Subversion 1.0.4 contains remotely exploitable vulnerability which is fixed in the current release, 1.0.5. However, the current ported version is 1.0.4. The advisory can be found at <URI: http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt> Fix: I diffed the sources between 1.0.4 and 1.0.5 release and it seems they've only changed the vulnerable part of the code. Assuming that it wont break up the building process, just changing the PORTVERSION and distinfo to match the 1.0.5 version should do it - it compiled ok for me (I'm using apache2 APR). I pasted the (quite simple) patch below: How-To-Repeat: Run the svnserve and wait... :-)
Responsible Changed From-To: freebsd-ports-bugs->lev I'm maintainer.
State Changed From-To: open->closed Committed, thanks
Since this fixes a security vulnerability, you might want to add an patch for ports/security/vuxml/vuln.xml or ports/security/portaudit-db/database/portaudit.txt next time (Not both, the first is preferred). Thanks for fixing this -Oliver