www/freenginx: update njs 0.9.8 -> 0.9.9
Bump PKGREVISION.
Sponsored by: tipi.work
<ChangeLog>
nginx modules:
*) Security: a heap buffer overflow might occur in a worker process
when the "js_fetch_proxy" directive value contains nginx
variables derived from the client request ($http_*, $arg_*,
$cookie_*, etc.) and the location's JS handler invokes
ngx.fetch(). The issue was introduced in dea83189 (0.9.4).
*) Feature: added js_access directive.
*) Feature: added r.readRequestText(), r.readRequestArrayBuffer(),
[21 lines not shown]
www/freenginx-devel: update from 1.31.0 to 1.31.1
Sponsored by: tipi.work
<ChangeLog>
*) Feature: the "off" parameter of the "index" directive.
Thanks to Fabiano Furtado.
*) Bugfix: a segmentation fault might occur in a worker process if the
"rewrite" directive was used to change request arguments and other
directives of the ngx_http_rewrite_module were executed afterwards.
*) Bugfix: in the "set" directive.
*) Bugfix: a segmentation fault might occur in a worker process if the
ngx_http_charset_module was used to convert responses from UTF-8.
*) Bugfix: in the ngx_http_charset_module.
[12 lines not shown]
www/freenginx-devel: update njs 0.9.8 -> 0.9.9
Bump PKGREVISION.
Sponsored by: tipi.work
<ChangeLog>
nginx modules:
*) Security: a heap buffer overflow might occur in a worker process
when the "js_fetch_proxy" directive value contains nginx
variables derived from the client request ($http_*, $arg_*,
$cookie_*, etc.) and the location's JS handler invokes
ngx.fetch(). The issue was introduced in dea83189 (0.9.4).
*) Feature: added js_access directive.
*) Feature: added r.readRequestText(), r.readRequestArrayBuffer(),
[21 lines not shown]
rsync: updated to 3.4.3
rsync 3.4.3 (20 May 2026)
Changes in this version:
SECURITY FIXES:
Six CVEs are fixed in this release. All six are assigned by
VulnCheck as CNA. Affected versions are 3.4.2 and earlier in every
case. Three of the six (CVE-2026-29518, CVE-2026-43617,
CVE-2026-43619) require non-default daemon configuration to reach:
the first and third need `use chroot = no` for a module, the second
needs `daemon chroot = ...` set in rsyncd.conf. Two (CVE-2026-43618,
CVE-2026-43620) are reachable from a normal pull or a normal
authenticated daemon connection. The sixth (CVE-2026-45232) is
reachable only when `RSYNC_PROXY` is set and the proxy (or a MITM)
returns a pathological response. Many thanks to the external
researchers who reported these issues.
[128 lines not shown]
(devel/R-Rcpp) Updated 1.0.14 to 1.1.1.1.1
(pkgsrc)
- Three patches dropped
- Added patch for src/Makevars (by looking at devel/R-fs)
to take care the issue of not finding the function backtrace_symbol
(Atsushi Toyokura helped me a lot on this modification)
- Tested only on NetBSD (9.4), Linux and SunOS are not tested, sorry
(upstream)
Changes in Rcpp non-release version 1.1.1-1.1 (2026-04-19):
* Please see pr #1466 addressing #1465 for context (plus change
from #1460, and R_getRegisteredNamespace from #1469)
* This is an unplanned, unscheduled and uncalled for
non-release made solely to unplug CRAN from late-breaking
changes in R 4.6.0
[165 lines not shown]
unbound: updated to 1.25.1
1.25.1
Bug Fixes
Fix CVE-2026-33278, Possible remote code execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42959, Crash during DNSSEC validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-41292, Parsing a long list of incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo Alto Networks, for the report.
Fix CVE-2026-42534, Jostle logic bypass degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42960, Possible cache poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and JianJun Chen, Tsinghua University, for the report.
Fix CVE-2026-44390, Unbounded name compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
