Cross-platform application and UI framework (Linux CentOS 7.9.2009)
qt:qt from the portQAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault.
The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site.
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.
Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.
An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).
An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.
An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.
A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.
The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.
pkg audit reports nothing for this version.Framework: Make use of USE_LINUX=imageformat-libs2626acef73
Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
x11-toolkits: remove 'Created by' lines A big Thank You to the original contributors of these ports: * 1wardd@airmail.net * Alexander Kabaev <ak03@gte.com> * Alexander Novitsky <alecn2002@yandex.ru> * Alexey Dokuchaev <danfe@FreeBSD.org> * Andreas Kohn <andreas@syndrom23.de> * Andrew Pantyukhin <infofarmer@FreeBSD.org> * Anton Berezin <tobez@FreeBSD.org> * Brian Buchanan <brian@CSUA.Berkeley.EDU> * Cezary Morga <cm@therek.net> * Cheng-Lung Sung <clsung@FreeBSD.org> * Danilo Egea Gondolfo <danilo@FreeBSD.org> * Dima Sivachenko <dima@Chg.RU> * Edwin Groothuis <edwin@mavetju.org> * Eric Anholt <anholt@FreeBSD.org> * Igor Pokrovsky <ip@doom.homeunix.org> * James FitzGibbon <jfitz@FreeBSD.org> * Jean-Sébastien Pédron <dumbbell@FreeBSD.org> * Joe Marcus Clarke <marcus@FreeBSD.org> * Juli Mallett * Kenjiro Cho <kjc@csl.sony.co.jp> * Kimura Fuyuki <fuyuki@hadaly.org> * Koop Mast <kwm@FreeBSD.org> * Lars Koeller <Lars.Koeller@Uni-Bielefeld.de> * Lubomir Marinov <lubomir_m@abv.bg> * Marc Recht <marc@informatik.uni-bremen.de> * Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org> * Martin Klaffenboeck <martin.klaffenboeck@gmx.at> * Martin Matuska <mm@FreeBSD.org> * Maxim Sobolev <sobomax@FreeBSD.org> * Michael Grünewald <michipili@gmail.com> * Michael Johnson <ahze@FreeBSD.org> * Mike Krutov <neko@takino.org> * Mike Meyer <mwm@mired.org> * Olivier Duchateau * Paul Schmehl <pauls@utdallas.edu> * Peter Hawkins <thepish@FreeBSD.org> * Piotr Kubaj <pkubaj@anongoth.pl> * Radim Kolar * Rene Ladan <rene@FreeBSD.org> * Robert C. Noland III <rnoland@FreeBSD.org> * Simon Barner <barner@gmx.de> * Stephane Legrand <stephane@FreeBSD.org> * Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> * Thomas Gellekum <tg@FreeBSD.org> * Tom McLaughlin <tmclaugh@sdf.lonestar.org> * Vanilla I. Shu <vanilla@MinJe.com.TW> * Will Andrews <andrews@technologist.com> * Yukihiro Nakai <nakai@FreeBSD.org> * Zane C, Bowers <vvelox@vvelox.net> * asami * chinsan * chuckr * clsung@dragon2.net * dmitry@karasik.eu.org * fjoe@FreeBSD.org * gahr * gena * ijliao * mi * minter@lunenburg.org * nivit@users.sourceforge.net * ports@c0decafe.net * roland.jesse@gmx.net * thierry@pompo.net * vanilla With hat: portmgr71b6a9f9c7
*: Linux emulation: add support for aarch64 PR: 256008 Submitted by: Vincent Milum Jr (prior version) Approved by: emulation (maintainer timeout)c7dd5ca11a
*/*: Remove redundant '-[0-9]*' from CONFLICTS The conflict checks compare the patterns first against the package names without version (as reported by "pkg query "%n"), then - if there was no match - agsinst the full package names including the version (as reported by "pkg query "%n-%v"). Many CONFLICTS definitions used patterns like "bash-[0-9]*" to filter for the bash package in any version. But that pattern is functionally identical with just "bash". Approved by: portmgr (blanket)819f25b36d
x11-toolkits/linux-c7-qt-x11: Add CPE information Approved by: portmgr (blanket)9c03ecdb5b
Remove # $FreeBSD$ from Makefiles.305f148f48
Update Linux CentOS ports to 7.9.2009.9aae2889e0
Update CentOS 7 ports to 7.8.2003.f8c4d55478
Do not borrow pkg-descr of these ports from devel/linux-c6-qt47fdbfaf29f7
Move security/linux-c7-openssl into emulators/linux_base-c7. It is needed by sha*sum from the coreutils package.346b48c4ce
Update qt to 4.8.7-3.el7_6.323b24abe9
Address some portlint warnings in the Linux infrastructure ports. Eliminate LINUXNAME from port Makefiles. This was just a helper variable without special meaning outside port Makefiles but several developers have copied it to new ports where it was then unused, apparently thinking that it did have some special meaning.bb5cf6c4f3
Eliminate RPMVERSION from Linux ports and set DISTVERSIONSUFFIX instead. This puts all version information together in the port Makefiles.5b721b6172
Update CentOS 7 ports to 7.6.1810. This adds some new ports: converters/linux-c7-fribidi required by x11-toolkits/linux-c7-pango. graphics/linux-c7-libglvnd required by graphics/linux-c7-dri. graphics/linux-c7-wayland required by graphics/linux-c7-dri. print/linux-c7-freetype unbundled from emulators/linux_base-c7 because it depends on graphics/linux-c7-png now. Mesa OpenGL libraries in graphics/linux-c7-dri now support libglvnd (GL Vendor-Neutral Dispatch library) which allows some applications to use Mesa while others use Nvidia OpenGL. The x11/nvidia-driver* ports have been changed so versions above 390.42 now use CentOS libglvnd and no longer install a bundled copy. PR: 229431 Submitted by: pkubaj (partly)f099d068fc
Qt4 deprecation: add a Qt4 pkg-descr to the linux-*qt4* ports. - repo copied from devel/qt4@495966 Approved by: portmgr (implicit)63c1631f4d
Update Linux CentOS 7 ports to 7.4.1708.b7fad8b86f
Enable i386 support to Linux CentOS 7 ports. PR: 216646d0d15cc5cd
- Autodetect the installed linux_base port and use LINUX_DEFAULT only as a last resort. - Construct a list of DISTFILES for every architecture (amd64, i386). Select one list for regular make and all lists for make makesum so linux ports can have one combined distinfo file. - Set DIST_SUBDIR?=centos so there's only one copy of common distfiles. - Use MASTER_SITES and DISTFILES groups so make6140d3c6aa
Update Linux CentOS 7 ports to 7.3.1611. While 7.2 had semi-official i386 packages there are no such packages for 7.3 yet so i386 support has been marked IGNORE for now. Change DIST_SUBDIR to just "centos" so distfiles that remain the same between major versions don't have to be redownloaded. Remove fmake hacks from linux.mk. Submitted by: Piotr Kubaj <pkubaj@anongoth.pl>c2712d2471
Remove NVIDIA option from Linux ports now that the nvidia-driver can be installed later.22758f2672
Add Linux CentOS 7 infrastructure ports. Mk/Uses/linux.mk changes: - Add support for architecture neutral (noarch) distfiles. - Add support for 64-bit only ports: set IGNORE on i386 and don't install 32-bit compat libraries on amd64. Submitted by: Piotr Kubaj <pkubaj@anongoth.pl> Differential Revision: https://reviews.freebsd.org/D78861675ff649c