PowerDNS discovered the fix for CVE-2015-1868 was not complete in the
previous releases.

Security:	64e6006e-f009-11e4-98c6-000c292ee6b8
Security:	CVE-2015-5470

Add note on how to use the new html functionality

Add ability to produce html files for vuxml entries

This will allow committers to test complex vuxml entries before
submission.

A special thanks to hrs for responding to my plea for this feature

Submitted by:	hrs

- Add xen-tools to the list of packages fixed in existing
XSA-135 / CVE-2015-3209 entry

PR:		201416
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>

Document all recent xen-kernel and xen-tools security issues

PR:		201416
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>

Document a few pivotx vulnerabilities

Update squid entry to reflect new range of affected versions
Still waiting on CVE assignment

PR:		201374
Security:	150d1538-23fa-11e5-a4a5-002590263bf5

Document wpa_supplicant  WPS_NFC option payload length validation
vulnerability

PR:		201432
Submitted by:	Jason Unovitch

Document OpenSSL alternative chains certificate forgery vulnerability.

- Correct the version range of www/py-django-devel

document django vulnerabilities

Security:	37ed8e9c-2651-11e5-86ff-14dae9d210b8
Security:	CVE-2015-5143
Security:	CVE-2015-5144
Security:	CVE-2015-5145

node and iojs vuln now has a CVE assigned

Security:	864e6f75-2372-11e5-86ff-14dae9d210b8
Security:	CVE-2015-5380

Document Adobe Flash Plugin vulnerability (CVE-2015-5119)

Fix other no-op formatting mistakes for the roundcube entry

Security:	038a5808-24b3-11e5-b0c8-bf4d8935d4fa

Fix formatting by adding some breaks

Security:	038a5808-24b3-11e5-b0c8-bf4d8935d4fa

Make version range closer to reality -- this should be a no-op (use of P2
and P1 without PORTREVISION is intentional).

-base options for dns/bind have been gone now.  Cover them with <gt>0</gt>
for this entry so that existing users gets warned.

Noticed by:	mat

Document BIND remote resolver DoS vulnerability when DNSsec validation
is enabled.

cups-filters mentions wrong CVE in some places

incorrect: CVE-2015-3259
correct: CVE-2015-3279

Add mailing list post that clarifies this

Security:	bf1d9331-21b6-11e5-86ff-14dae9d210b8

Document haproxy information leak

Security:	CVE-2015-3281

Document roundcube vulnerabilities

Security:	CVE-2015-5381
Security:	CVE-2015-5383

Document SQL Injection in turnserver

PR:		201231

Document recent squid vulnerabilities

PR:		201374

Use correct end tag.

Submitted by:	dvl@

Add iojs as affected package

Security:	864e6f75-2372-11e5-86ff-14dae9d210b8

Correct bitcoin range for CVE-2015-3641

Document ansible vulnerabilities

PR:		201359

Document bitcoin CVE-2015-3641

add node-devel as affected package
confirmed source code of node 0.11.16 is also vulnerable

add www/node denial of service vulnerability
no known CVE has been assigned

cups-filters CVE-2015-3279

Fix range for linux-c6-openssl

Record libxml2 vulnability

Security:	CVE-2015-1819

Correct version range for netpbm CVE-2015-3885

Document games/wesnoth authentication information disclosure vulnerability.

PR:		201105
Submitted by:	Jason Unovitch

- Document CVE-2015-3258 (cups-filters buffer overflow vulnerability)

PR:		201134
Submitted by:	cyberbotx@cyberbotx.com
Differential Revision:

Document ntp remote control message DoS vulnerability.

Document qemu pcnet guest to host escape vulnerability - CVE-2015-3209

PR:		201064
Submitted by:	koobs
Security:	https://vuxml.FreeBSD.org/freebsd/acd5d037-1c33-11e5-be9c-6805ca1d3bb1.html

Document CVE-2014-3120, CVE-2014-6439, CVE-2015-1427, CVE-2015-3337,
and CVE-2015-4165 (various Elasticsearch vulnerabilities).

PR:		ports/201008
Submitted by:	Jason Unovitch

Split CVE-2015-4152 to its own entry as the affected port is logstash only.

While there also document CVE-2014-4326 (already fixed) for logstash.

PR:		ports/201001
Submitted by:	Jason Unovitch

Add entry for logstash-forwarder/logstash.

PR:		ports/201065
Submitted by:	Jason Unovitch

Aggressively mark more consumers of bundled dcraw as vulnerable

ljpeg_start() originates from dcraw, no need to list every package with
copy of it at the expense of readability.

Document linux-*-flashplugin11 CVE.

Reported by:	kwm
Reviewed by:	kwm
Security:	d02f6b01-1a3f-11e5-8bd6-c485083ca99c
Security:	CVE-2015-3113
Sponsored by:	Perceivon Hosting Inc.

Fix entry date.

Document rubygem-bson DoS and possible injection vulnerability.

PR:		201061
Submitted by:	Jason Unovitch

Document 3 vulnerabilities with PHP that affected 4 extensions.

PR:		200926
Submitted by:	Jason Unovitch

Reflect version range change after r390340.  While I'm there, also fix
the CVE-2015-4556 entry because it's not yet fixed in the ports tree and
add a reference to the PR while there.

PR:		200980
Submitted by:	Vitaly Magerya (with changes suggested by Jason Unovitch)

Document vulnerabilities in devel/ipython < 3.2.0.

Document new vulnerabilities in www/chromium < 43.0.2357.130

Obtained
from:	http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html

Document rubygem-paperclip validation bypass vulnerabilitiy.

PR:		200979
Submitted by:	Jason Unovitch

Document lang/chicken vulnerabilities CVE-2014-9651 and CVE-2015-4556.

PR:		200980
Submitted by:	Jason Unovitch

Document cacti multiple vulnerabilities (affects < 0.8.8c) and
multiple XSS/SQL injection vulnerabilities (affects < 0.8.8d).

PR:		200963
Submitted by:	Jason Unovitch

Add p5-Dancer vuln.

Document Drupal multiple vulnerabilities.

Document two vulnerabilities of cURL.

- Make it compatible with Python 3.x

Approved by:	delphij

- Document Ruby on Rails multiple vulnerabilities

Modify a5f160fa-deee-11e4-99f8-080027ef73ec so it covers ja-mailman too.

Submitted by:	Yasuhito FUTATSUKI

Document testdisk multiple vulnerabilities.

PR:		ports/200250
Submitted by:	Jason Unovitch

Document Tomcat multiple vulnerabilities.

Add ossec-hids-* vulnerabilities.

PR:		200801
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
Approved by:	swills (mentor)

- Add vulnerability information for additional ports affected by openssl CVEs in
8305e215-1080-11e5-8ba2-000c2980a9f3

- Document recent vulnerabilities in security/openssl

Document 13 Flash vulnerabilities.
Affected: www/linux-*-flashplugin11.

Document libzmq4 V3 protocol handler protocol downgrade vulnerability.

PR:		200502
Submitted by:	Jason Unovitch

Document pgbouncer remote denial of service vulnerability.

PR:		200537
Submitted by:	Jason Unovitch

Document cups multiple vulnerabilities.

Document two strongswan vulnerabilities.

PR:		200721
Submitted by:	Jason Unovitch (with changes: wrapped long line and changed
		CVE-2015-3991's coverage to cover only < 5.3.1 to reflect
		the reality).

Document redis EVAL Lua sandbox escape vulnerability.

Add an entry for www/tidy-* heap-buffer-overflow.

PR:		ports/200631
Submitted by:	Walter Hop

Fix typo and remove PHP from pcre vulnerabilities, as the bundled pcre
is not used.

Document fixed version of pcre in e69af246-0ae2-11e5-90e4-d050996490d0.

- Update VuXML

PR:		200196
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>

- Re-add PHP removed in previous commit
- Update pcre to use lt instead of gt

- Make version matching on the pcre vuln a little more sane
- Remove PHP as the vulnerability appears to be in devel/pcre, not php

Document two recent pcre vulnerabilities that can be triggered by
specifically crafted *patterns* and would lead to stack or heap
overflow.

Update information for graphics/libraw.

PR:	200194

security/vuxml: multiple vulnerabilities of wpa_supplicant and hostapd

Security:	CVE-2015-4141
Security:	CVE-2015-4142
Security:	CVE-2015-4143
Security:	CVE-2015-4144
Security:	CVE-2015-4145
Security:	CVE-2015-4146
PR:		200568

Document recent ffmpeg0 vulnerabilities

Add entry for vulnerable versions of avidemux2 and avidemux26

PR:		200507
Submitted by:	venture37@geeklan.co.uk

security/vuxml: add www/rubygem-rest-client vulnerabilities

PR:		200504
Differential Revision:	https://reviews.freebsd.org/D2699
Submitted by:	Sevan Janiyan <venture37@geeklan.co.uk>
Approved by:	ports-secteam (delphij, eadler)
Security:	CVE-2015-1820
Security:	CVE-2015-3448

 - Add kodi to 57325ecf-facc-11e4-968f-b888e347c638 [1]
 - Update entry dates for newly added entry.

PR:		200200 [1]
Submitted by:	Jason Unovitch [1]

Reflect CVE-2015-2060 and CVE-2014-9556.

PR:		ports/198955
Submitted by:	Jason Unovitch

- Document django vulnerability CVE-2015-3982

Extend 57325ecf-facc-11e4-968f-b888e347c638 to cover rawstudio as well.

PR:		200199
Submitted by:	Jason Unovitch

Document the issue with proxychains-ng which uses current directory when
searching for its own shared library (CVE-2015-3887).

PR:		200511
Submitted by:	Jason Unovitch

Document wireshark multiple vulnerabilities.

Document krb5 requires_preauth bypass in PKINIT-enabled KDC.

Retrofit document cURL multiple vulnerabilities.

Document cassandra remote code execution vulnerability.

PR:		199091
Submitted by:	Jason Unovitch <jason unovitch gmail com>

Fix version range for previous commit.

Extend CVE-2015-3456 to cover xen-tools (4.5.0-4.5.0_5: we didn't supported
the feature in earlier version of this port) and VirtualBox cases as well.

PR:		200311

document possible vulnerabilities in sysutils/py-salt

PR:		200172
Submitted by:	Sevan Janiyan <venture37@geeklan.co.uk>

Add entry for mail/davmail.

PR:		198297
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
Approved by:	<john.c.prather@gmail.com> (maintainer (timeout))

Document dnsmasq and -devel vulnerabilities (CVE-2015-3294 and one other in rc).

Document PCRE and PHP multiple vulnerabilities.

Correct PR number.

Submitted by:	jason.unovitch gmail.com

Record some minor PostgreSQL sercurity problems.

"This update fixes three security vulnerabilities reported in PostgreSQL over
the past few months. Nether of these issues is seen as particularly urgent.
However, users should examine them in case their installations are vulnerable."

URL:	http://www.postgresql.org/about/news/1587/

Pass full path to the vuln.xml file to extra-validation.py.  Without this,
if .OBJDIR differs from .CURDIR, the validation would fail.

PR:		193923
Reported by:	jbeich

Document CVE-2015-3306 proftpd mod_copy unauthenticated copying of files
vulnerability.