is provided by libiconv, and explicitly link with libiconv since the
iconv() functions are called from the program. Fixes linking with lld.
ok bentley@
- "stdio rpath" for common usage
- "stdio rpath proc exec" for -z (--search-zip) as it is spawning
external commands for decompress files.
from semarie@, ok kn@
A Python module incorporating an interface to the SPDX license database.
This library serves purely as a holder for the database that can be found on
the SPDX website.
To more easily query this database or detect licenses, consider using
something like spdx-lookup.
has pkgspec set on the go version number already), so that pkg_add -u updates
them to versions which work with MAP_STACK. spotted by pvk@
(part 2: the ports which don't use MODULES=lang/go)
also provides a tool):
databases/hs-resource-pool
devel/hs-List
devel/hs-OneTuple
devel/hs-blaze-builder
devel/hs-unbounded-delays
devel/hs-unordered-containers
devel/hscolour
net/hs-multipart
textproc/hs-bytestring-lexing
textproc/hs-scanner
ok jasper@ (who also checked the list and reminded my of hscolour)
also provides a tool):
databases/hs-resource-pool
devel/hs-List
devel/hs-OneTuple
devel/hs-blaze-builder
devel/hs-unbounded-delays
devel/hs-unordered-containers
devel/hscolour
net/hs-multipart
textproc/hs-bytestring-lexing
textproc/hs-scanner
ok jasper@ (who also checked the list and reminded my of hscolour)
CVE-2018-1308: XXE attack through Apache Solr's DIH's dataConfig request parameter
This vulnerability relates to an XML external entity expansion (XXE) in the
`&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be
used as XXE using file/ftp/http protocols in order to read arbitrary local
files from the Solr server or the internal network. See [1] for more details.
Mitigation:
Users are advised to upgrade to either Solr 6.6.3 or Solr 7.3.0 releases both
of which address the vulnerability. Once upgrade is complete, no other steps
are required. Those releases disable external entities in anonymous XML files
passed through this request parameter.
If users are unable to upgrade to Solr 6.6.3 or Solr 7.3.0 then they are
advised to disable data import handler in their solrconfig.xml file and
restart their Solr instances. Alternatively, if Solr instances are only used
locally without access to public internet, the vulnerability cannot be used
directly, so it may not be required to update, and instead reverse proxies or
Solr client applications should be guarded to not allow end users to inject
`dataConfig` request parameters.
