see #10814

see #11329

see #11328

see #11307

see #10919

Milan P. Stanić authored 5 years ago and Leo committed 5 years ago

backported security fixes from upstream:

radius: Prevent buffer overflow in rc_mksid()
pppd: Fix bounds check in EAP code
pppd: Ignore received EAP messages when not doing EAP
add 'secfixes'

see #11288

Disabled ssl support, since according with http://www.live555.com/liveMedia/
RTSP-over-TLS is sill in to-do list:

* support for SRTP ('secure' RTP), and perhaps also RTSP-over-TLS.

Cherry-picked from edge.
Fixes: alpine/aports#11273

This re-arranges the contents of ncurses-terminfo-base so it contains
all the terminfo entries for commonly used TERMs like xterm256-color.

It also includes all terminfo entries for terminals we package like
alacritty, gnome-terminal, konsole, kitty, st, etc. And a few others
like putty, tmux and vte.

The ncurses-terminfo-base packaged increased from 94.21 kB to 126.98 kB,
a quite small increase when considering that now it is in the majority
of cases the only package one has to install instead of having to rely
on the massive ncurses-terminfo package.

TBK authored 5 years ago and Leo committed 5 years ago

Most distros uses 1.12.13 (https://repology.org/project/cvs/versions) but according to Gentoo it is usable, so following Gentoo (https://bugs.gentoo.org/124733) 1.12.12 is the way forward.

CVEs:
* CVE-2010-3846 - https://bugzilla.redhat.com/show_bug.cgi?id=642146
* CVE-2012-0804 - https://security-tracker.debian.org/tracker/CVE-2012-0804
* CVE-2017-12836 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10

The -libs subpackage depended on ncurses-terminfo when it shouldn't
because when moving $pkgdir/usr/lib also moved /usr/lib/terminfo which
is a symlink to /usr/share/terminfo which is part of ncurses-terminfo
and thus a dependency would be automatically added by the
prepare_symlink() function from APKBUILD.

So make the libs() function grab only actual libraries by matching
/usr/lib/*.so.* (this does not match libraries meant for -dev which
would be *.so) so /usr/lib/terminfo isn't caught up.

Also make the terminfo() function move /usr/lib/terminfo to it.

In the meantime also do other cleanup like removing unnecessary 'cd
"$builddir"' declarations and make libs() depend on the same
$pkgver-r$pkgrel of the ncurses-terminfo-base.

fixes #11250

define ciphers for better security and performance
close inactive SAs
fix race conditions

fixes #11189

(cherry picked from commit a60544e5)

J0WI authored 5 years ago and Natanael Copa committed 5 years ago

(cherry picked from commit 18df15db)

prspkt authored 5 years ago and Natanael Copa committed 5 years ago

(cherry picked from commit 1573948f)

J0WI authored 5 years ago and Natanael Copa committed 5 years ago

fixes #11150

tony mancill authored 5 years ago and Natanael Copa committed 5 years ago

Update openjdk8 pacakge to 8.232.09 / icedtea 3.14.0

- drop icedtea-jdk-tls-nist-curves.patch (applied upstream)
- refresh icedtea-hotspot-musl.patch to apply against 3.14.0

ref #11156

CVE-2019-14902, CVE-2019-14907, CVE-2019-19344

ref #11155