BSD Commit Log Search

   update to libunbound-1.24.2, CVE-2025-11411

   update to libunbound-1.24.2, further fix for CVE-2025-11411

   Update to unicode-cldr-48.

   Tor Browser: repair font fingerprinting defense

   I broke it during the update to 14.5 in April when I moved
   fonts.conf but forgot to update the launcher script.

   Tor Browser: repair font fingerprinting defense

   I broke it during the update to 14.5 in April when I moved
   fonts.conf but forgot to update the launcher script.

   SECURITY update to cups-2.4.15.
   CVE-2025-61915
   CVE-2025-58436

   Sync to unbound

   --------
   Fix incomplete mitigation of CVE-2025-11411 by applying the non-test part of
   https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-11411_2_wtests.diff

   This extends the previous fix by also scrubbing unsolicited NS RRSets (and
   their respective address records) for YXDOMAIN and nodata non-referral answers.
   --------

   Sync to unbound 1.24.1; heavy lifting by sthen (some time ago)

   Removing /var/db/gdm/.cache/gnome-shell/ does not seem necessary anymore.

   Update to libxslt-1.1.44.

   SECURITY update ot cups-2.4.15.
   CVE-2025-61915
   CVE-2025-58436

   Thus uses C++11 so use ports-gcc to build this on sparc64
   OK aja

   Drop explicit inclusion of gcc4 module and with that COMPILER and
   COMPILER_LANG can also be dropped. This is still using ports-gcc
   on gcc4 archs via lang/python.
   OK aja

   Clean up confusing logic in CMS_EncryptedData_encrypt()

   This makes it easier to read and more in line with other code in
   libcrypto. Also add a missing error check for the CMS_set_detached()
   call.

   ok jsing kenjiro

   Fix double free in certificate policies configuration

   In nref_nos(), nnums must not be freed on error because in the caller it
   is not->noticeref->noticenos and hangs off the POLICYQUALINFO qual which
   is freed as part of POLICYQUALINFO_free() in the error path.

   ok jsing kenjiro

   Ignore any iterator when traversing nd6 list.

   nd6_rtrequest() could crash with a NULL pointer dereference if an
   interator in nd6_list was inspected.  Skip freeing neigbor discovery
   entries and optimization in this unlikely case and try again later.

   reported by Mischa and Anton Kasimov; OK mvs@

   Update to cde-2.5.3.

   If there is no /memory node in the device tree, use the EFI memory map to
   determine physmem.

   ok jca@

   update to keeperrl 1.3

   Use LOGIN_SETXDGENV in login(1)

   Makes XDG_TUNTIME_DIR usable from text consoles.
   "makes sense to me" landry@, ok matthieu@ robert@

   update to fheroes2 1.1.12

   Update to gnome-control-center-49.2.1.

   Update to libproxy-0.5.12.

   Add missing GZIP_STATIC flag to SRVFLAG_BITS macro

   GZIP_STATIC flag at position \33 was missing from the debug string.

   Also correct the truncated PATH_REWRITE/NO_PATH_REWRITE flag names.
   The PATH_REWRITE and NO_PATH_REWRITE flag names were truncated to
   PATH and NO_PATH in the SRVFLAG_BITS string definition.

   OK kirill@ deraadt@

   Fix incomplete mitigation of CVE-2025-11411 by applying the non-test part of
   https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-11411_2_wtests.diff

   This extends the previous fix by also scrubbing unsolicited NS RRSets (and
   their respective address records) for YXDOMAIN and nodata non-referral answers.

   replace c-client's hand-rolled certificate checker with code to use
   SSL_set1_host based on debian's 1006_openssl1.1_autoverify.patch

   found with asterisk's imap voicemail code, which was whining about
   a letsencrypt certificate generated with 'profile tlsserver' (these
   don't include CN).

   help/ok tb@

   update to 21.1.6

   update to 0.72.1

   Add license and rcs header.

   ok tb

   Hook up wayland/cagebreak

   ok matthieu@