The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (0)
No VuXML entries for this package.
Commits (88)
Baptiste Daroussin (bapt) · 12.4_11
MAN?PREFIX: eleminate its usage and move man to share/man
*/*: Update WWW to use HTTPS for sourceforge.net projects
Homepage link is permanent redirected to its HTTPS counterpart
Issue reported by repology : https://repology.org/repository/freebsd/problems
Approved by: portmgr (blanket)
PR: 274888
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
mail/heirloom-mailx: Fix wrong UTC offset for Europe/Dublin
Somewhere around 2018, the tzdata maintainers (IANA) corrected a
historical mistake with the Europe/Dublin timezone. The mistake was
rooted in a misunderstanding of whether IST meant "Irish Summer Time"
or "Irish Standard Time".
The problem was discussed at great length
(http://mm.icann.org/pipermail/tz/2018-January/thread.html) and it was
concluded that IST really meant Irish *Standard* Time (in constrast with,
say, British *Summer* Time), and that this standard time is defined as
UTC+0100.
This corresponds to the article at
https://en.wikipedia.org/wiki/Time_in_the_Republic_of_Ireland and the
notes at https://en.wikipedia.org/wiki/Winter_time_(clock_lag); the
source archive of tzdata has a long section dedicated to this problem and
a large set of official references and links to www.irishstatutebook.ie.
Once the question was settled, the only possible solution for keeping
the Irish local time in sync with the rest of the world (timezones aside,
the local time in Ireland - as understood by common people - is the same
as in London and Belfast) was for IANA to _reverse_ the functioning of
the DST flag for Ireland. The result is that in the current IANA timezone
database (2021e), Europe/Dublin has DST applied in *winter*, with an
adjustment of -1h (that is, negative).
Digging deeper, one uncovers that there are a few other countries that
have (or once had) the same time-switch mechanism as Ireland; amongst
others, https://github.com/MenoData/Time4J/issues/742 also concedes that
negative DST is a reality.
In heirloom mailx, the logic that works out the UTC offset does the right
thing up to a point (November 2021, Ireland = UTC+0100), but then upon
inspecting tm->tm_isdst it sees that DST is in effect (remember, flag has
been reversed, so DST in Ireland is on in winter time) it adds one hour
(it should subtract one, because the adjustment is negative, but mailx
doesn't know).
PR: 260137
Submitted by: Andrea Biardi <a.biardi@tiscali.it>
Reported by: Andrea Biardi <a.biardi@tiscali.it>
MFH: 2022Q1
mail/heirloom-mailx: Use the proper progname in argv[0]
When argv[0] does not match that af the program name passed to
execv(2), mailwrapper cannot determine which application to call
in its translation table resulting in:
mailwrapper: no mapping in /etc/mail/mailer.conf
MFH: 2022Q1
*/*: Remove redundant '-[0-9]*' from CONFLICTS
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Many CONFLICTS definitions used patterns like "bash-[0-9]*" to filter
for the bash package in any version. But that pattern is functionally
identical with just "bash".
Approved by: portmgr (blanket)
mail/heirloom-mailx: Fix build without EGD
- Add patch for building without EGD (OpenSSL 1.1/LibreSSL)
- Move from USE_OPENSSL to USES=ssl
PR: 205540
Approved by: Maintainer timeout
Fix path to sendmail binary that was accidentally removed during a previous update
PR: 196082
Submitted by: Jamie Landeg-Jones <jamie@dyslexicfish.net> (maintainer)
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav
- Add a patch to fix "unignore" and similar commands - Bump PORTREVISION
PR: ports/146280
Submitted by: B. Smith <anon_101100 at yahoo.com>
Obtained from: developers cvs
- Add mutual conflicts to mail/heirloom-mailx and mail/mailx: both install bin/mailx
PR: 129332
Submitted by: Alexander Logvinov <ports at logvinov dot com> (maintainer of mail/heirloom-mailx)
Reported by: Evgeniy Pismenchuk <evpian at gmail dot com>
[maintainer update] mail/heirloom-mailx: update to 12.4
Update to 12.4
See http://heirloom.sourceforge.net/mailx/ChangeLog
Add option for IPv6 Support
PR: ports/126293
Submitted by: Alexander Logvinov <ports@logvinov.com>