Next | Query returned 137 messages, browsing 61 to 70 | Previous

History of commit frequency

CVS Commit History:


   2014-02-03 17:38:53 by Thomas Klausner | Files touched by this commit (3)
Log message:
Mark as not ready for python-3.x.

finch does not compile with python-3.3. Since libpurple is not versioned
and finch pulls it in, we have to mark libpurple too, and then pidgin
because of libpurple. It's all one codebase anyway...
   2014-01-31 07:32:16 by OBATA Akio | Files touched by this commit (8)
Log message:
Update pidin to 2.10.8.

version 2.10.8 (1/28/2014):
	General:
	* Python build scripts and example plugins are now compatible with
	  Python 3. (Ashish Gupta) (#15624)

	libpurple:
	* Fix potential crash if libpurple gets an error attempting to read a
	  reply from a STUN server. (Discovered by Coverity static analysis)
	  (CVE-2013-6484)
	* Fix potential crash parsing a malformed HTTP response. (Discovered by
	  Jacob Appelbaum of the Tor Project) (CVE-2013-6479)
	* Fix buffer overflow when parsing a malformed HTTP response with
	  chunked Transfer-Encoding. (Discovered by Matt Jones, Volvent)
	  (CVE-2013-6485)
	* Better handling of HTTP proxy responses with negative Content-Lengths.
	  (Discovered by Matt Jones, Volvent)
	* Fix handling of SSL certificates without subjects when using libnss.
	* Fix handling of SSL certificates with timestamps in the distant future
	  when using libnss. (#15586)
	* Impose maximum download size for all HTTP fetches.

	Pidgin:
	* Fix crash displaying tooltip of long URLs. (CVE-2013-6478)
	* Better handling of URLs longer than 1000 letters.
	* Fix handling of multibyte UTF-8 characters in smiley themes. (#15756)

	Windows-Specific Changes:
	* When clicking file:// links, show the file in Explorer rather than
	  attempting to run the file. This reduces the chances of a user
	  clicking on a link and mistakenly running a malicious file.
	  (Originally discovered by James Burton, Insomnia Security. Rediscovered
	  by Yves Younan of Sourcefire VRT.) (CVE-2013-6486)
	* Fix Tcl scripts. (#15520)
	* Fix crash-on-startup when ASLR is always on. (#15521)
	* Updates to dependencies:
		* NSS 3.15.4 and NSPR 4.10.2
		* Pango 1.29.4-1daa
			Patched for https://bugzilla.gnome.org/show_bug.cgi?id=668154

	AIM:
	* Fix untrusted certificate error.

	AIM and ICQ:
	* Fix a possible crash when receiving a malformed message in a Direct IM
	  session.

	Gadu-Gadu:
	* Fix buffer overflow with remote code execution potential. Only
	  triggerable by a Gadu-Gadu server or a man-in-the-middle.
	  (Discovered by Yves Younan and Ryan Pentney of Sourcefire VRT)
	  (CVE-2013-6487)
	* Disabled buddy list import/export from/to server (it didn't work
	  anymore). Buddy list synchronization will be implemented in 3.0.0.
	* Disabled new account registration and password change options, as it
	  didn't work either. Account registration also caused a crash. Both
	  functions are available using official Gadu-Gadu website.

	IRC:
	* Fix bug where a malicious server or man-in-the-middle could trigger
	  a crash by not sending enough arguments with various messages.
	  (Discovered by Daniel Atallah) (CVE-2014-0020)
	* Fix bug where initial IRC status would not be set correctly.
	* Fix bug where IRC wasn't available when libpurple was compiled with
	  Cyrus SASL support. (#15517)

	MSN:
	* Fix NULL pointer dereference parsing headers in MSN.
	  (Discovered by Fabian Yamaguchi and Christian Wressnegger of the
	  University of Goettingen) (CVE-2013-6482)
	* Fix NULL pointer dereference parsing OIM data in MSN.
	  (Discovered by Fabian Yamaguchi and Christian Wressnegger of the
	  University of Goettingen) (CVE-2013-6482)
	* Fix NULL pointer dereference parsing SOAP data in MSN.
	  (Discovered by Fabian Yamaguchi and Christian Wressnegger of the
	  University of Goettingen) (CVE-2013-6482)
	* Fix possible crash when sending very long messages. Not
	  remotely-triggerable. (Discovered by Matt Jones, Volvent)

	MXit:
	* Fix buffer overflow with remote code execution potential.
	  (Discovered by Yves Younan and Pawel Janic of Sourcefire VRT)
	  (CVE-2013-6487)
	* Fix sporadic crashes that can happen after user is disconnected.
	* Fix crash when attempting to add a contact via search results.
	* Show error message if file transfer fails.
	* Fix compiling with InstantBird.
	* Fix display of some custom emoticons.

	SILC:
	* Correctly set whiteboard dimensions in whiteboard sessions.

	SIMPLE:
	* Fix buffer overflow with remote code execution potential.
	  (Discovered by Yves Younan of Sourcefire VRT) (CVE-2013-6487)

	XMPP:
	* Prevent spoofing of iq replies by verifying that the 'from' address
	  matches the 'to' address of the iq request. (Discovered by Fabian
	  Yamaguchi and Christian Wressnegger of the University of Goettingen)
	  (CVE-2013-6483)
	* Fix crash on some systems when receiving fake delay timestamps with
	  extreme values. (Discovered by Jaime Breva Ribes) (CVE-2013-6477)
	* Fix possible crash or other erratic behavior when selecting a very
	  small file for your own buddy icon.
	* Fix crash if the user tries to initiate a voice/video session with a
	  resourceless JID.
	* Fix login errors when the first two available auth mechanisms fail but
	  a subsequent mechanism would otherwise work when using Cyrus SASL.
	  (#15524)
	* Fix dropping incoming stanzas on BOSH connections when we receive
	  multiple HTTP responses at once. (Issa Gorissen) (#15684)

	Yahoo!:
	* Fix possible crashes handling incoming strings that are not UTF-8.
	  (Discovered by Thijs Alkemade and Robert Vehse) (CVE-2012-6152)
	* Fix a bug reading a peer to peer message where a remote user could
	  trigger a crash. (CVE-2013-6481)

	Plugins:
	* Fix crash in contact availability plugin.
	* Fix perl function Purple::Network::ip_atoi
	* Add Unity integration plugin.
   2014-01-30 23:12:05 by Thomas Klausner | Files touched by this commit (2)
Log message:
Mark as not yet ready for python-3.x.
   2013-10-10 16:42:40 by Ryo ONODERA | Files touched by this commit (1058)
Log message:
Recursive revbump from pango-1.36.0
   2013-09-02 21:51:33 by Adam Ciarcinski | Files touched by this commit (1071) | Package updated
Log message:
Revbump after cairo update
   2013-06-06 14:55:24 by Thomas Klausner | Files touched by this commit (1687)
Log message:
Bump PKGREVISION for libXft changes for NetBSD native X support on
NetBSD 6, requested by tron.
   2013-06-05 00:17:35 by Matthias Scheler | Files touched by this commit (1946)
Log message:
Try to fix the fallout caused by the fix for PR pkg/47882. Part 3:

Recursively bump package revisions again after the "freetype2" and
"fontconfig" handling was fixed.
   2013-06-03 12:06:28 by Thomas Klausner | Files touched by this commit (1948)
Log message:
Bump freetype2 and fontconfig dependencies to current pkgsrc versions,
to address issues with NetBSD-6(and earlier)'s fontconfig not being
new enough for pango.

While doing that, also bump freetype2 dependency to current pkgsrc
version.

Suggested by tron in PR 47882
   2013-03-03 08:17:25 by OBATA Akio | Files touched by this commit (8)
Log message:
Update pidgin to 2.10.7.

version 2.10.7 (02/13/2013):
	Alien hatchery:
	* No changes

	General:
	* The configure script will now exit with status 1 when specifying
	  invalid protocol plugins using the --with-static-prpls and
	  --with-dynamic-prpls arguments. (Michael Fiedler) (#15316)

	libpurple:
	* Fix a crash when receiving UPnP responses with abnormally long values.
	  (CVE-2013-0274)
	* Don't link directly to libgcrypt when building with GnuTLS support.
	  (Bartosz Brachaczek) (#15329)
	* Fix UPnP mappings on routers that return empty <URLBase/> elements
	  in their response. (Ferdinand Stehle) (#15373)
	* Tcl plugin uses saner, race-free plugin loading.
	* Fix the Tcl signals-test plugin for savedstatus-changed.
	  (Andrew Shadura) (#15443)

	Pidgin:
	* Make Pidgin more friendly to non-X11 GTK+, such as MacPorts' +no_x11
	  variant.

	Gadu-Gadu:
	* Fix a crash at startup with large contact list. Avatar support for
	  buddies will be disabled until 3.0.0. (#15226, #14305)

	IRC:
	* Support for SASL authentication. (Thijs Alkemade, Andy Spencer)
	  (#13270)
	* Print topic setter information at channel join. (#13317)

	MSN:
	* Fix SSL certificate issue when signing into MSN for some users.
	* Fix a crash when removing a user before its icon is loaded. (Mark
	  Barfield) (#15217)

	MXit:
	* Fix a bug where a remote MXit user could possibly specify a local
	  file path to be written to. (CVE-2013-0271)
	* Fix a bug where the MXit server or a man-in-the-middle could
	  potentially send specially crafted data that could overflow a buffer
	  and lead to a crash or remote code execution. (CVE-2013-0272)
	* Display farewell messages in a different colour to distinguish
	  them from normal messages.
	* Add support for typing notification.
	* Add support for the Relationship Status profile attribute.
	* Remove all reference to Hidden Number.
	* Ignore new invites to join a GroupChat if you're already joined, or
	  still have a pending invite.
	* The buddy's name was not centered vertically in the buddy-list if they
	  did not have a status-message or mood set.
	* Fix decoding of font-size changes in the markup of received messages.
	* Increase the maximum file size that can be transferred to 1 MB.
	* When setting an avatar image, no longer downscale it to 96x96.

	Sametime:
	* Fix a crash in Sametime when a malicious server sends us an abnormally
	  long user ID. (CVE-2013-0273)

	Yahoo!:
	* Fix a double-free in profile/picture loading code. (Mihai Serban)
	  (#15053)
	* Fix retrieving server-side buddy aliases. (Catalin Salgu) (#15381)

	Plugins:
	* The Voice/Video Settings plugin supports using the sndio GStreamer
	  backends. (Brad Smith) (#14414)
	* Fix a crash in the Contact Availability Detection plugin. (Mark)
	  (#15327)
	* Make the Message Notification plugin more friendly to non-X11 GTK+,
	  such as MacPorts' +no_x11 variant.
   2013-02-16 12:25:34 by Thomas Klausner | Files touched by this commit (1885)
Log message:
Recursive bump for png-1.6.

Next | Query returned 137 messages, browsing 61 to 70 | Previous