head	1.2;
access;
symbols
	pkgsrc-2026Q1:1.2.0.148
	pkgsrc-2026Q1-base:1.2
	pkgsrc-2025Q4:1.2.0.146
	pkgsrc-2025Q4-base:1.2
	pkgsrc-2025Q3:1.2.0.144
	pkgsrc-2025Q3-base:1.2
	pkgsrc-2025Q2:1.2.0.142
	pkgsrc-2025Q2-base:1.2
	pkgsrc-2025Q1:1.2.0.140
	pkgsrc-2025Q1-base:1.2
	pkgsrc-2024Q4:1.2.0.138
	pkgsrc-2024Q4-base:1.2
	pkgsrc-2024Q3:1.2.0.136
	pkgsrc-2024Q3-base:1.2
	pkgsrc-2024Q2:1.2.0.134
	pkgsrc-2024Q2-base:1.2
	pkgsrc-2024Q1:1.2.0.132
	pkgsrc-2024Q1-base:1.2
	pkgsrc-2023Q4:1.2.0.130
	pkgsrc-2023Q4-base:1.2
	pkgsrc-2023Q3:1.2.0.128
	pkgsrc-2023Q3-base:1.2
	pkgsrc-2023Q2:1.2.0.126
	pkgsrc-2023Q2-base:1.2
	pkgsrc-2023Q1:1.2.0.124
	pkgsrc-2023Q1-base:1.2
	pkgsrc-2022Q4:1.2.0.122
	pkgsrc-2022Q4-base:1.2
	pkgsrc-2022Q3:1.2.0.120
	pkgsrc-2022Q3-base:1.2
	pkgsrc-2022Q2:1.2.0.118
	pkgsrc-2022Q2-base:1.2
	pkgsrc-2022Q1:1.2.0.116
	pkgsrc-2022Q1-base:1.2
	pkgsrc-2021Q4:1.2.0.114
	pkgsrc-2021Q4-base:1.2
	pkgsrc-2021Q3:1.2.0.112
	pkgsrc-2021Q3-base:1.2
	pkgsrc-2021Q2:1.2.0.110
	pkgsrc-2021Q2-base:1.2
	pkgsrc-2021Q1:1.2.0.108
	pkgsrc-2021Q1-base:1.2
	pkgsrc-2020Q4:1.2.0.106
	pkgsrc-2020Q4-base:1.2
	pkgsrc-2020Q3:1.2.0.104
	pkgsrc-2020Q3-base:1.2
	pkgsrc-2020Q2:1.2.0.100
	pkgsrc-2020Q2-base:1.2
	pkgsrc-2020Q1:1.2.0.80
	pkgsrc-2020Q1-base:1.2
	pkgsrc-2019Q4:1.2.0.102
	pkgsrc-2019Q4-base:1.2
	pkgsrc-2019Q3:1.2.0.98
	pkgsrc-2019Q3-base:1.2
	pkgsrc-2019Q2:1.2.0.96
	pkgsrc-2019Q2-base:1.2
	pkgsrc-2019Q1:1.2.0.94
	pkgsrc-2019Q1-base:1.2
	pkgsrc-2018Q4:1.2.0.92
	pkgsrc-2018Q4-base:1.2
	pkgsrc-2018Q3:1.2.0.90
	pkgsrc-2018Q3-base:1.2
	pkgsrc-2018Q2:1.2.0.88
	pkgsrc-2018Q2-base:1.2
	pkgsrc-2018Q1:1.2.0.86
	pkgsrc-2018Q1-base:1.2
	pkgsrc-2017Q4:1.2.0.84
	pkgsrc-2017Q4-base:1.2
	pkgsrc-2017Q3:1.2.0.82
	pkgsrc-2017Q3-base:1.2
	pkgsrc-2017Q2:1.2.0.78
	pkgsrc-2017Q2-base:1.2
	pkgsrc-2017Q1:1.2.0.76
	pkgsrc-2017Q1-base:1.2
	pkgsrc-2016Q4:1.2.0.74
	pkgsrc-2016Q4-base:1.2
	pkgsrc-2016Q3:1.2.0.72
	pkgsrc-2016Q3-base:1.2
	pkgsrc-2016Q2:1.2.0.70
	pkgsrc-2016Q2-base:1.2
	pkgsrc-2016Q1:1.2.0.68
	pkgsrc-2016Q1-base:1.2
	pkgsrc-2015Q4:1.2.0.66
	pkgsrc-2015Q4-base:1.2
	pkgsrc-2015Q3:1.2.0.64
	pkgsrc-2015Q3-base:1.2
	pkgsrc-2015Q2:1.2.0.62
	pkgsrc-2015Q2-base:1.2
	pkgsrc-2015Q1:1.2.0.60
	pkgsrc-2015Q1-base:1.2
	pkgsrc-2014Q4:1.2.0.58
	pkgsrc-2014Q4-base:1.2
	pkgsrc-2014Q3:1.2.0.56
	pkgsrc-2014Q3-base:1.2
	pkgsrc-2014Q2:1.2.0.54
	pkgsrc-2014Q2-base:1.2
	pkgsrc-2014Q1:1.2.0.52
	pkgsrc-2014Q1-base:1.2
	pkgsrc-2013Q4:1.2.0.50
	pkgsrc-2013Q4-base:1.2
	pkgsrc-2013Q3:1.2.0.48
	pkgsrc-2013Q3-base:1.2
	pkgsrc-2013Q2:1.2.0.46
	pkgsrc-2013Q2-base:1.2
	pkgsrc-2013Q1:1.2.0.44
	pkgsrc-2013Q1-base:1.2
	pkgsrc-2012Q4:1.2.0.42
	pkgsrc-2012Q4-base:1.2
	pkgsrc-2012Q3:1.2.0.40
	pkgsrc-2012Q3-base:1.2
	pkgsrc-2012Q2:1.2.0.38
	pkgsrc-2012Q2-base:1.2
	pkgsrc-2012Q1:1.2.0.36
	pkgsrc-2012Q1-base:1.2
	pkgsrc-2011Q4:1.2.0.34
	pkgsrc-2011Q4-base:1.2
	pkgsrc-2011Q3:1.2.0.32
	pkgsrc-2011Q3-base:1.2
	pkgsrc-2011Q2:1.2.0.30
	pkgsrc-2011Q2-base:1.2
	pkgsrc-2011Q1:1.2.0.28
	pkgsrc-2011Q1-base:1.2
	pkgsrc-2010Q4:1.2.0.26
	pkgsrc-2010Q4-base:1.2
	pkgsrc-2010Q3:1.2.0.24
	pkgsrc-2010Q3-base:1.2
	pkgsrc-2010Q2:1.2.0.22
	pkgsrc-2010Q2-base:1.2
	pkgsrc-2010Q1:1.2.0.20
	pkgsrc-2010Q1-base:1.2
	pkgsrc-2009Q4:1.2.0.18
	pkgsrc-2009Q4-base:1.2
	pkgsrc-2009Q3:1.2.0.16
	pkgsrc-2009Q3-base:1.2
	pkgsrc-2009Q2:1.2.0.14
	pkgsrc-2009Q2-base:1.2
	pkgsrc-2009Q1:1.2.0.12
	pkgsrc-2009Q1-base:1.2
	pkgsrc-2008Q4:1.2.0.10
	pkgsrc-2008Q4-base:1.2
	pkgsrc-2008Q3:1.2.0.8
	pkgsrc-2008Q3-base:1.2
	cube-native-xorg:1.2.0.6
	cube-native-xorg-base:1.2
	pkgsrc-2008Q2:1.2.0.4
	pkgsrc-2008Q2-base:1.2
	cwrapper:1.2.0.2
	pkgsrc-2008Q1:1.1.0.22
	pkgsrc-2008Q1-base:1.1
	pkgsrc-2007Q4:1.1.0.20
	pkgsrc-2007Q4-base:1.1
	pkgsrc-2007Q3:1.1.0.18
	pkgsrc-2007Q3-base:1.1
	pkgsrc-2007Q2:1.1.0.16
	pkgsrc-2007Q2-base:1.1
	pkgsrc-2007Q1:1.1.0.14
	pkgsrc-2007Q1-base:1.1
	pkgsrc-2006Q4:1.1.0.12
	pkgsrc-2006Q4-base:1.1
	pkgsrc-2006Q3:1.1.0.10
	pkgsrc-2006Q3-base:1.1
	pkgsrc-2006Q2:1.1.0.8
	pkgsrc-2006Q2-base:1.1
	pkgsrc-2006Q1:1.1.0.6
	pkgsrc-2006Q1-base:1.1
	pkgsrc-2005Q4:1.1.0.4
	pkgsrc-2005Q4-base:1.1
	pkgsrc-2005Q3:1.1.0.2;
locks; strict;
comment	@# @;


1.2
date	2008.04.19.05.38.16;	author obache;	state Exp;
branches;
next	1.1;

1.1
date	2005.10.05.13.38.13;	author salo;	state Exp;
branches
	1.1.2.1;
next	;

1.1.2.1
date	2005.10.05.13.38.13;	author snj;	state dead;
branches;
next	1.1.2.2;

1.1.2.2
date	2005.10.08.06.08.48;	author snj;	state Exp;
branches;
next	;


desc
@@


1.2
log
@Update weex to 2.6.1.5.
Based on patch provided by Zafer Aydogan via private mail.

This update to 2.6.1 contains all patches from the Debian package:
- various bug fixes
- uploading under the temporary name `weex.tmp' with the RenameOK option
- support for FTP proxy server that requires challenge/response
- The i386 RPM was compiled on RedHat 9
- You should be able to "rpmbuild --rebuild" the SRPM on older RedHat releases
  or other RPM based distros.

pkgsrc changes:
  * project now on sourceforge
  * no need patch to fix localedir (patch-ac)
  * need msgfmt to build
  * need gettext-lib
  * add DESTDIR support
@
text
@$NetBSD: patch-ad,v 1.1 2005/10/05 13:38:13 salo Exp $

Fix for SA17028, via FreeBSD.

--- src/log.c.orig	2003-08-18 09:52:38.000000000 +0000
+++ src/log.c
@@@@ -183,7 +183,7 @@@@ void log_flush(void)
 
 	fp=log_open();
 	for(i=0;i<max_log;i++){
-		fprintf(fp,log_str[i]);
+		fprintf(fp,"%s",log_str[i]);
 		free(log_str[i]);
 	}
 	free(log_str);
@


1.1
log
@Security fix for SA17028:

"A vulnerability in Weex can be exploited by malicious users to cause a DoS
(Denial of Service) or to compromise a vulnerable system.

The vulnerability is caused due to a format string error in the "log_flush()"
function when flushing an error log entry that contains format string
specifiers to disk. This may be exploited to execute arbitrary code on a
user's system via a directory name containing format string specifiers.

Successful exploitation requires that the attacker is able to create
directories within the user's Weex home directory."

http://secunia.com/advisories/17028/

Patch from FreeBSD PR ports/86833.
@
text
@d1 1
a1 1
$NetBSD$
d5 3
a7 3
--- src/log.c.orig	2000-05-03 16:42:05.000000000 +0200
+++ src/log.c	2005-10-05 15:31:06.000000000 +0200
@@@@ -182,7 +182,7 @@@@
@


1.1.2.1
log
@file patch-ad was added on branch pkgsrc-2005Q3 on 2005-10-05 13:38:13 +0000
@
text
@d1 15
@


1.1.2.2
log
@Pullup ticket 803 - requested by Lubomir Sedlacik
security fix for weex

Revisions pulled up:
- pkgsrc/www/weex/Makefile		1.9
- pkgsrc/www/weex/distinfo		1.4
- pkgsrc/www/weex/patches/patch-ad	1.1

   Module Name:    pkgsrc
   Committed By:   salo
   Date:           Wed Oct  5 13:38:13 UTC 2005

   Modified Files:
           pkgsrc/www/weex: Makefile distinfo
   Added Files:
           pkgsrc/www/weex/patches: patch-ad

   Log Message:
   Security fix for SA17028:

   "A vulnerability in Weex can be exploited by malicious users to cause a DoS
   (Denial of Service) or to compromise a vulnerable system.

   The vulnerability is caused due to a format string error in the "log_flush()"
   function when flushing an error log entry that contains format string
   specifiers to disk. This may be exploited to execute arbitrary code on a
   user's system via a directory name containing format string specifiers.

   Successful exploitation requires that the attacker is able to create
   directories within the user's Weex home directory."

   http://secunia.com/advisories/17028/

   Patch from FreeBSD PR ports/86833.
@
text
@a0 15
$NetBSD: patch-ad,v 1.1.2.1 2005/10/08 06:08:48 snj Exp $

Fix for SA17028, via FreeBSD.

--- src/log.c.orig	2000-05-03 16:42:05.000000000 +0200
+++ src/log.c	2005-10-05 15:31:06.000000000 +0200
@@@@ -182,7 +182,7 @@@@
 
 	fp=log_open();
 	for(i=0;i<max_log;i++){
-		fprintf(fp,log_str[i]);
+		fprintf(fp,"%s",log_str[i]);
 		free(log_str[i]);
 	}
 	free(log_str);
@