- Document slapd acl selfwrite Security Issue in openldap

- Document "System.CodeDom.Compiler" Insecure Temporary Creation in mono

- Document open_basedir Race Condition Vulnerability in php

- Document NULL byte injection vulnerability in phpbb

- Add references and use earlier discovery date in
fffa9257-3c17-11db-86ab-00123ffe8333

- Add CVE names to 19b17ab4-51e0-11db-a5ae-00508d6a62df

- Document admin section SQL injection in postnuke

- Document LWFN Files Buffer Overflow Vulnerability in freetype

- Document Buffer Overflow Vulnerabilities in cscope

- Document RSA Signature Forgery Vulnerability in gnutls

- Document Search Unspecified XSS in MT

- Update dokuwiki advisories

- Document latest XSRF vulnerabilities in phpmyadmin

- Mark gtetrinet 0.7.10 safe

Document openssh -- multiple vulnerabilities AKA
FreeBSD-SA-06:22.openssh.

- Document multiple vulnerabilities in dokuwiki

- Document multiple vulnerabilities in tikiwiki

- Document NULL byte injection vulnerability in punbb

- Concisify a Secunia report
- Use <gt>0 for an unpatched bug

Suggested by:   simon

- Document (another) Denial of Service Vulnerability in freeciv

- Document Packet Parsing Denial of Service Vulnerability in freeciv

- Document multiple vulnerabilities in plans

- Update the unace advisory

- Document multiple XSS security bugs in eyeOS

- Document restructuredText "csv_table" Information Disclosure in zope

- Document stack-based buffer overflow in libmms

- Document Opera SSL RSA Signature Forgery

Bump modified data which was missed in last commit.

- Mark latest linux-{firefox,seamonkey}-devel safe

Document mozilla -- multiple vulnerabilities.

In the PHP entry, replace mod-php with mod_php [1].

Rewrite the win32-codecs entry to even better explain the vulnerability [2].

Noticed by:             Dan Langille (with FreshPorts.org) [1]
Discussed with:         simon [2]

Try to explain a bit better that users who have the Quicktime plugin
as a browser plugin can be directly affected by the remote code
execution.

Also mention that I changed the entry date in the previous entry
(PHP) which I had forgotten to do yesterday and did not mention
in the previous commit.

Document win32-codecs -- multiple vulnerabilities

Attempt two:

Document php -- multiple vulnerabilities

OK, I do not know WHAT went wrong but it went wrong, revert to the old
situation and i will re-adopt the PHP entry.

Document php -- multiple vulnerabilities

Cancel latest gnutls entry (GNUTLS-SA-2006-3) - it is a false alarm:

http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001208.html

Upgrade drupal-pubcookie to the latest version fixing a security hole
allowing anyone to bypass the authenication system and become an
arbitrary drupal user.

Security:       vid:c0fd7890-4346-11db-89cc-000ae42e9b93

Style neats for the latest gnutls entry.

Reviewed by:    remko

correct the tomcat entry (change the ,5 to _5 since we talk about PORTREVISION
instead of PORTEPOCH) [1]

correct the jdk -- jar directory traversal vulnerability entry, the
FreeBSD Foundation uses different package names [2], [3].

For both entries the modification date was bumped.

Reported by:            Gabor Kovesdan (on #bsdports) [1]
                        David Robillard <david dot robillard at gmail dot com>
[2]
                        Tim Zingelman <zingelman at fnal dot gov>

Document linux-flashplugin7 -- arbitrary code execution vulnerabilities.

Mark jakarta-tomcat5 as fixed since 5.0.30,5 regarding minor XSS issue.

Add an info about GNUTLS-SA-2006-3.

- mailman -- Multiple Vulnerabilities

Bump modification date for last jabber entry change

Noted by:       remko

Fix jabber entry

Document hlstats -- multiple cross site scripting vulnerabilities.

Document gtetrinet -- remote code execution

Bump modified date in the entry changed by garga.

Forgotten by:   garga

net-im/jabber -- Mark the correct versions with fd_set vulnerability, author
fixed the problem on trunk and 2 new releases (1.4.3.1 and 1.4.4.1) is comming
soon

Update the latest FreeBSD-SA entry, ppp got replaced by sppp.
Also implement a suggestion from Simon, mark all versions before
the latest version vulnerable.

Document joomla -- multiple vulnerabilities

Note that I only documented the high level
threats, there are several others which can
be found at the link provided [1]

Reference:      http://www.joomla.org/content/view/1841/78/ [1]

Document FreeBSD-SA-06:18.ppp

Minor whitespace cleanup (we need a blank line every after </entry>
so that we can easily see the different entries).

- Add imp to the previous entry.
- Add some SecurityFocus BIDs too.

Document horde -- Phishing and Cross-Site Scripting Vulnerabilities.

Convert 8 spaces to tab as per the FDP for the latest
entry.

Add entry for globus tmpfile creation bugs.

The lang/f2c port has been updated, update affected versions.

Reviewed by:    simon

Document x11vnc -- authentication bypass vulnerability.

The 1.1111th commit, yay.

Document alsaplayer -- multiple vulnerabilities.

Document postgresql -- encoding based SQL injection.

Reported by:            Radim Kolar <hsn at netmag dot cz>

Bump modified date in the older entry I just corrected.

Spotted by:     simon (again)

Document postgresql -- multiple vulnerabilities.

These are all older vulnerabilities which had not yet been documented
by the Security Team.

Also fix a minor mistake in an older PostgreSQL entry.

Fix the discovery date in the latest MySQL entry.

Spotted by:     simon

Document mysql -- format string vulnerability.

OK after some more discussions with Simon it appeared that the ,2
marked all future releases of squirrelmail as vulnerable.

The negative side-effect of PORTEPOCH.  Split the previous entry
into two seperated entries again, restoring the old entry for
squirrelmail, and having the 'new' entry for ja-squirrelmail.

This would grab any future versions of ja-squirrelmail if it were
to be readded, and does not conflict with future versions of
squirrelmail.

For more information about the portepoch discussion etc:
http://lists.freebsd.org/pipermail/freebsd-vuxml/2006-July/000185.html

Simon provided me with the necessary clue to mark the appropriate ports
as vulnerable.  I was soo close..

Document squirrelmail -- random variable overwrite vulnerability.

Note that I marked all ja-squirrelmail entries as vulnerable, it
does no longer exist on it's own and the portepoch is giving me
matching problems.

Document rubygem-rails -- evaluation of ruby code.

Submitted by:   Marius Nuennerich <marius.nuennerich@gmx.net>

Add CVE name to recent ClamAV entry.

Document clamav and clamav-devel vulnerability

Reviewed by:    secteam (mnag)

- Fix discovery date in latest entry
- Remove extra "." in latest entry

Update drupal to 4.6.9 to fix yet another XSS vulnerability.

Security:       vuxml vid c905298c-2274-11db-896e-000ae42e9b93

Add recent gnupg issue.

We are not affected by: CAN-2005-0018 in the
f2c entry (43cb40b3-c8c2-11da-a672-000e0c2e438a).  We do not have
the shellscript, and it is not installed.

Reported by:            thierry

Unbreak latest ruby entry by adding missing </lt>.

Run make tidy to clean up some style issues.

Only sort on entry date, not modified date.  It simply causes too much
repo churn with little value to resort all entries which have been
modified.

- The last vulnerabilities was fixed in ruby18 port

OK, I misunderstood Simon with this one.  The <gt>1.8.*</gt> entry
should have stayed and I interpreted that wrong.

Pointyhat:              remko

Fix my previous version commit.  The two entries matched twice when you
have ruby installed.  You learn something new everyday...

Noticed/discussed with:         simon

Mark all 1.6 and 1.8 versions as vulnerable, we do not have a fix
yet and are unable to tell what the naming scheme will be with
those patches.  We can narrow down the scope later, we should
not do so before we know the mentioned scheme.

Triggered by:           sem

Add a BID to the latest vuxml entry.
Some minor changes to the markup of the entry.

- Document Ruby vulnerability. [1]
- Fix URL in previous mutt entry while here.

Reported by:    Joel Hatton via freebsd-ports [1]

Add linux-thunderbird to mozilla -- multiple vulnerabilities entry.

Prodded by:     sat

Document apache -- mod_rewrite ldap buffer overflow vulnerability.

Thanks to remko for doing initial list of apache package names in an
earlier VuXML entry.

Fix error in latest mozilla entry which marked all firefox version as
vulnerable.

Reported by:    Craig Leres

Document mozilla -- multiple vulnerabilities.

Note I assume that linux-firefox-devel 3.0.a2006.07.26 is fixed, I
haven't actually checked (way to many issues to check for).

Add "zope -- information disclosure vulnerability" entry

Reviewed by:    simon

For latest drupal entry:
 - Unbreak vuln.xml format by adding content to the references section.
 - Remove vulnerabilities already documented in
   40a0185f-ec32-11da-be02-000c6ec775d9.

Add entry for drupal issues.

Add shoutcast crosssite scripting.

Submitted by:   gabor
Reviewed by:    simon

Cancel VID 0a4cd819-0291-11db-bbf7-000c6ec775d9 / opera -- JPEG
processing integer overflow vulnerability, since it turns out that the
issue does not affect the FreeBSD or Linux versions of Opera.

Source: http://www.opera.com/support/search/supsearch.dml?index=834

Correct dates in latest mambo entry by resetting entry date and adding
a modified date.

OK'ed by:       itetcu

Bump modified date for previous commit.

Requested by:   simon

The two two SQL injection vulnerabilities in Mambo described in
vid f70d09cb-0c46-11db-aac7-000c6ec775d9 are fixed in 4.5.4

PR:             ports/100044
Submited by:    maintainer

Fix markup breakage that slipped in just before commit of the latest
samba entry.

Document samba -- memory exhaustion DoS in smbd.

- For the latest trac entry include information from the release
  announcements about setups which are not affected.  To avoid having
  to reference two documents simply reference the release notes for
  all the information (it's basically the same as the changelog with
  slightly different wording).
- Add a modified date tag.