ImageMagick, libarchive, libogg, libvorbis, udisks2: new upstream release

cmake, gvfs, kdeutils, totem-pl-parser: rebuild with libarchive-3.0.4
cvs, pam, patch, t1lib: rebuild package

git-svn-id: http://trac.vinelinux.org/repos/projects/specs@6304 ec354946-7b23-47d6-9f5a-488ba84defc7

I/ImageMagick/ImageMagick-vl.spec

@@ -1,8 +1,8 @@
 # ImageMagick has adopted a new Version.Patchlevel version numbering system...
 # 6.2.9.7 is actually version 6.2.9, Patchlevel 0.
 
-%define VER 6.7.6
-%define Patchlevel 8
+%define VER 6.7.7
+%define Patchlevel 6
 
 Name: ImageMagick
 Summary: X application for displaying and manipulating images.
@@ -211,6 +211,7 @@ ImageMagick-perl パッケージをインストールして下さい．
     --with-quantum-depth=16 \
     --without-frozenpaths \
     --with-x \
+    --without-dps \
     --without-djvu \
     --without-fftw \
     --without-jbig \
@@ -281,7 +282,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/libMagickWand.so.*
 %{_bindir}/[a-z]*
 %{_sysconfdir}/%{name}/*.xml
-%{_sysconfdir}/%{name}/*.icc
+#{_sysconfdir}/%{name}/*.icc
 %{_mandir}/man1/ImageMagick.*
 %{_mandir}/man1/[a-z]*
 
@@ -327,6 +328,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man3/*
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 6.7.7.6-1
+- new upstream release
+
 * Sun May 06 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 6.7.6.8-1
 - new upstream release
 

c/cmake/cmake-vl.spec

@@ -8,7 +8,7 @@ Name: cmake
 Summary: Cross-platform make system
 Summary(ja): クロスプラットフォームな Make システム
 Version: 2.8.6
-Release: 1%{?_dist_release}
+Release: 2%{?_dist_release}
 
 Group: Development/Tools
 License: BSD
@@ -139,6 +139,9 @@ update-mime-database %{_datadir}/mime &> /dev/null || :
 
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 2.8.6-2
+- - rebuild with libarchive-3.0.4
+
 * Sat Nov 19 2011 Ryoichi INAGAKI <ryo1@bc.wakwak.com> 2.8.6-1
 - new upstream release
 - forced to link with libtinfo.so (ccmake)

c/cvs/cvs-vl.spec

@@ -4,7 +4,7 @@ Summary: A version control system.
 Summary(ja): バージョン管理システム
 Name: cvs
 Version: %{version}
-Release: 4%{?_dist_release}
+Release: 5%{?_dist_release}
 License: GPL
 Group: Development/Tools
 URL: http://www.cvshome.org/
@@ -14,6 +14,8 @@ Patch2: cvs-1.12.13-authserver.patch
 Patch3: cvs-1.11.2-cvspass.patch
 Patch5: cvs-1.11.2-install.patch 
 Patch101: can-2005-2693.patch
+Patch102: cvs-1.12.13_CVE-2012-0804.patch
+
 Requires(pre): install-info
 Prefix: %{_prefix}
 Buildroot: %{_tmppath}/%{name}-%{version}-root
@@ -22,6 +24,9 @@ BuildRequires: zlib-devel
 BuildRequires: openssl-devel
 BuildRequires: vim
 
+Vendor: Project Vine
+Distribution: Vine Linux
+
 # for perl
 %define __find_requires %{SOURCE100}
 
@@ -62,6 +67,7 @@ CVS は，ソースファイルを複数の開発者が同時に編集する際
 %patch3 -p1 -b .cvspass
 %patch5 -p1 -b .install
 %patch101 -p1 -b .can-2005-2693
+%patch102 -p1 -b .CVE-2012-0804
 
 %build
 %configure --with-external-zlib
@@ -107,6 +113,10 @@ fi
 %{_datadir}/cvs
 
 %changelog
+* Fri Feb 10 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp>1.12.13-5vl6
+- add patch102 for fix CVE-2012-0804 (heap overflow in the CVS client)
+- add Vendor / Distri Tags
+
 * Sat Apr  2 2011 IWAI, Masaharu <iwai@alib.jp> 1.12.13-4vl6
 - build with krb5-libs 1.8.2
 - add doc/*.pdf in %%doc

g/gvfs/gvfs-vl.spec

@@ -2,7 +2,7 @@ Summary: Backends for the gio framework in GLib
 Summary(ja): GLib の GIO フレームワークのバックエンド
 Name: gvfs
 Version: 1.12.3
-Release: 1%{?_dist_release}
+Release: 2%{?_dist_release}
 License: LGPLv2+
 Group: System Environment/Libraries
 URL: http://www.gtk.org
@@ -303,6 +303,9 @@ killall -USR1 gvfsd >&/dev/null || :
 
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.12.3-2
+- rebuild with libarchive-3.0.4
+
 * Sun May 20 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.12.3-1
 - new upstream release
 

k/kdeutils/kdeutils-vl.spec

@@ -2,7 +2,7 @@ Name: kdeutils
 Summary: KDE Utilities
 Summary(ja): KDE ユーティリティ集
 Version: 4.7.0
-Release: 2%{?_dist_release}
+Release: 3%{?_dist_release}
 
 License: GPLv2
 Group: Applications/System
@@ -211,6 +211,9 @@ fi
 %{_datadir}/kde4/apps/printer-applet
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 4.7.0-3
+- rebuild with libarchive-3.0.4
+
 * Sun Feb 26 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 4.7.0-2
 - rebuild with python-2.7.2
 

lib/liba/libarchive/libarchive-vl.spec

@@ -1,7 +1,7 @@
 Name:          libarchive
 Summary:       A library for handling streaming archive formats 
-Version:       2.8.4
-Release:       4%{?_dist_release}
+Version:       3.0.4
+Release:       1%{?_dist_release}
 
 Group:         System Environment/Libraries
 License:       BSD
@@ -74,6 +74,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/pkgconfig/*.pc
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 3.0.4-1
+- new upstream release
+
 * Thu May 19 2011 Yoji TOYODA <bsyamato@sea.plala.or.jp> 2.8.4-4
 - add BuildRequires: openssl-devel, libxml2-devel
 

lib/libo/libogg/libogg-vl.spec

@@ -2,14 +2,14 @@
 
 Summary:	The Ogg bitstream file format library.
 Name:		libogg
-Version:	1.2.0
+Version:	1.3.0
 Release:	1%{?_dist_release}
 
 Group:		System Environment/Libraries
 License:	BSD
 URL:		http://www.xiph.org/
 
-Source:		http://downloads.xiph.org/releases/ogg/%{name}-%{version}.tar.gz
+Source:		http://downloads.xiph.org/releases/ogg/%{name}-%{version}.tar.xz
 
 BuildRoot:	%{_tmppath}/%{name}-%{version}-root
 BuildRequires:  perl
@@ -114,6 +114,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/lib*.la
 %endif
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.3.0-1
+- new upstream release
+
 * Tue Sep 21 2010 Ryoichi INAGAKI <ryo1@bc.wakwak.com> 1.2.0-1
 - new upstream release
 - built with rpm-4.8.1

lib/libp/libpng/libpng-vl.spec

@@ -4,10 +4,14 @@ Summary: A library of functions for manipulating PNG image format files.
 Summary(ja): PNG画像形式ファイル操作用の関数ライブラリ
 Name: libpng
 Version: 1.2.46
-Release: 1%{_dist_release}
+Release: 3%{_dist_release}
 License: distributable
 Group: System Environment/Libraries
 Source: ftp://ftp.simplesystems.org/pub/libpng/png/src/%{name}-%{version}.tar.bz2
+Patch100: libpng-1.2.xx_CVE-2011-3026.patch
+Patch110: libpng-1.2.xx_CVE-2011-3045.patch
+Patch120: libpng-1.2.xx_CVE-2011-3048.patch
+
 Buildroot: %{_tmppath}/%{name}-%{version}-root
 BuildPrereq: zlib-devel
 Requires: zlib
@@ -99,6 +103,9 @@ the libpng package.
 #'
 %prep
 %setup -q
+%patch100 -p1 -b .CVE-2011-3026
+%patch110 -p1 -b .CVE-2011-3045
+%patch120 -p1 -b .CVE-2011-3048
 
 %build
 #./autogen.sh
@@ -156,6 +163,13 @@ the libpng package.
 %endif
 
 %changelog
+* Sat Apr 28 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 2:1.2.46-3vl6
+- add patch110 for fix CVE-2011-3045 
+- add patch120 for fix CVE-2011-3048 (png_set_text2())
+
+* Sat Feb 18 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 2:1.2.46-2
+- add patch100 for fix CVE-2011-3026
+
 * Wed Jul 13 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 2:1.2.46-1
 - new upstream release with security fix (VU#819894)
 - add Vendor/Distri tags

lib/libv/libvorbis/libvorbis-vl.spec

@@ -1,11 +1,11 @@
 %define build_compat32 %{?_with_compat32:1}%{!?_with_compat32:0}
-%define liboggver 1.2.0
+%define liboggver 1.3.0
 %define epoch_num 1
 
 Summary:	The Vorbis General Audio Compression Codec.
 Summary(ja):	Vorbis - 汎用オーディオ圧縮コーデック
 Name:		libvorbis
-Version:	1.3.1
+Version:	1.3.3
 Release:	1%{?_dist_release}
 Epoch:          %{epoch_num}
 
@@ -13,7 +13,7 @@ Group:		System Environment/Libraries
 License:	BSD
 URL:		http://www.xiph.org/
 
-Source:		http://downloads.xiph.org/releases/vorbis/%{name}-%{version}.tar.bz2
+Source:		http://downloads.xiph.org/releases/vorbis/%{name}-%{version}.tar.xz
 
 BuildRoot:	%{_tmppath}/%{name}-%{version}-root
 BuildRequires:	libogg-devel >= %{liboggver}
@@ -146,6 +146,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/lib*.la
 %endif
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.3.3-1
+- new upstream release
+
 * Tue Sep 21 2010 Ryoichi INAGAKI <ryo1@bc.wakwak.com> 1.3.1-1
 - new upstream release
 - built with rpm-4.8.1

p/pam/pam-vl.spec

@@ -6,7 +6,7 @@ Summary: A security tool which provides authentication for applications
 Summary(ja): アプリケーションに認証の仕組みを提供するセキュリティツール
 Name: pam
 Version: 1.1.1
-Release: 7%{?_dist_release}
+Release: 8%{?_dist_release}
 # The library is BSD licensed with option to relicense as GPLv2+ - this option is redundant
 # as the BSD license allows that anyway. pam_timestamp and pam_console modules are GPLv2+
 License: BSD and GPLv2+
@@ -35,6 +35,8 @@ Patch700: pam-0.99.9-sg-dev.patch
 Patch1009:  pam-1.1.1-drop-privs.patch
 # fix CVE-2010-3853
 Patch1010: pam-1.1.1-cve-2010-3853.patch
+Patch1020: pam-1.1.1_CVE-2011-3148.patch
+Patch1030: pam-1.1.1_CVE-2011-3149.patch
 
 %define _sbindir /sbin
 %define _moduledir /%{_lib}/security
@@ -79,6 +81,8 @@ BuildRequires: db4-devel
 Conflicts: util-linux < 2.14
 
 URL: http://www.us.kernel.org/pub/linux/libs/pam/index.html
+Vendor: Project Vine
+Distribution: Vine Linux
 
 %description
 PAM (Pluggable Authentication Modules) is a system security tool that
@@ -174,6 +178,8 @@ mv pam-redhat-%{pam_redhat_version}/* modules
 ## security patch(es)
 %patch1009 -p1 -b .drop-privs
 %patch1010 -p1 -b .execle
+%patch1020 -p1 -b .CVE-2011-3148
+%patch1030 -p1 -b .CVE-2011-3149
 
 libtoolize -f
 autoreconf
@@ -506,6 +512,10 @@ end
 
 
 %changelog
+* Wed Oct 26 2011 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 1.1.1-8
+- add patch1020 for fix CVE-2011-3148 (parsing environment)
+- add patch1030 for fix CVE-2011-3149 (parsing environment)
+
 * Tue May 17 2011 Daisuke SUZUKI <daisuke@linux.or.jp> 1.1.1-7
 - fix %%post script bug..
 

p/patch/patch-vl.spec

@@ -2,12 +2,13 @@ Summary: Utility for modifying/upgrading files
 Summary(ja): ファイルを修正/更新するためのユーティリティ
 Name: patch
 Version: 2.6.1
-Release: 2%{?_dist_release}
+Release: 3%{?_dist_release}
 License: GPLv2+
 URL: http://www.gnu.org/software/patch/patch.html
 Group: Development/Tools
 Source: ftp://ftp.gnu.org/gnu/patch/patch-%{version}.tar.bz2
 Patch1: patch-2.5.4-sigsegv.patch
+Patch2: patch-CVE-2010-4651.patch
 
 BuildRoot: %{_tmppath}/%{name}-%{version}-root
 BuildRequires: ed
@@ -40,6 +41,7 @@ patch は，アプリケーションをアップグレードする際に良く
 %prep
 %setup -q
 %patch1 -p1 -b .sigsegv
+%patch2 -p1 -b .CVE-2010-4651
 
 %build
 CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE"
@@ -49,7 +51,7 @@ CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE"
 %ifarch sparc sparc64
 make CPPFLAGS=""
 %else
-make %{?smp_mflags}
+make %{?_smp_mflags}
 %endif
 
 %check
@@ -69,6 +71,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/*/*
 
 %changelog
+* Mon May  7 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 2.6.1-3
+- add patch2 for fix CVE-2010-4651 (dir traversal) from fc13
+- fix using %%{?_smp_mflags} in make section
+
 * Thu Apr 14 2011 IWAI, Masaharu <iwai@alib.jp> 2.6.1-2
 - build on current VineSeed
 - add Vendor adn Distribution tags

t/t1lib/t1lib-vl.spec

@@ -1,7 +1,7 @@
 Summary:	PostScript Type 1 font rasterizer
 Name:		t1lib
 Version:	5.1.2
-Release:	2%{?_dist_release}
+Release:	3%{?_dist_release}
 Epoch: 		1
 
 Group:		System Environment/Libraries
@@ -12,11 +12,17 @@ Source:		ftp://sunsite.unc.edu/pub/Linux/libs/graphics/%{name}-%{version}.tar.gz
 Patch1:		%{name}-doc.patch.bz2
 Patch2:         %{name}-config.patch.bz2
 Patch3:         %{name}-5.1.2-segf.patch
+# security fixes
+Patch10:	t1lib-5.1.2-CVE-2010-2642.patch
+Patch11:	t1lib-5.1.2-CVE-2011-0764.patch
 
 BuildRoot:	%{_tmppath}/%{name}-%{version}-root
 BuildRequires:	libICE-devel libX11-devel libXaw-devel libXpm-devel
 BuildRequires:  texlive texlive-common
 
+Vendor: 	Project Vine
+Distribution: 	Vine Linux
+
 %description
 T1lib is a library for generating character and string-glyphs from
 Adobe Type 1 fonts under UNIX. T1lib uses most of the code of the X11
@@ -59,6 +65,8 @@ It also contains the "t1libconfig" script used to configure t1lib.
 %patch1 -p0
 %patch2 -p0
 %patch3 -p1 -b .segf
+%patch10 -p1 -b .CVE-2010-2642
+%patch11 -p1 -b .CVE-2011-0764
 
 iconv -f latin1 -t utf8 < Changes > Changes.utf8
 touch -r Changes Changes.utf8
@@ -125,6 +133,13 @@ rm -rf $RPM_BUILD_ROOT
 %{_bindir}/*
 
 %changelog
+* Mon Jan 16 2012 Satoshi IWAMOTO <satoshi.iwamoto@nifty.ne.jp> 5.1.2-3
+- add patch10 for fix CVE-2010-2642 (AFM font metrics parser)
+  CVE-2011-0433 is fixed on the this patch.
+- add patch11 for fix CVE-2011-0764 (AFM font metrics parser)
+  CVE-2011-0764, CVE-2011-1552, 53, 54 are fixed by this patch
+- add Vendor/Distri Tags 
+
 * Fri Jun 03 2011 Daisuke SUZUKI <daisuke@linux.or.jp> 5.1.2-2
 - add BR: texlive-common
 

t/totem-pl-parser/totem-pl-parser-vl.spec

@@ -1,6 +1,6 @@
 Name:		totem-pl-parser
 Version:	3.4.2
-Release:	1%{?_dist_release}
+Release:	2%{?_dist_release}
 Summary:	Totem Playlist Parser library
 Summary(ja):	Totem プレイリスト解析ライブラリ
 
@@ -82,6 +82,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/gir-1.0
 
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 3.4.2-2
+- rebuild with libarchive-3.0.4
+
 * Sun May 20 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 3.4.2-1
 - new upstream release
 

u/udisks2/udisks2-vl.spec

@@ -13,7 +13,7 @@
 
 Summary: Storage Management Service
 Name: udisks2
-Version: 1.94.0
+Version: 1.98.0
 Release: 1%{?_dist_release}
 License: GPLv2+
 Group: System Environment/Libraries
@@ -29,6 +29,7 @@ BuildRequires: dbus-glib-devel >= %{dbus_glib_version}
 BuildRequires: polkit-devel >= %{polkit_version}
 BuildRequires: parted-devel >= %{parted_version}
 BuildRequires: device-mapper-devel >= %{device_mapper_version}
+BuildRequires: libacl-devel
 BuildRequires: intltool
 BuildRequires: libatasmart-devel >= %{libatasmart_version}
 BuildRequires: libgudev1-devel >= %{udev_version}
@@ -163,6 +164,10 @@ rm -rf $RPM_BUILD_ROOT
 
 #
 %changelog
+* Sun Jun 10 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.98.0-1
+- new upstream release
+- add BuildRequires: libacl-devel
+
 * Sun Apr 15 2012 Yoji TOYODA <bsyamato@sea.plala.or.jp> 1.94.0-1
 - Initial build for Vine Linux