- Fix a minor typo

Reported by:    stas

Document devel/apr1's apr-util vunerabilities

Security:       http://secunia.com/advisories/41701
Reviewed by:    secteam (cperciva) via irc

Documented phpMyFaq XSS vulnerability

PR:             ports/151055
Submitted by:   Florian Smeets <flo@smeets.im>
Approved by:    itetcu (mentor, implicit)
Security:       http://www.phpmyfaq.de/advisory_2010-09-28.php

Report an XSS vulnerability in ftp/horde-gollem.

Report a XSS vulnerability in mail/horde-dimp.

Report a XSS vulnerability in mail/horde-imp.

Report 2 vulnerabilities in www/horde-base.

Documented remote code execution vulnerability in OpenX

PR:             ports/150610
Approved by:    itetcu (mentor, implicit)
Security:       ttp://blog.openx.org/09/security-update/

Documented squid denial of service vulnerability

PR:             ports/150364
Submitted by:   Thomas-Martin Seck <tmseck@web.de>
Approved by:    itetcu (mentor, implicit)
Security:       CVE-2010-3072
Security:       http://www.squid-cache.org/Advisories/SQUID-2010_3.txt

Update to 10.1r85 resp. 9.0r283 [1].

Security:      
http://www.freebsd.org/ports/portaudit/8a34d9e6-c662-11df-b2e1-001b2134ef46.html
PR:             ports/150832 [2]
Submitted by:   pointyhat via pav [1], Tsurutani Naoki
                <turutani@scphys.kyoto-u.ac.jp> [2]

Correct discovery date, my bad :(

Document django XSS vulnerability.

- Add libxul as affected package to the latest mozilla entry

Approved by:    beat (co-mentor)

- Fix CVE name for webkit-gtk2

Document webkit-gtk2 - multiple vulnerabilities.

Also add 1 extra CVE to the previous webkit-gtk2 entry that was fixed but
didn't make it to the release notes.

Belatedly (and perhaps pointlessly) document [1]:

  vim6 -- heap-based overflow while parsing shell metacharacters

While here, prepare this old port for termination with DEPRECATED.

PR:             ports/129300 [1]
Submitted by:   Eygene Ryabinkin <rea-fbsd@codelabs.ru> [1]

- Document mozilla -- multiple vulnerabilities

Document sudo Runas group vulnerability.

- wget 1.12_1 is also concerned

- Add wget entry CVE-2010-2252
- Add lftp entry CVE-2010-2251

 - Document p5-libwww vulnerability (remote servers can create .(dot) files)

Documented quagga vulnerabilities (stack overflow, DoS)

Approved by:    itetcu (mentor,implicit)
Security:       http://www.openwall.com/lists/oss-security/2010/08/24/3
Security:       http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100

Document "bugzilla" - information disclosure, denial of service.

- Fix version range of phpMyAdmin

Submitted by:   Marko Njezic <mr.max AT maxempire.com>

Adjust the version range in previous entry: 1.0.1 is also vulnerable, and
fix minor whitespace nit while here.

Add entry for OpenTTD denial of server vulnability.

Reviewed by:    danfe@ (OpenTTD maintainer)

- Added corkscrew: overflow condition due to insecure sscanf usage
- Fixed SLiM title: /SLiM/slim/

Approved by:    itetcu (mentor, implicit)
Security:       http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt

- Add phpMyAdmin's CVE-2010-3056 entry

- Fix date of the latest ruby entry.

Added CVE to SLiM vulnerability

Approved by:    itetcu (mentor, implicit)
Security:       CVE-2010-2945

- Document SLiM insecure PATH assignment issue
- Removed space from vlc title

Approved by:    itetcu (implicit, mentor)
Security:       http://seclists.org/oss-sec/2010/q3/198

- Document recent WEBrick XSS vulnerability in ruby.

- Add security/isolate entry

PR:             ports/148911
Submitted by:   Steve Wills <steve _at_ mouf.net> (maintainer)
Approved by:    tabthorpe (mentor)

Fix krb5 entry (86b8b655-4d1a-11df-83fb-0015587e2cc1) version range
mark-up.

Submitted by:   Peggy Wilkins via freebsd-ports

- Fix last entry by adding the forgotten package name.
  (Hint: always run make validate before committing to this file)

Forgotten by:   jsa, kwm

Document VLC CVE-2010-2937.

Approved by:    kwm (mentor)

Update to 10.1r82 resp. 9.0r280.

Security:      
http://www.freebsd.org/ports/portaudit/e19e74a4-a712-11df-b234-001b2134ef46.html

Document opera -- multiple vulnerabilities.

- Belatedly document firefox -- Dangling pointer crash regression from plugin
  parameter array fix

Approved by:    miwi

Whitespace fixes.

- Fix Piwik entry's <name> tag

Pointed out by: jadawin

- Add Piwik CVE-2010-2786 entry

Previous vuln affects only apache-2.2.x

- Document libmspack and cabextract vulnerability

Add entry for apache.

Document buffer overflow when parsing gitdir.
While here, tidy up a whitespace problem.

- Document www/codeigniter file upload class vulnerability

Approved by:    secteam (timeout - 1 week)
Security:       http://codeigniter.com/news/codeigniter_1.7.2_security_patch/

- Document mozilla -- multiple vulnerabilities

Approved by:    remko

Add vte as package name, instead of empty.

Document vte title set+query attack vulnerability.

While here add the CVE numbers to the webkit-gtk2 entry I forgot in the
previous commit.

PR:             ports/148678
Submitted by:   Janne Snabb <snabb@epipe.com>

Document webkit-gtk2 vulnerabilities.

Security:       http://blog.kov.eti.br/?p=116

- Document redmine vulnerabilities

Approved by:    miwi (secteam)
Security:       http://www.redmine.org/news/41

- Update to 3.1.1
- VuXML entry for PNG decoder security vulnerability
- License information

PR:     ports/147871
Approved by:    Pavel Pankov <pankov_p@mail.ru> (maintainer)
Feature safe:   yes

Add bogofilter heap underrun on malformed base64 input.

Submitted by:   mandree
PR:             ports/148408
Feature safe:   yes

- Cleanup a bit

Feature safe:   yes

Document "bugzilla" - information disclosure.

Feature safe:   yes

Document multiple vulnerabilities in irc/kvirc*

Approved by:    remko@
Feature safe:   yes

Add bid reference for libpng entry.

Feature safe:   yes

- graphics/png CVE-2010-1205
Feature safe:   yes

- Document moodle -- multiple vulnerabilities

Reviewed by:    delphij@, miwi@
Feature safe:   yes

Document mDNSResponder -- corrupted stack crash when parsing bad resolv.conf

This only happens on a system where one has a system where
resolv.conf is writable by an untrusted user or where mdnsd is setuid
and can be tricked into opening an alternate resolv.conf.
PR:             ports/147007
Submitted by:   jmallett@
Approved by:    tabthorpe (mentor)
Feature safe:   yes

Document opera -- Data URIs can be used to allow cross-site scripting.

Assume opera-devel is vulnerable too, although snapshots aren't
mentioned in the advisory, and it's months out of date.

Feature safe:   yes

- Cancelled movemail symlink vulnerability (doesnt affect our ports)
- Added entry for multiple vulnerabilities in cacti 0.8.7f
- Updated ziproxy entry to satisfy "make tidy"

Approved by:    itetcu (mentor, implicit)
Feature safe:   yes

- Document mozilla -- multiple vulnerabilities

Feature safe:   yes
Approved by:    delphij

vuln 4e8344a3-ca52-11de-8ee8-00215c6a37bb has been fixed with
php4-gd-4.4.9_4.

Requested by:   Michael Gmelin <mg bindone de>

Fix typo in previous revision.

- Cleanup, Formating

add CVE-2009-2347 tiff

Document linux-flashplugin -- multiple vulnerabilities.

Reviewed by:    tmclaugh

- Cleanup / Whitespace fixes

Remove empty package in previous revision.

- report FAX3 decoder buffer overrun

Document sudo secure path vulnerability. We are not vulnerable to this by
default but a user could build sudo with SUDO_SECURE_PATH defined or turn
it on in sudoers.

- Update to 3.0.1

PR:             ports/147195
Submitted by:   Pavel Pankov <pankov_p@mail.ru> (maintainer)

- Document two mediawiki security vulnerabilities

Approved by:    delphij@(ports-security override)

- Document multiple redmine vulnerabilities

Approved by:    miwi (secteam), beat (co-mentor)
Security:       http://www.redmine.org/news/39

Updated tomcat entry (CVE-2010-1157) with fixed version information.
This makes sure that the correct older versions are marked vulnerable

Approved by:    itetcu (mentor, implicit)
Security:      
http://www.vuxml.org/freebsd/3383e706-4fc3-11df-83fb-0015587e2cc1.html

- Added 109 missing CVE names to 60 VuXML entries
- Fixed Tomcat55 entry to mark current PORTREVISION vulnerable

PR:             ports/146418
Approved by:    itetcu (mentor, implicit)
Security:       http://people.freebsd.org/~niels/vuxml/

Added wireshark (DoS) and piwik (XSS) issues

Approved by:    itetcu (mentor, implicit)
Security:       http://www.wireshark.org/security/wnpa-sec-2010-03.html
Security:       http://www.wireshark.org/security/wnpa-sec-2010-04.html
Security:       http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/

Added spamass-milter remote command execution vulnerability

Approved by:    itetcu (mentor, implicit)
Security:       CVE-2010-1132
Security:      
http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html

- Added mediawiki and lxr vulnerabilities
- Fixed vlc topic format (lower case, portname first)

PR:             ports/146337
Approved by:    itetcu (mentor, implicit)
Security:      
http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
Security:      
http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com

Added 38 missing CVE names to 24 VuXML entries
(256 CVE names to go)

Approved by:    itetcu (mentor, implicit)
Security:       http://people.freebsd.org/~niels/vuxml/

Added 34 missing CVE names to 24 VuXML entries
(294 CVE names to go)

Approved by:    miwi (secteam)
Security:       http://people.freebsd.org/~niels/vuxml/

- VideoLAN has released 1.0.6 to address serveral vulnerabilities they discoverd
while working towards the 1.1.0 release. These vulnerabilities could potentially
allow for a specially crafted file to execute code.

PR:             ports/146099
Submitted by:   Joseph S. Atkinson <jsa@wickedmachine.net> (maintainer)

- fix version for apache+mod_ssl

- fix info for apache+mod_ssl

Mark kdebase3 as safe now.

- Documented multiple Joomla! vulnerabilities
- Added new reference to the recent cacti issue

Approved by:    remko (secteam)
Security:       http://developer.joomla.org/security/

Documented vulnerabilities in moodle, tomcat55, tomcat66 and cacti

PR:             ports/146021
PR:             ports/146022
Approved by:    remko (secteam)
Security:       http://seclists.org/bugtraq/2010/Apr/200
Security:       http://docs.moodle.org/en/Moodle_1.9.8_release_notes
Security:       http://www.bonsai-sec.com/en/research/vulnerability.php

Documented emacs movemail vulnerability and marked the seperate
mail/movemail port vulnerable to an old format string vulnerability.

Approved by:    remko (secteam)
Security:       http://www.ubuntu.com/usn/USN-919-1

Added krb5 double free vulnerability

Approved by:    remko (secteam)
Security:       http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt
Security:       CVE-2010-1320

Documented the following vulnerabilities:
- png: libpng decompression denial of service
- e107: code execution and XSS vulnerabilities
- pidgin: multiple remote denial of service vulnerabilities
- fetchmail: denial of service vulnerability

PR:             ports/145885
PR:             ports/145857
Approved by:    remko (secteam)
Security:       CVE-2010-0996
Security:       CVE-2010-0997
Security:       CVE-2010-1167
Security:       CVE-2010-0277
Security:       CVE-2010-0420
Security:       CVE-2010-0423
Security:       CVE-2010-0205

Documented the following vulnerabilities:
- curl: libcurl buffer overflow vulnerability
- irssi: multiple vulnerabilities
- ejabberd: queue overload denial of service vulnerability

Approved by:    remko (secteam)
Security:       http://curl.haxx.se/docs/adv_20100209.html
Security:       http://support.process-one.net/browse/EJAB-1173
Security:       http://xforce.iss.net/xforce/xfdb/57790
Security:       http://xforce.iss.net/xforce/xfdb/57791

- Added three krb5 vulnerabilities
- Fixed indent on mahara entry
- Fixed title of KDM entry

Approved by:    remko (secteam)
Security:       http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt
Security:       http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt
Security:       http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt

Document mahara sql injection vulnerability

Approved by:    remko (secteam)
Security:       http://www.debian.org/security/2010/dsa-2030

Correct CVE entry. The advisory from Todd[0] says CVE 2010-0426, which is
the entry assigned to the original sudoedit vulnerability[1]. The new
one (CVE-2010-1163) was just assigned. I believe the one assigned by CVE
folks is the proper one to use.

[0]: http://sudo.ws/sudo/alerts/sudoedit_escalate2.html
[1]: 018a84d0-2548-11df-b4a3-00e0815b8da8

- Document sudo privilege escalation bug. This is similar to
  018a84d0-2548-11df-b4a3-00e0815b8da8.

- Do not match x11/kdebase4 in latest KDM vulnerability.

Approved by:    tabthorpe (mentor)

- Document KDM local privilege escalation vulnerability.

Approved by:    tabthorpe (mentor), delphij (secteam)

- Document dojo - cross-site scripting and other vulnerabilities
- Document ZendFramework - security issues in bundled Dojo library

Approved by:    secteam (remko)
Security:      
http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/
Security:       http://framework.zend.com/security/advisory/ZF2010-07