--- rpms/php/sme8/php.spec 2011/09/13 14:05:18 1.4 +++ rpms/php/sme8/php.spec 2013/12/16 10:46:47 1.12 @@ -15,10 +15,12 @@ # heuristic used by bindir/mysql_config. %define mysql_config %{_libdir}/mysql/mysql_config +%define _default_patch_fuzz 2 + Summary: PHP scripting language for creating dynamic web sites Name: php Version: 5.3.3 -Release: 1%{?dist}.1.0 +Release: 14%{?dist} License: PHP and LGPLv2 and LGPLv2+ Group: Development/Languages URL: http://www.php.net/ @@ -38,6 +40,12 @@ Patch8: php-5.3.3-aconf26x.patch # Fixes for extensions Patch20: php-4.3.11-shutdown.patch +Patch21: php-5.3.3-zipmemset.patch +Patch22: php-5.3.3-pdo-overflow.patch +Patch23: php-5.3.3-pdo-53551.patch +Patch24: php-5.3.3-fileinfo.patch +Patch25: php-5.3.3-imap.patch +Patch26: php-5.3.3-odbc.patch # Functional changes Patch40: php-5.0.4-dlopen.patch @@ -49,15 +57,53 @@ Patch61: php-5.0.4-tests-wddx.patch Patch62: php-5.3.2-testfail.patch # Bug fixes -Patch100: php-5.3.2-r305570.patch -Patch101: php-5.3.3-r305043.patch +Patch100: php-5.3.3-extrglob.patch +Patch101: php-5.3.3-varnegidx.patch +Patch102: php-5.3.3-setdate.patch +# 103 not needed (no php-fpm) +Patch104: php-5.3.3-zendgc.patch +Patch105: php-5.3.3-r305043.patch +Patch106: php-5.3.3-copy.patch +Patch107: php-5.3.3-errorhandler.patch +Patch108: php-5.3.3-bug54268.patch # Fixes for security bugs -Patch207: php-5.3.2-CVE-2010-3709.patch -Patch208: php-5.3.2-CVE-2010-3870.patch -Patch209: php-5.3.3-CVE-2010-4156.patch -Patch210: php-5.3.3-CVE-2010-3710.patch -Patch211: php-5.3.2-CVE-2010-4645.patch +Patch200: php-5.3.2-CVE-2010-3709.patch +Patch201: php-5.3.2-CVE-2010-3870.patch +Patch202: php-5.3.3-CVE-2010-3710.patch +Patch203: php-5.3.2-CVE-2010-4645.patch +Patch204: php-5.3.3-CVE-2010-4156.patch +Patch205: php-5.3.3-CVE-2011-0708.patch +Patch206: php-5.3.3-CVE-2011-1148.patch +Patch207: php-5.3.3-CVE-2011-1466.patch +Patch208: php-5.3.3-CVE-2011-1468.patch +Patch209: php-5.3.3-CVE-2011-1469.patch +# 210 not needed (not affected) +Patch211: php-5.3.3-CVE-2011-1471.patch +Patch212: php-5.3.3-CVE-2011-1938.patch +Patch213: php-5.3.3-CVE-2011-2202.patch +Patch214: php-5.3.3-CVE-2011-2483.patch +Patch215: php-5.3.3-CVE-2011-4885.patch +Patch216: php-5.3.3-CVE-2011-4566.patch +Patch217: php-5.3.3-CVE-2012-0830.patch +Patch218: php-5.3.3-CVE-2012-1823.patch +Patch219: php-5.3.3-CVE-2012-2336.patch +Patch220: php-5.3.3-CVE-2011-4153.patch +# 221 not needed (no php-tidy) +Patch222: php-5.3.3-CVE-2012-1172.patch +Patch223: php-5.3.3-CVE-2012-2143.patch +Patch224: php-5.3.3-CVE-2012-2386.patch +Patch225: php-5.3.3-CVE-2012-0057.patch +Patch226: php-5.3.3-CVE-2012-0789.patch +Patch227: php-5.3.3-CVE-2010-2950.patch +Patch228: php-5.3.3-CVE-2012-2688.patch +Patch229: php-5.3.3-CVE-2012-0831.patch +Patch230: php-5.3.3-CVE-2011-1398.patch +Patch231: php-5.3.3-CVE-2013-1643.patch +Patch232: php-5.3.3-CVE-2006-7243.patch +Patch233: php-5.3.3-CVE-2013-4113.patch +Patch234: php-5.3.3-CVE-2013-4248.patch +Patch235: php-5.3.3-CVE-2013-6420.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -68,6 +114,7 @@ BuildRequires: zlib-devel, pcre-devel >= BuildRequires: bzip2, perl, libtool >= 1.4.3, gcc-c++ Requires: httpd-mmn = %{httpd_mmn} Provides: mod_php = %{version}-%{release} +Provides: php53 = %{version}-%{release}, config(php53) = %{version}-%{release} Requires: %{name}-common = %{version}-%{release} # For backwards-compatibility, require php-cli for the time being: Requires: %{name}-cli = %{version}-%{release} @@ -89,7 +136,7 @@ language to Apache HTTP Server. Group: Development/Languages Summary: Command-line interface for PHP Requires: %{name}-common = %{version}-%{release} -Provides: php-cgi = %{version}-%{release}, php-cli = %{version}-%{release} +Provides: php-cgi = %{version}-%{release}, php53-cli = %{version}-%{release} Provides: php-pcntl %description cli @@ -101,12 +148,16 @@ Group: Development/Languages Summary: Common files for PHP Provides: php-api = %{apiver}, php-zend-abi = %{zendver} Provides: php(api) = %{apiver}, php(zend-abi) = %{zendver} +Provides: php(language) = %{version} # Provides for all builtin modules: Provides: php-bz2, php-calendar, php-ctype, php-curl, php-date, php-exif Provides: php-ftp, php-gettext, php-gmp, php-hash, php-iconv, php-libxml Provides: php-reflection, php-session, php-shmop, php-simplexml, php-sockets Provides: php-spl, php-tokenizer, php-openssl, php-pcre Provides: php-zlib, php-json, php-zip, php-fileinfo +Provides: php-core, php-ereg, php-filter, php-phar, php-standard +Provides: php53-common = %{version}-%{release}, config(php53-common) = %{version}-%{release} +Obsoletes: php-pecl-json, php-pecl-zip, php-pecl-phar, php-pecl-Fileinfo Obsoletes: php-openssl, php-json # For obsoleted pecl extension Provides: php-pecl-json = %{jsonver}, php-pecl(json) = %{jsonver} @@ -123,7 +174,7 @@ package and the php-cli package. Group: Development/Libraries Summary: Files needed for building PHP extensions Requires: %{name} = %{version}-%{release}, autoconf, automake -Provides: php-devel = %{version}-%{release} +Provides: php53-devel = %{version}-%{release}, config(php53-devel) = %{version}-%{release} %description devel The php-devel package contains the files needed for building PHP @@ -135,6 +186,7 @@ Summary: A module for PHP applications t Group: Development/Languages Requires: %{name}-common = %{version}-%{release} BuildRequires: krb5-devel, openssl-devel, libc-client-devel +Provides: php53-imap = %{version}-%{release}, config(php53-imap) = %{version}-%{release} %description imap The php-imap package contains a dynamic shared object that will @@ -145,6 +197,7 @@ Summary: A module for PHP applications t Group: Development/Languages Requires: %{name}-common = %{version}-%{release} BuildRequires: cyrus-sasl-devel, openldap-devel, openssl-devel +Provides: php53-ldap = %{version}-%{release}, config(php53-ldap) = %{version}-%{release} %description ldap The php-ldap package is a dynamic shared object (DSO) for the Apache @@ -160,6 +213,7 @@ Group: Development/Languages Requires: %{name}-common = %{version}-%{release} Provides: php-pdo-abi = %{pdover} Provides: php-pdo_sqlite +Provides: php53-pdo = %{version}-%{release}, config(php53-pdo) = %{version}-%{release} %description pdo The %{name}-pdo package contains a dynamic shared object that will add @@ -173,6 +227,7 @@ Group: Development/Languages Requires: %{name}-common = %{version}-%{release}, %{name}-pdo Provides: php_database, php-mysqli, php-pdo_mysql BuildRequires: mysql-devel >= 4.1.0 +Provides: php53-mysql = %{version}-%{release}, config(php53-mysql) = %{version}-%{release} %description mysql The php-mysql package contains a dynamic shared object that will add @@ -187,6 +242,7 @@ Group: Development/Languages Requires: %{name}-common = %{version}-%{release}, %{name}-pdo Provides: php_database, php-pdo_pgsql BuildRequires: krb5-devel, openssl-devel, postgresql-devel +Provides: php53-pgsql = %{version}-%{release}, config(php53-pgsql) = %{version}-%{release} %description pgsql The php-pgsql package includes a dynamic shared object (DSO) that can @@ -202,6 +258,7 @@ Summary: Modules for PHP script using sy Group: Development/Languages Requires: %{name}-common = %{version}-%{release} Provides: php-posix, php-sysvsem, php-sysvshm, php-sysvmsg +Provides: php53-process = %{version}-%{release}, config(php53-process) = %{version}-%{release} %description process The php-process package contains dynamic shared objects which add @@ -214,6 +271,7 @@ Requires: %{name}-common = %{version}-%{ Summary: A module for PHP applications that use ODBC databases Provides: php_database, php-pdo_odbc BuildRequires: unixODBC-devel +Provides: php53-odbc = %{version}-%{release}, config(php53-odbc) = %{version}-%{release} %description odbc The php-odbc package contains a dynamic shared object that will add @@ -229,6 +287,7 @@ Group: Development/Languages Requires: %{name}-common = %{version}-%{release} Summary: A module for PHP applications that use the SOAP protocol BuildRequires: libxml2-devel +Provides: php53-soap = %{version}-%{release}, config(php53-soap) = %{version}-%{release} %description soap The php-soap package contains a dynamic shared object that will add @@ -239,6 +298,7 @@ Summary: A module for PHP applications t Group: Development/Languages Requires: %{name}-common = %{version}-%{release}, net-snmp BuildRequires: net-snmp-devel +Provides: php53-snmp = %{version}-%{release}, config(php53-snmp) = %{version}-%{release} %description snmp The php-snmp package contains a dynamic shared object that will add @@ -252,6 +312,8 @@ Group: Development/Languages Requires: %{name}-common = %{version}-%{release} Provides: php-dom, php-xsl, php-domxml, php-wddx BuildRequires: libxslt-devel >= 1.0.18-1, libxml2-devel >= 2.4.14-1 +Obsoletes: php-domxml, php-dom +Provides: php53-xml = %{version}-%{release}, config(php53-xml) = %{version}-%{release} %description xml The php-xml package contains dynamic shared objects which add support @@ -262,6 +324,7 @@ and performing XSL transformations on XM Summary: A module for PHP applications which use the XML-RPC protocol Group: Development/Languages Requires: %{name}-common = %{version}-%{release} +Provides: php53-xmlrpc = %{version}-%{release}, config(php53-xmlrpc) = %{version}-%{release} %description xmlrpc The php-xmlrpc package contains a dynamic shared object that will add @@ -271,6 +334,7 @@ support for the XML-RPC protocol to PHP. Summary: A module for PHP applications which need multi-byte string handling Group: Development/Languages Requires: %{name}-common = %{version}-%{release} +Provides: php53-mbstring = %{version}-%{release}, config(php53-mbstring) = %{version}-%{release} %description mbstring The php-mbstring package contains a dynamic shared object that will add @@ -282,6 +346,7 @@ Group: Development/Languages Requires: %{name}-common = %{version}-%{release} # Required to build the bundled GD library BuildRequires: libXpm-devel, libjpeg-devel, libpng-devel, freetype-devel +Provides: php53-gd = %{version}-%{release}, config(php53-gd) = %{version}-%{release} %description gd The php-gd package contains a dynamic shared object that will add @@ -291,6 +356,7 @@ support for using the gd graphics librar Summary: A module for PHP applications for using the bcmath library Group: Development/Languages Requires: %{name}-common = %{version}-%{release} +Provides: php53-bcmath = %{version}-%{release}, config(php53-bcmath) = %{version}-%{release} %description bcmath The php-bcmath package contains a dynamic shared object that will add @@ -300,6 +366,7 @@ support for using the bcmath library to Summary: A database abstraction layer module for PHP applications Group: Development/Languages Requires: %{name}-common = %{version}-%{release} +Provides: php53-dba = %{version}-%{release}, config(php53-dba) = %{version}-%{release} %description dba The php-dba package contains a dynamic shared object that will add @@ -310,6 +377,7 @@ Summary: A module for PHP applications f Group: System Environment/Libraries Requires: %{name}-common = %{version}-%{release} BuildRequires: aspell-devel >= 0.50.0 +Provides: php53-pspell = %{version}-%{release}, config(php53-pspell) = %{version}-%{release} %description pspell The php-pspell package contains a dynamic shared object that will add @@ -320,6 +388,7 @@ Summary: Internationalization extension Group: System Environment/Libraries Requires: %{name}-common = %{version}-%{release} BuildRequires: libicu-devel >= 3.6 +Provides: php53-intl = %{version}-%{release}, config(php53-intl) = %{version}-%{release} %description intl The php-intl package contains a dynamic shared object that will add @@ -335,6 +404,12 @@ support for using the ICU library to PHP %patch8 -p1 -b .aconf26x %patch20 -p1 -b .shutdown +%patch21 -p1 -b .zipmemset +%patch22 -p1 -b .pdooverflow +%patch23 -p1 -b .pdo53551 +%patch24 -p1 -b .streams +%patch25 -p1 -b .imapauth +%patch26 -p1 -b .pdoodbc %patch40 -p1 -b .dlopen %patch41 -p1 -b .easter @@ -343,15 +418,51 @@ support for using the ICU library to PHP %patch61 -p1 -b .tests-wddx %patch62 -p1 -b .testfail -%patch100 -p1 -b .r305570 -%patch101 -p1 -b .r305043 - -%patch207 -p1 -b .cve3709 -%patch208 -p1 -b .cve3870 - -%patch209 -p1 -b .cve4156 -%patch210 -p1 -b .cve3710 -%patch211 -p1 -b .cve4645 +%patch100 -p1 -b .extrglob +%patch101 -p1 -b .varnegidx +%patch102 -p1 -b .setdate + +%patch104 -p1 -b .zendgc +%patch105 -p1 -b .r305043 +%patch106 -p1 -b .copy +%patch107 -p1 -b .errorhandler +%patch108 -p1 -b .bug54268 + +%patch200 -p1 -b .cve3709 +%patch201 -p1 -b .cve3870 +%patch202 -p1 -b .cve4645 +%patch203 -p1 -b .cve3710 +%patch204 -p1 -b .cve4156 +%patch205 -p1 -b .cve0708 +%patch206 -p1 -b .cve1148 +%patch207 -p1 -b .cve1466 +%patch208 -p1 -b .cve1468 +%patch209 -p1 -b .cve1469 +%patch211 -p1 -b .cve1471 +%patch212 -p1 -b .cve1938 +%patch213 -p1 -b .cve2202 +%patch214 -p1 -b .cve2483 +%patch215 -p1 -b .cve4885 +%patch216 -p1 -b .cve4566 +%patch217 -p1 -b .cve0830 +%patch218 -p1 -b .cve1823 +%patch219 -p1 -b .cve2336 + +%patch220 -p1 -b .cve4153 +%patch222 -p1 -b .cve1172 +%patch223 -p1 -b .cve2143 +%patch224 -p1 -b .cve2386 +%patch225 -p1 -b .cve0057 +%patch226 -p1 -b .cve0789 +%patch227 -p1 -b .cve2950 +%patch228 -p1 -b .cve2688 +%patch229 -p1 -b .cve0831 +%patch230 -p1 -b .cve1398 +%patch231 -p1 -b .cve1643 +%patch232 -p1 -b .cve7243 +%patch233 -p1 -b .cve4113 +%patch234 -p1 -b .cve4248 +%patch235 -p1 -b .cve6420 # Prevent %%doc confusion over LICENSE files cp -p Zend/LICENSE Zend/ZEND_LICENSE @@ -427,6 +538,7 @@ fi # Fix some bogus permissions find . -name \*.[ch] -exec chmod 644 {} \; +find . -name \*.cpp -exec chmod 644 {} \; chmod 644 README.* %build @@ -648,6 +760,7 @@ cat files.json files.zip files.curl file install -d $RPM_BUILD_ROOT%{_sysconfdir}/rpm # %{SOURCE3} used here -> sed -e "s/@PHP_APIVER@/%{apiver}/;s/@PHP_ZENDVER@/%{zendver}/;s/@PHP_PDOVER@/%{pdover}/" \ + -e "s/@PHP_VERSION@/%{version}/" \ < $RPM_SOURCE_DIR/macros.php > macros.php install -m 644 -c macros.php \ $RPM_BUILD_ROOT%{_sysconfdir}/rpm/macros.php @@ -676,7 +789,7 @@ rm files.* macros.php %defattr(-,root,root) %doc CODING_STANDARDS CREDITS INSTALL LICENSE NEWS README* %doc Zend/ZEND_* TSRM_LICENSE regex_COPYRIGHT -%doc php.ini-* +%doc php.ini-production php.ini-development %config(noreplace) %{_sysconfdir}/php.ini %dir %{_sysconfdir}/php.d %dir %{_libdir}/php @@ -729,12 +842,74 @@ rm files.* macros.php %files process -f files.process %changelog -* Tue Sep 13 2011 Shad L. Lords - 5.3.3-1.1.0 +* Mon Dec 16 2013 Daniel Berteaud - 5.3.3-14.sme +- Resync with upstream php53, which include: +- add security fix for CVE-2013-6420 +- add security fix for CVE-2013-4248 +- add upstream reproducer for error_handler (#951075) +- add security fixes for CVE-2006-7243 +- add security fixes for CVE-2012-2688, CVE-2012-0831, + CVE-2011-1398, CVE-2013-1643 +- fix segfault in error_handler with + allow_call_time_pass_reference = Off (#951075) +- fix double free when destroy_zend_class fails (#951076) +- fix possible buffer overflow in pdo_odbc (#869694) +- php script hangs when it exceeds max_execution_time + when inside an ODBC call (#864954) +- fix zend garbage collector (#892695) +- fix transposed memset arguments in libzip (#953818) +- fix possible segfault in pdo_mysql (#869693) +- fix imap_open DISABLE_AUTHENTICATOR param ignores array (#859369) +- fix stream support in fileinfo (#869697) +- fix setDate when DateTime created from timestamp (#869691) +- fix permission on source files (#869688) +- add php(language) and missing provides (#837044) +- +- fix copy doesn't report failure on partial copy (#951413) + +* Mon Jul 15 2013 Shad L. Lords - 5.3.3-13.sme.2 +- Add php53-* provides to provide compatibility +- Obsolete php-domxml and php-dom [SME: 6733] - Update Obsoletes and Conflicts [SME: 6436] -* Wed Jan 19 2011 Joe Orton - 5.3.3-1.1 -- add security fixes for CVE-2010-3710, CVE-2010-4156, - CVE-2010-4645 (#670463) +* Fri Jul 12 2013 Remi Collet - 5.3.3-13.1 +- add security fix for CVE-2013-4113 + +* Mon Jun 25 2012 Joe Orton - 5.3.3-13 +- add security fix for CVE-2010-2950 + +* Wed Jun 13 2012 Joe Orton - 5.3.3-11 +- fix tests for CVE-2012-2143, CVE-2012-0789 + +* Tue Jun 12 2012 Joe Orton - 5.3.3-10 +- add security fix for CVE-2012-2336 + +* Tue Jun 12 2012 Joe Orton - 5.3.3-9 +- add security fixes for CVE-2011-4153, CVE-2012-0057, CVE-2012-0789, + CVE-2012-1172, CVE-2012-2143, CVE-2012-2386 + +* Thu May 3 2012 Joe Orton - 5.3.3-7 +- correct detection of = in CVE-2012-1823 fix (#818607) + +* Thu May 3 2012 Joe Orton - 5.3.3-6 +- add security fix for CVE-2012-1823 (#818607) + +* Thu Feb 2 2012 Joe Orton - 5.3.3-5 +- add security fix for CVE-2012-0830 (#786758) + +* Wed Jan 04 2012 Vojtech Vitek (V-Teq) - 5.3.3-4 +- remove extra php.ini-prod/devel files caused by %%patch -b + +* Tue Jan 03 2012 Vojtech Vitek (V-Teq) - 5.3.3-3 +- add security fixes for CVE-2011-4885, CVE-2011-4566 (#740734) + +* Fri Oct 28 2011 Joe Orton - 5.3.3-2 +- add php-$subpkg = V-R provides (#717158) +- add security fixes for CVE-2010-3710, CVE-2010-4156, CVE-2010-4645 (#670464) +- add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148, + CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1471, + CVE-2011-1938, CVE-2011-2202 (#740734) +- fix negative keys with var_export (#700724) * Wed Dec 1 2010 Joe Orton - 5.3.3-1 - update to 5.3.3 (#658315)