed Dec 22 01:06:25 2004 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F1AC016A4D4 for ; Wed, 22 Dec 2004 01:06:24 +0000 (GMT) Received: from farside.isc.org (farside.isc.org [204.152.187.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id C38AA43D4C for ; Wed, 22 Dec 2004 01:06:24 +0000 (GMT) (envelope-from Mark_Andrews@isc.org) Received: from drugs.dv.isc.org (localhost [IPv6:::1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by farside.isc.org (Postfix) with ESMTP id 33E1E67503 for ; Wed, 22 Dec 2004 01:06:23 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.13.1/8.13.1) with ESMTP id iBM16JlF080958; Wed, 22 Dec 2004 12:06:20 +1100 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200412220106.iBM16JlF080958@drugs.dv.isc.org> To: Ladislav Bodnar From: Mark Andrews In-reply-to: Your message of "Wed, 22 Dec 2004 08:55:07 +0800." <200412220855.07654.distro.watch@msa.hinet.net> Date: Wed, 22 Dec 2004 12:06:19 +1100 Sender: Mark_Andrews@isc.org cc: stable@freebsd.org Subject: Re: PHP vulnerability and portupgrade X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Dec 2004 01:06:25 -0000 > Hello, > > Due to the recently discovered vulnerability in PHP versions older than > 4.3.10 and 5.0.3, I decided to take a look at portupgrade to see if it is a > good way to keep the ports collection up-to-date with respect to security > issues. I ran cvsup on the security branch (tag=RELENG_5_3), then portsdb > -Uu. However, portupgrade didn't find any ports that needed an upgrade. > > Am I doing something wrong or is portupgrade not the best tool to keep up > with security advisories in ports? cvsup of ports does not use tag=RELENG_5_3. e.g. *default host=cvsup.FreeBSD.org *default base=/usr *default prefix=/usr *default release=cvs *default delete use-rel-suffix *default tag=. ports-all Use portaudit to track security issues in ports. > Thank you for your help :-) > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews@isc.org