16:38 pi 

graphics/libwmf: update 0.2.8.4 -> 0.2.12

- Switch to active fork (removes the need to patch for mutliple CVEs)
  This is what Alpine Linux, Arch Linux, Debian and Fedora uses.
- Add patch to use pkg-config (pkgconfig) to detect freetype(2)

References:
https://github.com/caolanm/libwmf (no proper release notes available)
https://github.com/archlinux/svntogit-packages/blob/packages/libwmf/trunk/libwmf-freetype.patch

PR:		252114
Submitted by:	daniel.engberg.lists@pyret.net

 

11:50 junovitch 

graphics/libwmf: Fix bug introduced by patch for CVE-2015-4696

- The original CVE-2015-4696 patch from upstream was missing line numbers
  in the first patch hunk.  The security issue was resolved by the
  restructured code but a new potential bug was introduced in the process.
- While here, update to my FreeBSD.org email

PR:		201513
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Obtained from:	Fedora libwmf RPM git (commit c8bc53c1)
Approved by:	feld (mentor)
MFH:		2015Q3

 

16:47 feld 

- Assign maintainership
- Resolve backlog of CVEs

PR:		201513
Reported by:	Sevan Janiyan
Submitted by:	Jason Unovitch (maintainer)
Security:	CVE-2004-0941 [1]
Security:	CVE-2007-0455 [1]
Security:	CVE-2007-2756 [1]
Security:	CVE-2007-3472 [1]
Security:	CVE-2007-3473 [1]
Security:	CVE-2007-3477 [1]
Security:	CVE-2009-3546 [1]
Security:	CVE-2015-4695 [2]
Security:	CVE-2015-4696 [3]
Security:	CVE-2015-0848 [4]
Security:	CVE-2015-4588 [4]
Security:	ca139c7f-2a8c-11e5-a4a5-002590263bf5
Obtained From:	CentOS libwmf RPM git [1]
Obtained From:	Debian Bug 784205 [2]
Obtained From:	Debian Bug 784192 [3]
Obtained From:	Red Hat Bug 1227243 [4]
MFH:		2015Q3