- update firefox to 19.0

- update firefox-esr, thunderbird, linux-firefox, linux-thunderbird to 17.0.3
- update linux-seamonkey to 2.16
- update nspr to 4.9.5
- update nss to 3.14.3
- add DuckDuckGo search plugin to firefox [1]
- mark kompozer deprecated
- clang fixes for www/libxul19 [2]

Security:	http://www.vuxml.org/freebsd/e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02.html
Submitted by:	DuckDuckGo [1], dim [2]
In collaboration with:	Jan Beich <jbeich@tormail.org>

13 files changed, 148 insertions, 68 deletions

diff --git a/security/ca_root_nss/Makefile b/security/ca_root_nss/Makefile
index d81fed79dc88..8facb95e94e3 100644
--- a/security/ca_root_nss/Makefile
+++ b/security/ca_root_nss/Makefile
@@ -5,7 +5,7 @@ PORTNAME=	ca_root_nss
 PORTVERSION=	${VERSION_NSS}
 CATEGORIES=	security
 MASTER_SITES=	${MASTER_SITE_MOZILLA}
-MASTER_SITE_SUBDIR=	security/nss/releases/NSS_${PORTVERSION:S/./_/g}_WITH_CKBI_${CKBI_VER:S/./_/}_RTM/src
+MASTER_SITE_SUBDIR=	security/nss/releases/${DISTNAME:U:C/[-.]/_/g}_RTM/src
 DISTNAME=	nss-${VERSION_NSS}${NSS_SUFFIX}
 
 MAINTAINER=	gecko@FreeBSD.org
@@ -25,11 +25,12 @@ PLIST_SUB+=	CERTDIR=${CERTDIR}
 # !!!  Please DO NOT submit patches for new version until it has !!!
 # !!!  been committed there first.                               !!!
 # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-VERSION_NSS=	3.14.1
-CKBI_VER=	1.93
-NSS_SUFFIX=	.with.ckbi.${CKBI_VER}
+VERSION_NSS=	3.14.3
+#NSS_SUFFIX=	.with.ckbi.1.93
 CERTDATA_TXT_PATH=	nss-${VERSION_NSS}/mozilla/security/nss/lib/ckfw/builtins/certdata.txt
 BUNDLE_PROCESSOR=	MAca-bundle.pl
+SUB_FILES=	MAca-bundle.pl
+SUB_LIST=	VERSION_NSS=${VERSION_NSS}
 
 .include <bsd.port.options.mk>
 
@@ -45,14 +46,9 @@ do-extract:
 	@${TAR} -C ${WRKDIR} -xf ${DISTDIR}/nss-${VERSION_NSS}${NSS_SUFFIX}${EXTRACT_SUFX} \
 	    ${CERTDATA_TXT_PATH}
 	@${CP} ${WRKDIR}/${CERTDATA_TXT_PATH} ${WRKDIR}
-	@${CP} ${FILESDIR}/${BUNDLE_PROCESSOR} ${WRKDIR}
 	@${RM} -rf ${WRKDIR}/nss-${VERSION_NSS}
 
-post-patch:
-	@${PERL} -pi -e 's,%%VERSION_NSS%%,${VERSION_NSS}${NSS_SUFFIX},g;' \
-	    ${WRKDIR}/${BUNDLE_PROCESSOR}
-
-do-build:
+do-build:	apply-slist
 	@${PERL} ${WRKDIR}/${BUNDLE_PROCESSOR} \
 	    < ${WRKDIR}/certdata.txt > \
 	    ${WRKDIR}/ca-root-nss.crt
diff --git a/security/ca_root_nss/distinfo b/security/ca_root_nss/distinfo
index 61a54a477d2a..6cfaa9cbd8bc 100644
--- a/security/ca_root_nss/distinfo
+++ b/security/ca_root_nss/distinfo
@@ -1,2 +1,2 @@
-SHA256 (nss-3.14.1.with.ckbi.1.93.tar.gz) = e22ffcca62d604029145e4f904c59e4a967a20d1276f123a91e76ecaae48ba98
-SIZE (nss-3.14.1.with.ckbi.1.93.tar.gz) = 5813393
+SHA256 (nss-3.14.3.tar.gz) = d9d366be94d33395597ebf82363fcdedfa693a6d627cf7f6bec025f609d54cc0
+SIZE (nss-3.14.3.tar.gz) = 6189790
diff --git a/security/ca_root_nss/files/MAca-bundle.pl b/security/ca_root_nss/files/MAca-bundle.pl.in
index ae6952452fc7..ae6952452fc7 100644
--- a/security/ca_root_nss/files/MAca-bundle.pl
+++ b/security/ca_root_nss/files/MAca-bundle.pl.in
diff --git a/security/nss/Makefile b/security/nss/Makefile
index bcb265201720..52bc584b9606 100644
--- a/security/nss/Makefile
+++ b/security/nss/Makefile
@@ -2,11 +2,11 @@
 # $FreeBSD$
 
 PORTNAME=	nss
-PORTVERSION=	${_MAJOR}.${_MINOR}.${_PATCH}
+PORTVERSION=	3.14.3
+#DISTVERSIONSUFFIX=	.with.ckbi.1.93
 CATEGORIES=	security
 MASTER_SITES=	${MASTER_SITE_MOZILLA}
-MASTER_SITE_SUBDIR=	security/nss/releases/NSS_${PORTVERSION:S/./_/g}_WITH_CKBI_${CKBI_VER:S/./_/}_RTM/src
-DISTNAME=	nss-${PORTVERSION}.with.ckbi.${CKBI_VER}
+MASTER_SITE_SUBDIR=	security/nss/releases/${DISTNAME:U:C/[-.]/_/g}_RTM/src
 
 MAINTAINER=	gecko@FreeBSD.org
 COMMENT=	Libraries to support development of security-enabled applications
@@ -16,11 +16,6 @@ BUILD_DEPENDS=	zip:${PORTSDIR}/archivers/zip \
 LIB_DEPENDS=	nspr4.1:${PORTSDIR}/devel/nspr \
 		sqlite3.8:${PORTSDIR}/databases/sqlite3
 
-_MAJOR=	3
-_MINOR=	14
-_PATCH=	1
-
-CKBI_VER=	1.93
 WRKSRC=		${WRKDIR}/${PORTNAME}-${PORTVERSION}/mozilla/security/nss
 
 MAKE_JOBS_UNSAFE=	yes
@@ -28,10 +23,15 @@ USE_LDCONFIG=	${PREFIX}/lib/nss
 USE_GMAKE=	yes
 USE_PERL5_BUILD=yes
 MAKE_ENV=	BSD_LDOPTS="${PTHREAD_LIBS} -L${LOCALBASE}/lib" \
+		SQLITE_INCLUDE_DIR="${LOCALBASE}/include" \
 		NSS_ENABLE_ECC=1 NSS_USE_SYSTEM_SQLITE=1
 ALL_TARGET=	nss_build_all
 CFLAGS+=	-I${LOCALBASE}/include/nspr -L${LOCALBASE}/lib
 
+SUB_FILES=	nss-config nss.pc
+SUB_LIST=	MAJOR_VERSION=${PORTVERSION:R:R} \
+		PORTVERSION=${PORTVERSION}
+
 DIST=		${WRKSRC:H:H}/dist
 
 EXTERNALS=	CVS dbm security/nss/lib/zlib nsprpub security/dbm
@@ -50,6 +50,16 @@ BINS=		${DIST}/${OPSYS}${OSREL}_OPT.OBJ
 BINS=		${DIST}/${OPSYS}${OSREL}_DBG.OBJ
 .endif
 
+.include <bsd.port.pre.mk>
+
+.if ${ARCH} == amd64
+USE_BINUTILS=	# intel-gcm.s
+CFLAGS+=	-B${LOCALBASE}/${CONFIGURE_TARGET:S/amd64/x86_64/}/bin
+.if defined(WITH_CLANG_IS_CC) || ${CC:Mcc} && ${OSVERSION} > 1000023
+EXTRA_PATCHES+=	${FILESDIR}/extra-bug835050
+.endif
+.endif
+
 check regression-test test:
 	cd ${WRKSRC}/tests;	\
 		${SETENV} PATH="${BINS}/bin:${PATH}" \
@@ -67,23 +77,11 @@ check regression-test test:
 post-patch:
 	@${REINPLACE_CMD} -e "s|-pthread|${PTHREAD_LIBS}|g" \
 		${WRKSRC:H:H}/security/coreconf/FreeBSD.mk
-	@${SED} -e 's|@exec_prefix@|${PREFIX}|; \
-		s|@includedir@|${PREFIX}/include/nss|; \
-		s|@libdir@|${PREFIX}/lib/nss|; \
-		s|@prefix@|${PREFIX}|' \
-		${FILESDIR}/nss-config.in >${WRKDIR}/nss-config
-	@${SED} -e 's|@PREFIX@|${PREFIX}|; s|@PORTVERSION@|${PORTVERSION}|' \
-		${FILESDIR}/nss.pc.in >${WRKDIR}/nss.pc
-.for i in MAJOR MINOR PATCH
-	@${SED} -i.${i} -e 's|@${i}@|${_${i}}|' ${WRKDIR}/nss-config
-.endfor
 	@${REINPLACE_CMD} '/NSS_DEFAULT_SYSTEM/s,/etc,${PREFIX}&,' \
 		${WRKSRC}/lib/sysinit/nsssysinit.c
 	@cd ${WRKSRC} && \
 		${FIND} . -name "*.c" -o -name "*.h" | \
 		${XARGS} ${REINPLACE_CMD} -e 's|"nspr.h"|<nspr.h>|'
-	@${REINPLACE_CMD} -e 's|/usr/local|${LOCALBASE}|g' \
-		${WRKSRC}/lib/softoken/manifest.mn
 	${FIND} ${WRKSRC}/tests -name '*.sh' | ${XARGS} ${GREP} -l -F '/bin/bash' | \
 		${XARGS} ${REINPLACE_CMD} -e 's|#! */bin/bash|#!${SH}|'
 
@@ -104,4 +102,4 @@ do-install:
 	${INSTALL_SCRIPT} ${WRKDIR}/nss-config ${PREFIX}/bin
 	${INSTALL_DATA} ${WRKDIR}/nss.pc ${PREFIX}/libdata/pkgconfig
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/security/nss/distinfo b/security/nss/distinfo
index 61a54a477d2a..6cfaa9cbd8bc 100644
--- a/security/nss/distinfo
+++ b/security/nss/distinfo
@@ -1,2 +1,2 @@
-SHA256 (nss-3.14.1.with.ckbi.1.93.tar.gz) = e22ffcca62d604029145e4f904c59e4a967a20d1276f123a91e76ecaae48ba98
-SIZE (nss-3.14.1.with.ckbi.1.93.tar.gz) = 5813393
+SHA256 (nss-3.14.3.tar.gz) = d9d366be94d33395597ebf82363fcdedfa693a6d627cf7f6bec025f609d54cc0
+SIZE (nss-3.14.3.tar.gz) = 6189790
diff --git a/security/nss/files/extra-bug835050 b/security/nss/files/extra-bug835050
new file mode 100644
index 000000000000..a9ccd0a0c0d1
--- /dev/null
+++ b/security/nss/files/extra-bug835050
@@ -0,0 +1,10 @@
+--- lib/freebl/Makefile~
++++ lib/freebl/Makefile
+@@ -659,7 +659,5 @@ $(OBJDIR)/$(PROG_PREFIX)intel-gcm-wrap$(
+ # symbolic names to registers, for example,
+ #     .set  Htbl, %rdi
+ # So we can't use Clang's integrated assembler with intel-gcm.s.
+-ifneq (,$(findstring clang,$(AS)))
+ $(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): ASFLAGS += -no-integrated-as
+ endif
+-endif
diff --git a/security/nss/files/nss-config.in b/security/nss/files/nss-config.in
index 4e7f19737940..eba0fa7f528c 100644
--- a/security/nss/files/nss-config.in
+++ b/security/nss/files/nss-config.in
@@ -1,10 +1,6 @@
 #!/bin/sh
 
-prefix=@prefix@
-
-major_version=@MAJOR@
-minor_version=@MINOR@
-patch_version=@PATCH@
+prefix=%%PREFIX%%
 
 usage()
 {
@@ -68,7 +64,7 @@ while test $# -gt 0; do
       echo_libdir=yes
       ;;
     --version)
-      echo ${major_version}.${minor_version}.${patch_version}
+      echo %%PORTVERSION%%
       ;;
     --cflags)
       echo_cflags=yes
@@ -97,13 +93,13 @@ done
 
 # Set variables that may be dependent upon other variables
 if test -z "$exec_prefix"; then
-    exec_prefix=@exec_prefix@
+    exec_prefix=$prefix
 fi
 if test -z "$includedir"; then
-    includedir=@includedir@
+    includedir=$prefix/include/nss
 fi
 if test -z "$libdir"; then
-    libdir=@libdir@
+    libdir=$prefix/lib/nss
 fi
 
 if test "$echo_prefix" = "yes"; then
@@ -129,16 +125,16 @@ fi
 if test "$echo_libs" = "yes"; then
       libdirs="-L$libdir"
       if test -n "$lib_ssl"; then
-	libdirs="$libdirs -lssl${major_version}"
+	libdirs="$libdirs -lssl%%MAJOR_VERSION%%"
       fi
       if test -n "$lib_smime"; then
-	libdirs="$libdirs -lsmime${major_version}"
+	libdirs="$libdirs -lsmime%%MAJOR_VERSION%%"
       fi
       if test -n "$lib_nss"; then
-	libdirs="$libdirs -lnss${major_version}"
+	libdirs="$libdirs -lnss%%MAJOR_VERSION%%"
       fi
       if test -n "$lib_nssutil"; then
-	libdirs="$libdirs -lnssutil${major_version}"
+	libdirs="$libdirs -lnssutil%%MAJOR_VERSION%%"
       fi
       echo $libdirs
 fi      
diff --git a/security/nss/files/nss.pc.in b/security/nss/files/nss.pc.in
index 3aca32ee3208..12df4b7d05fd 100644
--- a/security/nss/files/nss.pc.in
+++ b/security/nss/files/nss.pc.in
@@ -1,11 +1,11 @@
-prefix=@PREFIX@
-exec_prefix=@PREFIX@
-libdir=@PREFIX@/lib/nss
-includedir=@PREFIX@/include
+prefix=%%PREFIX%%
+exec_prefix=%%PREFIX%%
+libdir=%%PREFIX%%/lib/nss
+includedir=%%PREFIX%%/include
 
 Name: NSS
 Description: Mozilla Network Security Services
-Version: @PORTVERSION@
+Version: %%PORTVERSION%%
 Requires: nspr
 Libs: -L${libdir} -lnss3 -lsmime3 -lssl3 -lnssutil3
 Cflags: -I${includedir}/nss -I${includedir}/nss/nss
diff --git a/security/nss/files/patch-..::coreconf::FreeBSD.mk b/security/nss/files/patch-..::coreconf::FreeBSD.mk
index 2b8c57181be8..c215c366f0af 100644
--- a/security/nss/files/patch-..::coreconf::FreeBSD.mk
+++ b/security/nss/files/patch-..::coreconf::FreeBSD.mk
@@ -27,7 +27,7 @@
  
  OS_CFLAGS		= $(DSO_CFLAGS) -ansi -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
  
-@@ -65,20 +80,18 @@
+@@ -65,20 +80,20 @@
  USE_PTHREADS		= 1
  DEFINES			+= -D_THREAD_SAFE -D_REENTRANT
  OS_LIBS			+= -pthread
@@ -38,7 +38,9 @@
  ARCH			= freebsd
  
 -MOZ_OBJFORMAT		:= $(shell test -x /usr/bin/objformat && /usr/bin/objformat || echo elf)
++ifndef MOZILLA_CLIENT
 +DLL_SUFFIX		= so.1
++endif
  
 -ifeq ($(MOZ_OBJFORMAT),elf)
 -DLL_SUFFIX		= so
diff --git a/security/nss/files/patch-..::coreconf::rules.mk b/security/nss/files/patch-..::coreconf::rules.mk
index 707f69da83ea..7b2adc31a707 100644
--- a/security/nss/files/patch-..::coreconf::rules.mk
+++ b/security/nss/files/patch-..::coreconf::rules.mk
@@ -1,10 +1,12 @@
 --- ../coreconf/rules.mk.orig	Sat Jan  6 00:48:54 2007
 +++ ../coreconf/rules.mk	Fri Mar 23 10:15:46 2007
-@@ -114,6 +114,7 @@
+@@ -114,6 +114,9 @@
  endif
  ifdef SHARED_LIBRARY
  	$(INSTALL) -m 775 $(SHARED_LIBRARY) $(SOURCE_LIB_DIR)
++ifndef MOZILLA_CLIENT
 +	ln -sf $(notdir $(SHARED_LIBRARY)) $(SOURCE_LIB_DIR)/$(notdir $(SHARED_LIBRARY:.so.1=.so))
++endif
  ifdef MOZ_DEBUG_SYMBOLS
  ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
  	$(INSTALL) -m 644 $(SHARED_LIBRARY:$(DLL_SUFFIX)=pdb) $(SOURCE_LIB_DIR)
diff --git a/security/nss/files/patch-lib_softoken_manifest.mn b/security/nss/files/patch-lib_softoken_manifest.mn
deleted file mode 100644
index 402e89a80507..000000000000
--- a/security/nss/files/patch-lib_softoken_manifest.mn
+++ /dev/null
@@ -1,13 +0,0 @@
---- lib/softoken/manifest.mn.orig	2010-07-30 04:33:26.000000000 +0200
-+++ lib/softoken/manifest.mn	2010-10-17 12:01:04.000000000 +0200
-@@ -47,9 +47,7 @@
- 
- DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\" -DSHLIB_VERSION=\"$(LIBRARY_VERSION)\"
- 
--ifdef SQLITE_INCLUDE_DIR
--INCLUDES += -I$(SQLITE_INCLUDE_DIR)
--endif
-+INCLUDES += -I$(LOCALBASE)/include
- 
- EXPORTS = \
- 	secmodt.h \
diff --git a/security/nss/files/patch-pr175656 b/security/nss/files/patch-pr175656
new file mode 100644
index 000000000000..1f1bd51b838e
--- /dev/null
+++ b/security/nss/files/patch-pr175656
@@ -0,0 +1,13 @@
+--- lib/softoken/sdb.c~
++++ lib/softoken/sdb.c
+@@ -38,6 +38,10 @@
+ #include <unistd.h>
+ #endif
+ 
++#ifndef SQLITE_FCNTL_TEMPFILENAME
++#define SQLITE_FCNTL_TEMPFILENAME 16
++#endif
++
+ #ifdef SQLITE_UNSAFE_THREADS
+ #include "prlock.h"
+ /*
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index 1f20a89e261a..7fc6b22e08a6 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -51,6 +51,82 @@ Note:  Please add new entries to the beginning of this file.
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02">
+    <topic>mozilla -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>firefox</name>
+	<range><gt>11.0,1</gt><lt>19.0,1</lt></range>
+	<range><lt>17.0.3,1</lt></range>
+      </package>
+      <package>
+	<name>linux-firefox</name>
+	<range><lt>17.0.3,1</lt></range>
+      </package>
+      <package>
+	<name>linux-seamonkey</name>
+	<range><lt>2.16</lt></range>
+      </package>
+      <package>
+	<name>linux-thunderbird</name>
+	<range><lt>17.0.3</lt></range>
+      </package>
+      <package>
+	<name>seamonkey</name>
+	<range><lt>2.16</lt></range>
+      </package>
+      <package>
+	<name>thunderbird</name>
+	<range><gt>11.0</gt><lt>17.0.3</lt></range>
+	<range><lt>10.0.12</lt></range>
+      </package>
+      <package>
+	<name>libxul</name>
+	<range><gt>1.9.2.*</gt><lt>10.0.12</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The Mozilla Project reports:</p>
+	<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
+	  <p>MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 /
+	    rv:17.0.3)</p>
+	  <p>MFSA 2013-22 Out-of-bounds read in image rendering</p>
+	  <p>MFSA 2013-23 Wrapped WebIDL objects can be wrapped again</p>
+	  <p>MFSA 2013-24 Web content bypass of COW and SOW security wrappers</p>
+	  <p>MFSA 2013-25 Privacy leak in JavaScript Workers</p>
+	  <p>MFSA 2013-26 Use-after-free in nsImageLoadingContent</p>
+	  <p>MFSA 2013-27 Phishing on HTTPS connection through malicious proxy</p>
+	  <p>MFSA 2013-28 Use-after-free, out of bounds read, and buffer
+	    overflow issues found using Address Sanitizer</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+	<cvename>CVE-2013-0765</cvename>
+	<cvename>CVE-2013-0772</cvename>
+	<cvename>CVE-2013-0773</cvename>
+	<cvename>CVE-2013-0774</cvename>
+	<cvename>CVE-2013-0775</cvename>
+	<cvename>CVE-2013-0776</cvename>
+	<cvename>CVE-2013-0783</cvename>
+	<cvename>CVE-2013-0784</cvename>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-20.html</url>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-21.html</url>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-22.html</url>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-23.html</url>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-24.html</url>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-25.html</url>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-26.html</url>
+	<url>http://www.mozilla.org/security/announce/2013/mfsa2013-27.html</url>
+	<url>http://www.mozilla.org/security/known-vulnerabilities/</url>
+    </references>
+    <dates>
+      <discovery>2013-02-19</discovery>
+      <entry>2013-02-19</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="fcfdabb7-f14d-4e61-a7d5-cfefb4b99b15">
     <topic>Ruby Rack Gem -- Multiple Issues</topic>
     <affects>