Stack-based buffer overflow in the push_subg function in parser.y (lib/graph/parser.c) in Graphviz 2.20.2, and possibly earlier versions, allows user-assisted remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a DOT file with a large number of Agraph_t elements.
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
graphviz before 2.2.1 allows local users to overwrite arbitrary files via a symlink attack on temporary files. NOTE: this issue was originally associated with a different CVE identifier, CVE-2005-2965, which had been used for multiple different issues. This is the correct identifier.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (0)
No VuXML entries for this package.
Commits (57)
Charlie Li (vishwin) · 0.10.1_1
python: bump all USE_PYTHON=distutils consumers after RUN_DEPENDS removal
Any missed ports, feel free to bump.
Any ports that need setuptools at runtime can have the devel/py-setuptools
manually added back to RUN_DEPENDS, but understand that this practice
is deprecated; see CHANGES for details.
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
Convert Python ports to FLAVORS.
Ports using USE_PYTHON=distutils are now flavored. They will
automatically get flavors (py27, py34, py35, py36) depending on what
versions they support.
There is also a USE_PYTHON=flavors for ports that do not use distutils
but need FLAVORS to be set. A USE_PYTHON=noflavors can be set if
using distutils but flavors are not wanted.
A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
added to cope with Python ports that did not have the Python
PKGNAMEPREFIX but are flavored.
USES=python now also exports a PY_FLAVOR variable that contains the
current python flavor. It can be used in dependency lines when the
port itself is not python flavored. For example, deskutils/calibre.
By default, all the flavors are generated. To only generate flavors
for the versions in PYTHON2_DEFAULT and PYTHON3_DEFAULT, define
BUILD_DEFAULT_PYTHON_FLAVORS in your make.conf.
In all the ports with Python dependencies, the *_DEPENDS entries MUST
end with the flavor so that the framework knows which to build/use.
This is done by appending '@${PY_FLAVOR}' after the origin (or
@${FLAVOR} if in a Python module with Python flavors, as the content
will be the same). For example:
RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}
PR: 223071
Reviewed by: portmgr, python
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D12464
Add graphics/py-graphviz, simple Python interface for Graphviz
This package facilitates the creation and rendering of graph descriptions in the
DOT language of the Graphviz graph drawing software (repo) from Python.
Create a graph object, assemble the graph by adding nodes and edges, and
retrieve its DOT source code string. Save the source code to a file and render
it with the Graphviz installation of your system.
Use the view option/method to directly inspect the resulting (PDF, PNG, SVG,
etc.) file with its default application. Graphs can also be rendered and
displayed within Jupyter notebooks (a.k.a. IPython notebooks, example) as well
as the Jupyter Qt Console.
WWW: https://github.com/xflr6/graphviz
Already existed a port named graphics/py-graphviz, it was moved in
ports r408353 to graphics/py-pygraphviz because it was using an
incorrect name. More info in the commit log [1].
1 - https://svnweb.freebsd.org/ports?view=revision&revision=408353
PR: 222205
Submitted by: lbartoletti@tuxfamily.org
Reviewed by: koobs
Differential Revision: D12319
graphics/py-graphviz: Move to py-pygraphviz, Fix 3.x build
There are numerous graphviz related packages in PyPI, including:
graphviz, graphviz-python and pygraphviz.
This port, py-graphviz, is not and does not provide the same package
as the 'graphviz' package on PyPI (CHEESESHOP).
Further, it blocks the creation of a correctly named py-graphviz port,
is a POLA violation in terms of users expecting to find and recieve
the package they expect based on a standard search, and is likely to
create confusion among other ports if they depend on a python graphviz
package, which could result in incorrect packages/dependencies.
This is why among other reasons, Python packages should be named
exactly what they are called in PyPI, or inside install_requires,
setup_requires or tests_requires as dependencies in other packages.
This change moves py-graphviz to py-pygraphviz to correct the above
incorrect naming.
While I'm here:
- Remove backup (http) MASTER_SITES, CHEESESHOP is highly-available
and provides a Geo-aware CDN by Fastly.
- Remove {BUILD,RUN}_DEPENDS in favour of the actual LIB_DEPENDS
- Use PYDISTUTILS_* framework variables to customise the build instead
of hack patching setup.py
- Enable autoplist, fixing builds on Python 3.x [1]
- Enable concurrent (Python version) installation
- Hack patch setup.py to preclude docs installation, as it adds a
directory to --record and breaks pkg-plist output [2]
- Remove DOCSDIR override (no longer necessary)
- Assign MAINTAINER'ship to python@
- Add TEST_DEPENDS and test target
- pkg-descr: Match WWW URL to setup.py:homepage field
- pkg-descr: Improve package description text (matching upstream)
While I'm sweeping dependencies:
- Fix a typo in science/gramps: s|>-|>=
[2] https://wiki.freebsd.org/Python (Open task for install_data bug)
Reported by: Ben Woods (via IRC) [1]
Bump portrevision due to upgrade of devel/gettext.
The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).
PR: ports/124340
Submitted by: edwin@
Approved by: portmgr (pav)
- Make Python 2.5.1 the default Python version - Add significantly better support in bsd.python.mk for working with Python Eggs and the easy_install system
Tested by: pointyhat runs
Approved by: pav (portmgr)
Most work by: perky
Thanks to: pav
- Fix place of install when devel/py-setuptools is installed - Pass maintainership to submitter
PR: ports/103564
Submitted by: Soeren Straarup <xride@x12.dk>
Update to recommended version 0.22 from new upstream which no longer requires SWIG. This fixes the brokeness introduced in the previous SWIG bandaid. A lawyer might want to check if the license is also less restrictive now ;)
Sponsored by: simon & erwin of tb3.droso.net
- Remove files/setup.py - Add files/Makefile - Rather than build from port's own download of graphviz, depend on the graphviz port and use its shared objects. (Fixes fetch problem)
PR: ports/78069
Submitted by: Sam Lawrance <boris@brooknet.com.au>