CVS commit: pkgsrc/security/zoneminder

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/security/zoneminder
From: "Greg Troxel" <gdt%netbsd.org@localhost>
Date: Sun, 11 Oct 2026 00:04:42 +0000

Module Name:    pkgsrc
Committed By:   gdt
Date:           Sun Oct 11 00:04:42 UTC 2026

Modified Files:
        pkgsrc/security/zoneminder: Makefile PLIST distinfo
        pkgsrc/security/zoneminder/patches:
            patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm
            patch-src_zm__utils.cpp patch-src_zm_signal_cpp
Removed Files:
        pkgsrc/security/zoneminder/patches: patch-src_zm__rtp__source.cpp

Log Message:
security/zoneminder: Update to 1.38.6

Tested on NetBSD 10.

Upstream NEWS, less bugfixes and minor improvements:

# ZoneMinder 1.38.6 Release Notes

(some kind of packaging fix not important to pkgsrc)

# ZoneMinder 1.38.5 Release Notes

This is a maintenance release for the 1.38 series. It is primarily a security
release: it fixes 19 reported vulnerabilities, including an authenticated remote
code execution, a heap overflow and a stack overflow, as well as cross-monitor
authorization bypasses throughout the web UI and API. All 1.38 users should upgrade.

## pgrade notes

- **Run `zmupdate.pl -f` after upgrading** (the packages do this for you). It now
  replaces a `ZM_AUTH_HASH_SECRET` that is empty or still the shipped default with a
  random secret. Token (JWT) authentication is refused while the secret is the
  public default, so on a source install that skips this step API logins answer 403
  until a secret is set in Options → System.
- The 1.38.5 database update adds an index on `Sessions.access` and moves Controls
  rows from the removed `onvif` protocol module to `ONVIF`.
- The API no longer answers actions a controller does not implement with generic
  handlers. Such requests, including Controls add/edit and Configs add, now return
  404.
- Adding a monitor to a group, removing it, re-parenting the group or deleting it
  now requires edit permission on each monitor affected, in both the web UI and
  the API.
- Forcing, cancelling or disabling a monitor's alarms now requires edit permission
  on that monitor.
- `ZM_GO2RTC_PATH` may now be given as the go2rtc server address (`http://host:1984`)
  or its API path (`http://host:1984/api`); before, only the `/api` form worked.


To generate a diff of this commit:
cvs rdiff -u -r1.113 -r1.114 pkgsrc/security/zoneminder/Makefile
cvs rdiff -u -r1.14 -r1.15 pkgsrc/security/zoneminder/PLIST
cvs rdiff -u -r1.30 -r1.31 pkgsrc/security/zoneminder/distinfo
cvs rdiff -u -r1.5 -r1.6 \
    pkgsrc/security/zoneminder/patches/patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm \
    pkgsrc/security/zoneminder/patches/patch-src_zm__utils.cpp \
    pkgsrc/security/zoneminder/patches/patch-src_zm_signal_cpp
cvs rdiff -u -r1.7 -r0 \
    pkgsrc/security/zoneminder/patches/patch-src_zm__rtp__source.cpp

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/zoneminder/Makefile
diff -u pkgsrc/security/zoneminder/Makefile:1.113 pkgsrc/security/zoneminder/Makefile:1.114
--- pkgsrc/security/zoneminder/Makefile:1.113   Tue Sep 29 06:07:28 2026
+++ pkgsrc/security/zoneminder/Makefile Sun Oct 11 00:04:42 2026
@@ -1,14 +1,14 @@
-# $NetBSD: Makefile,v 1.113 2026/09/29 06:07:28 wiz Exp $
+# $NetBSD: Makefile,v 1.114 2026/10/11 00:04:42 gdt Exp $
 
 # This is a twisty maze of variables.  The plan is to edit VERSION
 # (the zoneminder version) on upgrades, and have everything flow from
 # there.
-VERSION=       1.38.4
+VERSION=       1.38.6
 # Distfile is ZoneMinder but package and tarball contents are zoneminder.
 NAME_DIST=     ZoneMinder
 NAME_LOWER=    zoneminder
 PKGNAME=       ${DISTNAME:S/${NAME_DIST}-/${NAME_LOWER}-/}
-PKGREVISION=   4
+#PKGREVISION=
 DISTNAME=      ${NAME_DIST}-${VERSION}
 WRKSRC=                ${WRKDIR}/${NAME_LOWER}-${GITHUB_TAG}
 CATEGORIES=    security

Index: pkgsrc/security/zoneminder/PLIST
diff -u pkgsrc/security/zoneminder/PLIST:1.14 pkgsrc/security/zoneminder/PLIST:1.15
--- pkgsrc/security/zoneminder/PLIST:1.14       Tue Aug 11 19:27:13 2026
+++ pkgsrc/security/zoneminder/PLIST    Sun Oct 11 00:04:42 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.14 2026/08/11 19:27:13 gdt Exp $
+@comment $NetBSD: PLIST,v 1.15 2026/10/11 00:04:42 gdt Exp $
 bin/zm_rtsp_server
 bin/zmaudit.pl
 bin/zmc
@@ -3087,7 +3087,6 @@ ${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder
 ${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder/Control/Wanscam.pm
 ${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder/Control/WanscamHW0025.pm
 ${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder/Control/mjpgStreamer.pm
-${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder/Control/onvif.pm
 ${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder/Database.pm
 ${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder/Event.pm
 ${PERL5_SUB_INSTALLVENDORLIB}/ZoneMinder/Event_Summary.pm
@@ -6495,6 +6494,7 @@ share/zoneminder/db/zm_update-1.37.80.sq
 share/zoneminder/db/zm_update-1.37.9.sql
 share/zoneminder/db/zm_update-1.38.1.sql
 share/zoneminder/db/zm_update-1.38.4.sql
+share/zoneminder/db/zm_update-1.38.5.sql
 share/zoneminder/fonts/default.zmfnt
 ${ZM_HTTPD_ROOT}/ajax/add_monitors.php
 ${ZM_HTTPD_ROOT}/ajax/alarm.php
@@ -7925,11 +7925,13 @@ ${ZM_HTTPD_ROOT}/includes/Frame.php
 ${ZM_HTTPD_ROOT}/includes/Group.php
 ${ZM_HTTPD_ROOT}/includes/Group_Monitor.php
 ${ZM_HTTPD_ROOT}/includes/Group_Permission.php
+${ZM_HTTPD_ROOT}/includes/HttpRange.php
 ${ZM_HTTPD_ROOT}/includes/Manufacturer.php
 ${ZM_HTTPD_ROOT}/includes/Model.php
 ${ZM_HTTPD_ROOT}/includes/Monitor.php
 ${ZM_HTTPD_ROOT}/includes/Monitor_Permission.php
 ${ZM_HTTPD_ROOT}/includes/MontageLayout.php
+${ZM_HTTPD_ROOT}/includes/Network.php
 ${ZM_HTTPD_ROOT}/includes/Object.php
 ${ZM_HTTPD_ROOT}/includes/Report.php
 ${ZM_HTTPD_ROOT}/includes/Role_Group_Permission.php
@@ -8613,6 +8615,7 @@ ${ZM_HTTPD_ROOT}/skins/classic/views/js/
 ${ZM_HTTPD_ROOT}/skins/classic/views/js/console.js
 ${ZM_HTTPD_ROOT}/skins/classic/views/js/console.js.php
 ${ZM_HTTPD_ROOT}/skins/classic/views/js/control.js
+${ZM_HTTPD_ROOT}/skins/classic/views/js/control.js.php
 ${ZM_HTTPD_ROOT}/skins/classic/views/js/controlcap.js
 ${ZM_HTTPD_ROOT}/skins/classic/views/js/controlcaps.js
 ${ZM_HTTPD_ROOT}/skins/classic/views/js/cycle.js

Index: pkgsrc/security/zoneminder/distinfo
diff -u pkgsrc/security/zoneminder/distinfo:1.30 pkgsrc/security/zoneminder/distinfo:1.31
--- pkgsrc/security/zoneminder/distinfo:1.30    Tue Aug 11 19:27:14 2026
+++ pkgsrc/security/zoneminder/distinfo Sun Oct 11 00:04:42 2026
@@ -1,11 +1,11 @@
-$NetBSD: distinfo,v 1.30 2026/08/11 19:27:14 gdt Exp $
+$NetBSD: distinfo,v 1.31 2026/10/11 00:04:42 gdt Exp $
 
 BLAKE2s (FriendsOfCake-crud-14292374ccf1328f2d5db20897bd06f99ba4d938.tar.gz) = 8877bf6718ecfe3cba2515629418fe5addc60cf8ce4650526b39db6a234922ad
 SHA512 (FriendsOfCake-crud-14292374ccf1328f2d5db20897bd06f99ba4d938.tar.gz) = 
da58528686baf05385ad08079f965bce10eba6d599133ab773e9ab1f9e4b7d82cf5431b4b773317b90effb16e0b026a029bdfabe08a9ef1a5e9b94e7a1c2ea9e
 Size (FriendsOfCake-crud-14292374ccf1328f2d5db20897bd06f99ba4d938.tar.gz) = 73086 bytes
-BLAKE2s (ZoneMinder-1.38.4.tar.gz) = e0fd482ac88d85a7af7fe9af23f65e2197b267e840a13839a877e3d0cc4b2203
-SHA512 (ZoneMinder-1.38.4.tar.gz) = 582344cbf2027d203f2b206084537fd2b4ea292a518a83a7ef32635fdc1f0113eb50e149716f0539abaa2cc1520291c83f9ca92a0475c71717581c188c839fe3
-Size (ZoneMinder-1.38.4.tar.gz) = 20579498 bytes
+BLAKE2s (ZoneMinder-1.38.6.tar.gz) = d245f2641a2aebf274a42701b81b94f7f0c68f9b8e6e1e49d5a431212395ef66
+SHA512 (ZoneMinder-1.38.6.tar.gz) = f315e266a824f7ed23c189d2811a3b583a7474e3ae1c1bea33e4fa8e1dfc193c7e1fe18bcebec9f6cdde677d41d90581c9f9f5d32a7980acb7b919bd1b98aae1
+Size (ZoneMinder-1.38.6.tar.gz) = 20658550 bytes
 BLAKE2s (ZoneMinder-CakePHP-Enum-Behavior-ea90c0cd7f6e24333a90885e563b5d30b793db29.tar.gz) = 4639184438becb1c33450a00e213fca9d11e92b7f2545fb701f40a664c716764
 SHA512 (ZoneMinder-CakePHP-Enum-Behavior-ea90c0cd7f6e24333a90885e563b5d30b793db29.tar.gz) = 
75f2188e548b98191c8df82fb76e918f3bda9788f541449df8fa92449ad19aa0b9c13420dd91c760e08a4d31956ad51602242ab97e3bd4460f01e99f49992453
 Size (ZoneMinder-CakePHP-Enum-Behavior-ea90c0cd7f6e24333a90885e563b5d30b793db29.tar.gz) = 3504 bytes
@@ -17,13 +17,12 @@ SHA512 (chmike-CxxUrl-eaf46c0207df24853a
 Size (chmike-CxxUrl-eaf46c0207df24853a238d4499e7f4426d9d234c.tar.gz) = 14299 bytes
 SHA1 (patch-CMakeLists.txt) = 51899465cbf3bdafea590989d5bbf176054c3764
 SHA1 (patch-scripts_ZoneMinder_lib_ZoneMinder_ConfigData.pm.in) = 9cf3f3f9da6a3cb4911bbb127a2d10d7edd8929f
-SHA1 (patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm) = 5350c37edb0d5d52613a734a20516ce6aefb417d
+SHA1 (patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm) = c31203f6d2155a73434da40d4c1d8d5be9e2dfe8
 SHA1 (patch-scripts_ZoneMinder_lib_ZoneMinder_Memory_Shared.pm) = 38de6349f2071eef146009e029a3a0592aa9720a
 SHA1 (patch-scripts_zm_in) = e1e344b2bddaffa63c435541f6d5e78af73de80b
 SHA1 (patch-scripts_zmpkg_pl_in) = 429ea720574e19d96a34ad6a39f1196a90ac8a86
 SHA1 (patch-src_zm__comms.h) = b6b68d50dfb73a72fd9609d50890aed6ecde9294
 SHA1 (patch-src_zm__remote__camera__nvsocket.cpp) = 2af57a1fe70369b0d377932570370838466c1535
-SHA1 (patch-src_zm__rtp__source.cpp) = ba46738d040ad0c83a49e0d5cc368f2752535b6e
-SHA1 (patch-src_zm__utils.cpp) = c347ad18989ca83e4317fb7e7eb3ba9fed4e99fa
-SHA1 (patch-src_zm_signal_cpp) = 68c97ef3b3bc9b0be0069bee0842e31c9317582e
+SHA1 (patch-src_zm__utils.cpp) = e520c226020dfdd19814b4f3ade66c773213d914
+SHA1 (patch-src_zm_signal_cpp) = ecade9c2f9597b001b99eacb8a65cffcf3e9136c
 SHA1 (patch-web_includes_database.php) = 0d7e455220a59e94d5dd9acfd83858b78dce889b

Index: pkgsrc/security/zoneminder/patches/patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm
diff -u pkgsrc/security/zoneminder/patches/patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm:1.5 pkgsrc/security/zoneminder/patches/patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm:1.6
--- pkgsrc/security/zoneminder/patches/patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm:1.5   Thu Jul 30 12:36:00 2026
+++ pkgsrc/security/zoneminder/patches/patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm       Sun Oct 11 00:04:42 2026
@@ -1,4 +1,4 @@
-$NetBSD: patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm,v 1.5 2026/07/30 12:36:00 gdt Exp $
+$NetBSD: patch-scripts_ZoneMinder_lib_ZoneMinder_General_pm,v 1.6 2026/10/11 00:04:42 gdt Exp $
 
 Comment that appears no longer relevant, probably because upstream has
 avoided the problem it was about.  Deletion  candidate.
@@ -24,14 +24,14 @@ Use the -m parameter to su, as ZM_WEB_US
 
 \todo Assess and report upstream.
 
---- scripts/ZoneMinder/lib/ZoneMinder/General.pm.orig  2023-02-23 21:44:01.000000000 +0000
+--- scripts/ZoneMinder/lib/ZoneMinder/General.pm.orig  2026-10-05 23:07:17.000000000 +0000
 +++ scripts/ZoneMinder/lib/ZoneMinder/General.pm
-@@ -92,7 +92,7 @@ sub getCmdFormat {
+@@ -198,7 +198,7 @@ sub getCmdFormat {
      chomp( $output );
      Debug("Test failed, '$output'");
  
--    $prefix = 'su '.$Config{ZM_WEB_USER}.q` --shell=/bin/sh --command='`;
-+    $prefix = 'su -m'.$Config{ZM_WEB_USER}.q` --shell=/bin/sh --command='`;
+-    $prefix = 'su -s /bin/sh '.$Config{ZM_WEB_USER}.q` -c '`;
++    $prefix = 'su -m '.$Config{ZM_WEB_USER}.q` -c '`;
      $suffix = q`'`;
      $command = $prefix.$null_command.$suffix;
      Debug("Testing \"$command\"");
Index: pkgsrc/security/zoneminder/patches/patch-src_zm__utils.cpp
diff -u pkgsrc/security/zoneminder/patches/patch-src_zm__utils.cpp:1.5 pkgsrc/security/zoneminder/patches/patch-src_zm__utils.cpp:1.6
--- pkgsrc/security/zoneminder/patches/patch-src_zm__utils.cpp:1.5      Thu Jul 30 12:36:00 2026
+++ pkgsrc/security/zoneminder/patches/patch-src_zm__utils.cpp  Sun Oct 11 00:04:42 2026
@@ -1,23 +1,12 @@
-$NetBSD: patch-src_zm__utils.cpp,v 1.5 2026/07/30 12:36:00 gdt Exp $
-
-Fix time types.
+$NetBSD: patch-src_zm__utils.cpp,v 1.6 2026/10/11 00:04:42 gdt Exp $
 
 Hack around arm detection woes.
 
-\todo Send time upstream and fix arm problems.
+\todo Fix/upstream.
 
---- src/zm_utils.cpp.orig      2026-05-28 12:42:49.000000000 +0000
+--- src/zm_utils.cpp.orig      2026-10-05 23:07:17.000000000 +0000
 +++ src/zm_utils.cpp
-@@ -215,7 +215,7 @@ std::string TimevalToString(timeval tv) 
-     return "";
-   }
- 
--  return stringtf("%s.%06ld", tm_buf.data(), tv.tv_usec);
-+  return stringtf("%s.%06ld", tm_buf.data(), (long) tv.tv_usec);
- }
- 
- /* Detect special hardware features, such as SIMD instruction sets */
-@@ -264,8 +264,8 @@ void HwCapsDetect() {
+@@ -291,8 +291,8 @@ void HwCapsDetect() {
    elf_aux_info(AT_HWCAP, &auxval, sizeof(auxval));
    if (auxval & HWCAP_NEON) {
  #else
Index: pkgsrc/security/zoneminder/patches/patch-src_zm_signal_cpp
diff -u pkgsrc/security/zoneminder/patches/patch-src_zm_signal_cpp:1.5 pkgsrc/security/zoneminder/patches/patch-src_zm_signal_cpp:1.6
--- pkgsrc/security/zoneminder/patches/patch-src_zm_signal_cpp:1.5      Thu Jul 30 12:36:00 2026
+++ pkgsrc/security/zoneminder/patches/patch-src_zm_signal_cpp  Sun Oct 11 00:04:42 2026
@@ -1,4 +1,4 @@
-$NetBSD: patch-src_zm_signal_cpp,v 1.5 2026/07/30 12:36:00 gdt Exp $
+$NetBSD: patch-src_zm_signal_cpp,v 1.6 2026/10/11 00:04:42 gdt Exp $
 
 Don't assume machine-dependent IP register details are available for any
 platform except Linux.  Only Linux is sure to have this style of mcontext_t.
@@ -6,18 +6,18 @@ Instead, add an #else for NetBSD.
 
 \todo File upstream.
 
---- src/zm_signal.cpp.orig     2026-05-28 12:42:49.000000000 +0000
+--- src/zm_signal.cpp.orig     2026-10-05 23:07:17.000000000 +0000
 +++ src/zm_signal.cpp
-@@ -118,6 +118,8 @@ RETSIGTYPE zm_die_handler(int signal)
- #if defined(__x86_64__)
- #if defined(__FreeBSD_kernel__) || defined(__FreeBSD__)
+@@ -120,6 +120,8 @@ RETSIGTYPE zm_die_handler(int signal)
+     ip = (void *)(uc->uc_mcontext->__ss.__rip);
+ #elif defined(__FreeBSD_kernel__) || defined(__FreeBSD__)
      ip = (void *)(uc->uc_mcontext.mc_rip);
 +#elif defined(__NetBSD__)
 +    ip = (void *) _UC_MACHINE_PC(uc);
  #elif defined(__OpenBSD__)
      ip = (void *)(uc->sc_rip);
  #else
-@@ -126,18 +128,24 @@ RETSIGTYPE zm_die_handler(int signal)
+@@ -128,6 +130,8 @@ RETSIGTYPE zm_die_handler(int signal)
  #elif defined(__i386__)
  #if defined(__FreeBSD_kernel__) || defined(__FreeBSD__)
      ip = (void *)(uc->uc_mcontext.mc_eip);
@@ -26,8 +26,9 @@ Instead, add an #else for NetBSD.
  #else
      ip = (void *)(uc->uc_mcontext.gregs[REG_EIP]);
  #endif
- #elif defined(__aarch64__)
- #if defined(__FreeBSD__)
+@@ -136,12 +140,16 @@ RETSIGTYPE zm_die_handler(int signal)
+     ip = (void *)(uc->uc_mcontext->__ss.__pc);
+ #elif defined(__FreeBSD__)
      ip = (void *)(uc->uc_mcontext.mc_gpregs.gp_elr);
 +#elif defined(__NetBSD__)
 +    ip = (void *) _UC_MACHINE_PC(uc);

Prev by Date: CVS commit: pkgsrc/textproc/stng
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/textproc/stng
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index