CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

security/libotr33.2.1_5

Portable OTR Messaging Library and toolkit

Maintainer
cs@FreeBSD.org
Packages
libotr3 3.2.1_5
Upstream
up to date
CPE
cypherpunks:libotr from the port
WWW
https://otr.cypherpunks.ca/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (2) · listed, port not fixed yet

CVE-2016-28519.8published 2016-04-07VuXML entry

Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.

Fixed (0)

No VuXML entries for this package.

Commits (21)

Nuno Teixeira (eduardo) · 3.2.1_5
security/libotr3: Move man pages to share/man

Approved by:	portmgr (blanket)
52441ceb42
Stefan Eßer (se) · 3.2.1_4
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 3.2.1_4
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Stefan Eßer (se) · 3.2.1_4
*/*: Remove redundant '-*' from CONFLICTS definitions

The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").

Approved by: portmgr (blanket)
04b9da4140
Mathieu Arnold (mat) · 3.2.1_4
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 3.2.1_4
Remove # $FreeBSD$ from Makefiles.
305f148f48
Mathieu Arnold (mat) · 3.2.1_4
Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight
597afc47ba
Dmitry Marakasov (amdmi3) · 3.2.1_4
- Drop @dirrm* from plist

Approved by:	portmgr blanket
ea0276fde1
Kurt Jaeger (pi) · 3.2.1_4
security/libgcrypt: 1.6.1 -> 1.6.2, bump depends

Changes:
- src/sexp.c (do_vsexp_sscan): Return error for invalid args.
- cipher/md.c (_gcry_md_info): Fix a segv in case of calling
  with wrong parameters.
- cipher/primegen.c (_gcry_generate_elg_prime): Change to return an
  error code, possible NULL deref in call to prime generator.
- cipher/dsa.c (generate): Take care of new return code.
- cipher/elgamal.c (generate): Change to return an error code.  Take
	care of _gcry_generate_elg_prime return code.
- ecc: Support the non-standard 0x40 compression flag for EdDSA.
- mpi: Extend the internal mpi_get_buffer.
- mpi: Fix regression for powerpc-apple-darwin detection.
- Fix bug inhibiting the use of the sentinel attribute in src/gcrypt.h.in
- Fix building for the x32 target without asm modules in
  mpi/generic/mpi-asm-defs.h: Use a fixed value for the x32 ABI.
- Fix ARM assembly when building __PIC__
- mpi: Fix a subtle bug setting spurious bits with in mpi_set_bit.
  * mpi/mpi-bit.c (_gcry_mpi_set_bit, _gcry_mpi_set_highbit): Clear
    allocated but not used bits before resizing.
  * tests/t-mpi-bits.c (set_bit_with_resize): New.
- Use internal malloc function in fips.c.
  * src/fips.c (check_binary_integrity): s/gcry_malloc/xtrymalloc/.
- pubkey: Re-map all deprecated RSA algo numbers.
- cipher: Fix possible NULL dereference in cipher/md.c for being NULL.
- Fix ARMv6 detection when CFLAGS modify target CPU architecture.

PR:		193264
Approved by:	cpm@fbsd.es (maintainer)
cba03c03e1
Tijl Coosemans (tijl) · 3.2.1_3
- Remove dependency on pkgconf - Convert to USES=pathfix to avoid patching Makefile.am which may cause   automake to run - Remove USE_AUTOTOOLS
87ffe19901
Carlo Strub (cs) · 3.2.1_3
Add CPE
7f2dc6fd0c
Kurt Jaeger (pi) · 3.2.1_3
security/libgcrypt: 1.5.3_3 -> 1.6.1

- Update to 1.6.1
- Remove some unneeded patches
- Fix pkg-plist
- report configure bug upstream
  https://bugs.g10code.com/gnupg/issue1668
- report API breakage downstream and find that MacPorts had the same issue
  https://rt.cpan.org/Ticket/Display.html?id=97201
- bump PORTREVISION for dependent ports (approx. 100 ports)
- Thanks to exp-run by antoine@ to find ports that break
- patch ports that would otherwise break
  security/shishi with PR 192164 is already committed
  [1] devel/ccrtp
  [2] editors/abiword
  [3] security/p5-Crypt-GCrypt

PR:		191256, 192162 [1], 192163 [2], 192166 [3]
Submitted by:	Carlos Jacobo Puga Medina <cjpugmed@gmail.com>
Approved by:	maintainer timeout, antoine (exp-run), portmgr (implicit)
b95d127471
Dmitry Marakasov (amdmi3) · 3.2.1_2
- Switch security/libotr3 to USES=libtool, drop .la files - Bump dependent ports as .so version has changed

Approved by:	portmgr blanket
06358fd1ac
Carlo Strub (cs) · 3.2.1_1
- security/libotr: update to new LIB_DEPENDS, adjust conflicts - security/libotr3: update to new LIB_DEPENDS, adjust conflicts, add staging support
eecee497f7
Carlo Strub (cs) · 3.2.1_1
Take maintainership
a91e90d29d
Baptiste Daroussin (bapt) · 3.2.1_1
Add NO_STAGE all over the place in preparation for the staging support (cat: security)
a65ed2e51b
Alex Kozlov (ak) · 3.2.1_1
- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)
d4041784dc
Emanuel Haupt (ehaupt) · 3.2.1_1
Chase security/libgcrypt update
2898e3fa0c
Doug Barton (dougb) · 3.2.1
Throw my ports back in the pool, and make my intentions clear for the various ports that I've created.

I bid fond fare well
A chapter closes for me
What opens for you?
deda664425
Doug Barton (dougb) · 3.2.1
Hook security/libotr3 up, and move ports that depend on the old version to this new dependency.
433f1ce663
Doug Barton (dougb) · 3.2.1
Copy libotr to libotr3 so that ports that still rely on the old, incompatible version can continue uninterrupted until they upgrade.
4d3a4412c3