pkg/49794: Maintainer update: net/tor to 0.2.5.11 (security fix)

[reezer%reezer.org@localhost]

>Number:         49794
>Category:       pkg
>Synopsis:       Maintainer update: net/tor to 0.2.5.11 (security fix)
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 27 09:45:00 +0000 2015
>Originator:     Christian Sturm
>Release:        
>Organization:
>Environment:
>Description:
This patch updates net/tor to 0.2.5.10 to 0.2.5.11. It fixes a security vulnerability so it should be pulled up into the pkgsrc stable branch once committed to the tree.

Changes in version 0.2.5.11 - 2015-03-17
  Tor 0.2.5.11 is the second stable release in the 0.2.5 series.

  It backports several bugfixes from the 0.2.6 branch, including a
  couple of medium-level security fixes for relays and exit nodes.
  It also updates the list of directory authorities.

  o Directory authority changes:
    - Remove turtles as a directory authority.
    - Add longclaw as a new (v3) directory authority. This implements
      ticket 13296. This keeps the directory authority count at 9.
    - The directory authority Faravahar has a new IP address. This
      closes ticket 14487.

  o Major bugfixes (crash, OSX, security):
    - Fix a remote denial-of-service opportunity caused by a bug in
      OSX's _strlcat_chk() function. Fixes bug 15205; bug first appeared
      in OSX 10.9.

  o Major bugfixes (relay, stability, possible security):
    - Fix a bug that could lead to a relay crashing with an assertion
      failure if a buffer of exactly the wrong layout was passed to
      buf_pullup() at exactly the wrong time. Fixes bug 15083; bugfix on
      0.2.0.10-alpha. Patch from 'cypherpunks'.
    - Do not assert if the 'data' pointer on a buffer is advanced to the
      very end of the buffer; log a BUG message instead. Only assert if
      it is past that point. Fixes bug 15083; bugfix on 0.2.0.10-alpha.

  o Major bugfixes (exit node stability):
    - Fix an assertion failure that could occur under high DNS load.
      Fixes bug 14129; bugfix on Tor 0.0.7rc1. Found by "jowr";
      diagnosed and fixed by "cypherpunks".

  o Major bugfixes (Linux seccomp2 sandbox):
    - Upon receiving sighup with the seccomp2 sandbox enabled, do not
      crash during attempts to call wait4. Fixes bug 15088; bugfix on
      0.2.5.1-alpha. Patch from "sanic".

  o Minor features (controller):
    - New "GETINFO bw-event-cache" to get information about recent
      bandwidth events. Closes ticket 14128. Useful for controllers to
      get recent bandwidth history after the fix for ticket 13988.

  o Minor features (geoip):
    - Update geoip to the March 3 2015 Maxmind GeoLite2 Country database.
    - Update geoip6 to the March 3 2015 Maxmind GeoLite2
      Country database.

  o Minor bugfixes (client, automapping):
    - Avoid crashing on torrc lines for VirtualAddrNetworkIPv[4|6] when
      no value follows the option. Fixes bug 14142; bugfix on
      0.2.4.7-alpha. Patch by "teor".
    - Fix a memory leak when using AutomapHostsOnResolve. Fixes bug
      14195; bugfix on 0.1.0.1-rc.

  o Minor bugfixes (compilation):
    - Build without warnings with the stock OpenSSL srtp.h header, which
      has a duplicate declaration of SSL_get_selected_srtp_profile().
      Fixes bug 14220; this is OpenSSL's bug, not ours.

  o Minor bugfixes (directory authority):
    - Allow directory authorities to fetch more data from one another if
      they find themselves missing lots of votes. Previously, they had
      been bumping against the 10 MB queued data limit. Fixes bug 14261;
      bugfix on 0.1.2.5-alpha.
    - Enlarge the buffer to read bwauth generated files to avoid an
      issue when parsing the file in dirserv_read_measured_bandwidths().
      Fixes bug 14125; bugfix on 0.2.2.1-alpha.

  o Minor bugfixes (statistics):
    - Increase period over which bandwidth observations are aggregated
      from 15 minutes to 4 hours. Fixes bug 13988; bugfix on 0.0.8pre1.

  o Minor bugfixes (preventative security, C safety):
    - When reading a hexadecimal, base-32, or base-64 encoded value from
      a string, always overwrite the whole output buffer. This prevents
      some bugs where we would look at (but fortunately, not reveal)
      uninitialized memory on the stack. Fixes bug 14013; bugfix on all
      versions of Tor.

>How-To-Repeat:

>Fix:
begin 644 tor-0.2.5.11.patch.gz
M'XL("*(B%54``W1O<BTP+C(N-2XQ,2YP871C:`"]D5U+PS`4AJ_77Y%+A;7-
MR7>&$T0%=S$OK'\@'R>C3%IIR]#]>CMU;'[L2C`00LC)<]XG63017V9DZ=:8
MZB?,YG\?V<-U17:P&2G#IN_:=BB?UZN^"V6#0SFT7;EO-]UD'0Y=C9NZ69%N
M7/JZ;0@40&D6ZY1(WKUO#@%YX-D%N5E4C_=7R]OY9#+R<EJP0HYU69[GV>6)
M4\@6'[*Q[H>Z2>T_R>[;G915<'!5<(C'IS*,<]2M[JZ`G!V;%H/KBM7VG,P)
M**HY^`31>ZG!)AN9X`R]%5%S8QSUT0;</=O#\F:L/DERE`8*J&SR*@H7+4K*
M8K`L@$XJ\8`F,)MVI*K>XDD.!Z6$H<2_#MA__LD/!?AR01N!"8)&(;BGZ)PV
M$IVQ8+4SD;/HM.5JY/RB<$P2B<7D`3BPI)RT#$0T03HA@]%!118I3]J;7:+O
2"E\2<:!<[A7>`##J.=LF`P``
`
end