GitLab

CVE-2016-9847: Unsafe generation of blowfish secret
CVE-2016-9848: phpinfo information leak value of sensitive (HttpOnly) cookies
CVE-2016-9849: Username deny rules bypass (AllowRoot & Others) by using Null Byte
CVE-2016-9850: Username rule matching issues
CVE-2016-9851: With a crafted request parameter value it is possible to bypass the logout timeout.
CVE-2016-9852 CVE-2016-9853 CVE-2016-9854 CVE-2016-9855: Multiple full path disclosure vulnerabilities
CVE-2016-9856 CVE-2016-9857: Multiple XSS vulnerabilities
CVE-2016-9858 CVE-2016-9859 CVE-2016-9860: We consider these vulnerabilities to be of moderate severity.
CVE-2016-9861: Bypass white-list protection for URL redirection
CVE-2016-9862: BBCode injection vulnerability
CVE-2016-9863: DOS vulnerability in table partitioning
CVE-2016-9864: Multiple SQL injection vulnerabilities
CVE-2016-9865: Incorrect serialized string parsing
CVE-2016-9866: CSRF token not stripped from the URL

- Upgrade to 5.1.12
- Init script on start loads vboxsf, which mounts any shared directories
- Init script on stop umounts any vboxsf filesystems and unloads vboxsf

Update musl-fixes.patch

fixes #6590

Based on the Debian handling of grub-xen-host

grub2-accept-empty-module.patch from http://savannah.gnu.org/bugs/?49012

http://boost.org/build
Boost.Build makes it easy to build C++ projects, everywhere

Builds monkey with jemalloc to fix a seg fault issue when built
with built-in malloc.

CVE-2016-10009, CVE-2016-10010, CVE-2016-10011, CVE-2016-10012

And cosmetic fixes in init-script and APKBUILD.

fixes depends: perl-test-tester ==> perl-test-simple

Enable libmagic support