{"push_id":592774899,"size":3,"distinct_size":0,"ref":"refs/heads/pkgsrc_2014Q4","head":"457928fcba5186c7ce496f86d03394ad6eeb23e1","before":"429598c2ebae92fa020a1fd5b92975472ddbb938","commits":[{"sha":"700c313e4f29cc50547d54307e79a971c409979c","author":{"email":"a75d4d9e7d4d99e804e432141408b6e8dc3a4282","name":"tron"},"message":"Pullup ticket #4633 - requested by taca\nlang/php56: security update\n\nRevisions pulled up:\n- lang/php/phpversion.mk                                        1.88\n- lang/php56/Makefile                                           1.4\n- lang/php56/PLIST                                              1.2\n- lang/php56/distinfo                                           1.6\n- lang/php56/patches/patch-ext_date_php_date.c                  deleted\n- lang/php56/patches/patch-ext_date_tests_bug68942.phpt         deleted\n- lang/php56/patches/patch-ext_date_tests_bug68942_2.phpt       deleted\n\n---\n   Module Name:\tpkgsrc\n   Committed By:\ttaca\n   Date:\t\tFri Feb 20 01:17:50 UTC 2015\n\n   Modified Files:\n   \tpkgsrc/lang/php: phpversion.mk\n   \tpkgsrc/lang/php56: Makefile PLIST distinfo\n   Removed Files:\n   \tpkgsrc/lang/php56/patches: patch-ext_date_php_date.c\n   \t    patch-ext_date_tests_bug68942.phpt\n   \t    patch-ext_date_tests_bug68942_2.phpt\n\n   Log Message:\n   Update php56 to 5.6.6 (PHP 5.6.6).\n\n   19 Feb 2015, PHP 5.6.6\n\n   - Core:\n     . Removed support for multi-line headers, as the are deprecated by RFC 7230.\n       (Stas)\n     . Fixed bug #67068 (getClosure returns somethings that's not a closure).\n       (Danack at basereality dot com)\n     . Fixed bug #68942 (Use after free vulnerability in unserialize() with\n       DateTimeZone). (CVE-2015-0273) (Stas)\n     . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname\n       buffer overflow). (Stas)\n     . Fixed Bug #67988 (htmlspecialchars() does not respect default_charset\n       specified by ini_set) (Yasuo)\n     . Added NULL byte protection to exec, system and passthru. (Yasuo)\n\n   - Dba:\n     . Fixed bug #68711 (useless comparisons). (bugreports at internot dot info)\n\n   - Enchant:\n     . Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()).\n       (Antony)\n\n   - Fileinfo:\n     . Fixed bug #68827 (Double free with disabled ZMM). (Joshua Rogers)\n     . Fixed bug #67647 (Bundled libmagic 5.17 does not detect quicktime files\n       correctly). (Anatol)\n     . Fixed bug #68731 (finfo_buffer doesn't extract the correct mime with some\n       gifs). (Anatol)\n\n   - FPM:\n     . Fixed bug #66479 (Wrong response to FCGI_GET_VALUES). (Frank Stolle)\n     . Fixed bug #68571 (core dump when webserver close the socket).\n       (redfoxli069 at gmail dot com, Laruence)\n\n   - JSON:\n     . Fixed bug #50224 (json_encode() does not always encode a float as a float)\n       by adding JSON_PRESERVE_ZERO_FRACTION. (Juan Basso)\n\n   - LIBXML:\n     . Fixed bug #64938 (libxml_disable_entity_loader setting is shared\n       between threads). (Martin Jansen)\n\n   - Mysqli:\n     . Fixed bug #68114 (linker error on some OS X machines with fixed\n       width decimal support) (Keyur Govande)\n     . Fixed bug #68657 (Reading 4 byte floats with Mysqli and libmysqlclient\n       has rounding errors) (Keyur Govande)\n\n   - Opcache:\n     . Fixed bug with try blocks being removed when extended_info opcode\n       generation is turned on. (Laruence)\n\n   - PDO_mysql:\n     . Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of\n       named pipes). (steffenb198 at aol dot com)\n\n   - Phar:\n     . Fixed bug #68901 (use after free). (bugreports at internot dot info)\n\n   - Pgsql:\n     . Fixed Bug #65199 (pg_copy_from() modifies input array variable) (Yasuo)\n\n   - Session:\n     . Fixed bug #68941 (mod_files.sh is a bash-script) (bugzilla at ii.nl, Yasuo)\n     . Fixed Bug #66623 (no EINTR check on flock) (Yasuo)\n     . Fixed bug #68063 (Empty session IDs do still start sessions) (Yasuo)\n\n   - Sqlite3:\n     . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong\n       required_num_args). (Julien)\n\n   - Standard:\n     . Fixed bug #65272 (flock() out parameter not set correctly in windows).\n       (Daniel Lowrey)\n     . Fixed bug #69033 (Request may get env. variables from previous requests\n       if PHP works as FastCGI). (Anatol)\n\n   - Streams:\n     . Fixed bug which caused call after final close on streams filter. (Bob)","distinct":false,"url":"https://api.github.com/repos/joyent/pkgsrc/commits/700c313e4f29cc50547d54307e79a971c409979c"},{"sha":"e90d304c7501f2a9c775e41020c698970e8bb45b","author":{"email":"a75d4d9e7d4d99e804e432141408b6e8dc3a4282","name":"tron"},"message":"Pullup ticket #4634 - requested by taca\nnet/samba: security update\n\nRevisions pulled up:\n- net/samba/Makefile                                            1.253\n- net/samba/distinfo                                            1.102\n\n---\n   Module Name:\tpkgsrc\n   Committed By:\ttaca\n   Date:\t\tTue Feb 24 09:54:47 UTC 2015\n\n   Modified Files:\n   \tpkgsrc/net/samba: Makefile distinfo\n\n   Log Message:\n   Update samba package to 3.6.25.\n\n                      ==============================\n                      Release Notes for Samba 3.6.25\n                             February 23, 2015\n                      ==============================\n\n   This is a security release in order to address CVE-2015-0240 (Unexpected\n   code execution in smbd).\n\n   o  CVE-2015-0240:\n      All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an\n      unexpected code execution vulnerability in the smbd file server\n      daemon.\n\n      A malicious client could send packets that may set up the stack in\n      such a way that the freeing of memory in a subsequent anonymous\n      netlogon packet could allow execution of arbitrary code. This code\n      would execute with root privileges.\n\n   o  CVE-2014-0178:\n      In preparing a response to an authenticated FSCTL_GET_SHADOW_COPY_DATA\n      or FSCTL_SRV_ENUMERATE_SNAPSHOTS client request, affected versions of\n      Samba do not initialize 8 bytes of the 16 byte SRV_SNAPSHOT_ARRAY\n      response field. The uninitialized buffer is sent back to the client.\n\n      A non-default VFS module providing the get_shadow_copy_data_fn() hook\n      must be explicitly enabled for Samba to process the aforementioned\n      client requests. Therefore, only configurations with \"shadow_copy\" or\n      \"shadow_copy2\" specified for the \"vfs objects\" parameter are vulnerable.","distinct":false,"url":"https://api.github.com/repos/joyent/pkgsrc/commits/e90d304c7501f2a9c775e41020c698970e8bb45b"},{"sha":"457928fcba5186c7ce496f86d03394ad6eeb23e1","author":{"email":"a75d4d9e7d4d99e804e432141408b6e8dc3a4282","name":"tron"},"message":"Pullup tickets #4633 and #4634.","distinct":false,"url":"https://api.github.com/repos/joyent/pkgsrc/commits/457928fcba5186c7ce496f86d03394ad6eeb23e1"}]}