| Commit History - (may be incomplete: see SVNWeb link above for full details) |
| Date | By | Description |
23 Nov 2010 19:02:12
  1.1_1
|
thierry  |
Add an entry for www/horde-base VCARD attachments XSS vulnerability.
Security: VuXML: a3314314-f731-11df-a757-0011098ad87f |
23 Nov 2010 17:42:24
1.1_1
|
simon |
Fix discovery date in last entry.
Pointy hat to: remko |
23 Nov 2010 16:38:51
1.1_1
|
remko |
Add proftpd remote root vulnerability.
Based on: Vladimir Nikolic <vladimir dot nikolic at amis dot net>
Feature proof: yes
With hat: secteam |
17 Nov 2010 11:09:34
1.1_1
|
dinoex |
- add security/openssl CVE-2010-3864 |
06 Nov 2010 17:55:52
1.1_1
|
nox |
- Update to 10.1r102 resp. 9.0r289.
- Drop MD5 hashes from distinfos
Security:
http://www.freebsd.org/ports/portaudit/76b597e4-e9c6-11df-9e10-001b2134ef46.html
Reported by: Matthias Apitz on -emulation |
06 Nov 2010 04:08:59
1.1_1
|
delphij |
Add wireshark CVE-2010-3445.
PR: ports/151891
Submitted by: Eygene Ryabinkin |
04 Nov 2010 01:50:23
1.1_1
|
sunpoet |
- Limit affected version of dovecot to 1.2.* before 1.2.8
(vid: 30211c45-e52a-11de-b5cd-00e0815b8da8)
Reported by: Adam McDougall <mcdouga9@egr.msu.edu>
Reference:
http://www.dovecot.org/list/dovecot-news/2009-November/000143.html |
03 Nov 2010 20:29:56
1.1_1
|
wxs |
Document mailman XSS.
PR: ports/151918
Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru> |
03 Nov 2010 15:45:50
1.1_1
|
skv |
Document "otrs" - multiple XSS and denial of service vulnerabilities. |
28 Oct 2010 09:17:23
1.1_1
|
beat |
- Document mozilla -- Heap buffer overflow mixing document.write and DOM
insertion |
26 Oct 2010 16:46:27
1.1_1
|
dinoex |
- www/opera
PR: 151471
Submitted by: Arjan van Leeuwen |
25 Oct 2010 16:03:49
1.1_1
|
sunpoet |
- Add bzip2 integer overflow vulnerability
Approved by: pgollucci (mentor, implicit) |
25 Oct 2010 14:58:41
1.1_1
|
wxs |
Add the missing FreeBSD SA entries. We used to add these but stopped a while
back. This should catch us up.
According to cperciva@ the reason we stopped was that it was causing a lot of
false positives. I ran portaudit with these changes and did not see any false
positives but if it turns out to be too noisy I will remove them.
Submitted by: Christopher J. Umina (private mail)
Approved by: cperciva@ |
24 Oct 2010 17:08:03
1.1_1
|
rene |
Add monotone denial of service.
Security: http://www.monotone.ca/NEWS |
20 Oct 2010 21:13:40
1.1_1
|
pgollucci |
- Add devel/apr0 to list of packages that is affect. |
20 Oct 2010 15:12:52
1.1_1
|
beat |
- Document mozilla -- multiple vulnerabilities |
20 Oct 2010 12:42:51
1.1_1
|
kwm |
Add multiple vulnabilities in webkit-gtk2. |
06 Oct 2010 05:44:01
1.1_1
|
pgollucci |
- set modified date |
06 Oct 2010 05:41:27
1.1_1
|
pgollucci |
- these 2 urls are covered by the <cvename/> tags
Suggested by: stas |
06 Oct 2010 05:36:56
1.1_1
|
pgollucci |
- Fix a minor typo
Reported by: stas |
06 Oct 2010 05:29:50
1.1_1
|
pgollucci |
Document devel/apr1's apr-util vunerabilities
Security: http://secunia.com/advisories/41701
Reviewed by: secteam (cperciva) via irc |
02 Oct 2010 11:16:58
1.1_1
|
niels |
Documented phpMyFaq XSS vulnerability
PR: ports/151055
Submitted by: Florian Smeets <flo@smeets.im>
Approved by: itetcu (mentor, implicit)
Security: http://www.phpmyfaq.de/advisory_2010-09-28.php |
28 Sep 2010 18:04:46
1.1_1
|
thierry |
Report an XSS vulnerability in ftp/horde-gollem. |
28 Sep 2010 17:48:19
1.1_1
|
thierry |
Report a XSS vulnerability in mail/horde-dimp. |
28 Sep 2010 17:30:10
1.1_1
|
thierry |
Report a XSS vulnerability in mail/horde-imp. |
28 Sep 2010 17:09:35
1.1_1
|
thierry |
Report 2 vulnerabilities in www/horde-base. |
26 Sep 2010 13:32:10
1.1_1
|
niels |
Documented remote code execution vulnerability in OpenX
PR: ports/150610
Approved by: itetcu (mentor, implicit)
Security: ttp://blog.openx.org/09/security-update/ |
24 Sep 2010 20:24:37
1.1_1
|
niels |
Documented squid denial of service vulnerability
PR: ports/150364
Submitted by: Thomas-Martin Seck <tmseck@web.de>
Approved by: itetcu (mentor, implicit)
Security: CVE-2010-3072
Security: http://www.squid-cache.org/Advisories/SQUID-2010_3.txt |
22 Sep 2010 17:45:56
1.1_1
|
nox |
Update to 10.1r85 resp. 9.0r283 [1].
Security:
http://www.freebsd.org/ports/portaudit/8a34d9e6-c662-11df-b2e1-001b2134ef46.html
PR: ports/150832 [2]
Submitted by: pointyhat via pav [1], Tsurutani Naoki
<turutani@scphys.kyoto-u.ac.jp> [2] |
17 Sep 2010 20:07:07
1.1_1
|
delphij |
Correct discovery date, my bad :( |
17 Sep 2010 19:31:59
1.1_1
|
delphij |
Document django XSS vulnerability. |
15 Sep 2010 15:37:24
1.1_1
|
decke |
- Add libxul as affected package to the latest mozilla entry
Approved by: beat (co-mentor) |
10 Sep 2010 13:41:57
1.1_1
|
jadawin |
- Fix CVE name for webkit-gtk2 |
10 Sep 2010 13:03:20
1.1_1
|
kwm |
Document webkit-gtk2 - multiple vulnerabilities.
Also add 1 extra CVE to the previous webkit-gtk2 entry that was fixed but
didn't make it to the release notes. |
09 Sep 2010 03:13:09
1.1_1
|
shaun |
Belatedly (and perhaps pointlessly) document [1]:
vim6 -- heap-based overflow while parsing shell metacharacters
While here, prepare this old port for termination with DEPRECATED.
PR: ports/129300 [1]
Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru> [1] |
08 Sep 2010 06:51:06
1.1_1
|
beat |
- Document mozilla -- multiple vulnerabilities |
07 Sep 2010 18:11:49
1.1_1
|
wxs |
Document sudo Runas group vulnerability. |
04 Sep 2010 16:20:33
1.1_1
|
bapt |
- wget 1.12_1 is also concerned |
03 Sep 2010 13:57:14
1.1_1
|
bapt |
- Add wget entry CVE-2010-2252
- Add lftp entry CVE-2010-2251 |
31 Aug 2010 14:53:00
1.1_1
|
jadawin |
- Document p5-libwww vulnerability (remote servers can create .(dot) files) |
25 Aug 2010 07:49:08
1.1_1
|
niels |
Documented quagga vulnerabilities (stack overflow, DoS)
Approved by: itetcu (mentor,implicit)
Security: http://www.openwall.com/lists/oss-security/2010/08/24/3
Security: http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100 |
24 Aug 2010 16:26:54
1.1_1
|
skv |
Document "bugzilla" - information disclosure, denial of service. |
23 Aug 2010 07:12:57
1.1_1
|
lwhsu |
- Fix version range of phpMyAdmin
Submitted by: Marko Njezic <mr.max AT maxempire.com> |
22 Aug 2010 17:19:50
1.1_1
|
danfe |
Adjust the version range in previous entry: 1.0.1 is also vulnerable, and
fix minor whitespace nit while here. |
22 Aug 2010 12:30:07
1.1_1
|
kwm |
Add entry for OpenTTD denial of server vulnability.
Reviewed by: danfe@ (OpenTTD maintainer) |
21 Aug 2010 21:30:32
1.1_1
|
niels |
- Added corkscrew: overflow condition due to insecure sscanf usage
- Fixed SLiM title: /SLiM/slim/
Approved by: itetcu (mentor, implicit)
Security: http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt |
21 Aug 2010 12:42:18
1.1_1
|
lwhsu |
- Add phpMyAdmin's CVE-2010-3056 entry |
20 Aug 2010 23:34:13
1.1_1
|
stas |
- Fix date of the latest ruby entry. |
20 Aug 2010 21:00:34
1.1_1
|
niels |
Added CVE to SLiM vulnerability
Approved by: itetcu (mentor, implicit)
Security: CVE-2010-2945 |
19 Aug 2010 21:11:53
1.1_1
|
niels |
- Document SLiM insecure PATH assignment issue
- Removed space from vlc title
Approved by: itetcu (implicit, mentor)
Security: http://seclists.org/oss-sec/2010/q3/198 |
18 Aug 2010 06:36:26
1.1_1
|
stas |
- Document recent WEBrick XSS vulnerability in ruby. |
17 Aug 2010 12:50:38
1.1_1
|
bapt |
- Add security/isolate entry
PR: ports/148911
Submitted by: Steve Wills <steve _at_ mouf.net> (maintainer)
Approved by: tabthorpe (mentor) |
15 Aug 2010 17:10:53
1.1_1
|
shaun |
Fix krb5 entry (86b8b655-4d1a-11df-83fb-0015587e2cc1) version range
mark-up.
Submitted by: Peggy Wilkins via freebsd-ports |
14 Aug 2010 22:43:51
1.1_1
|
gabor |
- Fix last entry by adding the forgotten package name.
(Hint: always run make validate before committing to this file)
Forgotten by: jsa, kwm |
14 Aug 2010 20:51:52
1.1_1
|
jsa |
Document VLC CVE-2010-2937.
Approved by: kwm (mentor) |
13 Aug 2010 20:15:54
1.1_1
|
nox |
Update to 10.1r82 resp. 9.0r280.
Security:
http://www.freebsd.org/ports/portaudit/e19e74a4-a712-11df-b234-001b2134ef46.html |
13 Aug 2010 15:23:18
1.1_1
|
shaun |
Document opera -- multiple vulnerabilities. |
09 Aug 2010 09:10:12
1.1_1
|
beat |
- Belatedly document firefox -- Dangling pointer crash regression from plugin
parameter array fix
Approved by: miwi |
04 Aug 2010 14:47:39
1.1_1
|
wxs |
Whitespace fixes. |
04 Aug 2010 09:32:27
1.1_1
|
lwhsu |
- Fix Piwik entry's <name> tag
Pointed out by: jadawin |
04 Aug 2010 09:18:12
1.1_1
|
lwhsu |
- Add Piwik CVE-2010-2786 entry |
31 Jul 2010 12:00:24
1.1_1
|
kuriyama |
Previous vuln affects only apache-2.2.x |
29 Jul 2010 23:03:53
1.1_1
|
gabor |
- Document libmspack and cabextract vulnerability |
26 Jul 2010 01:42:21
1.1_1
|
kuriyama |
Add entry for apache. |
23 Jul 2010 00:37:11
1.1_1
|
wxs |
Document buffer overflow when parsing gitdir.
While here, tidy up a whitespace problem. |
21 Jul 2010 22:25:34
1.1_1
|
glarkin |
- Document www/codeigniter file upload class vulnerability
Approved by: secteam (timeout - 1 week)
Security: http://codeigniter.com/news/codeigniter_1.7.2_security_patch/ |
21 Jul 2010 12:46:17
1.1_1
|
beat |
- Document mozilla -- multiple vulnerabilities
Approved by: remko |
19 Jul 2010 00:07:23
1.1_1
|
kwm |
Add vte as package name, instead of empty. |
18 Jul 2010 23:28:32
1.1_1
|
kwm |
Document vte title set+query attack vulnerability.
While here add the CVE numbers to the webkit-gtk2 entry I forgot in the
previous commit.
PR: ports/148678
Submitted by: Janne Snabb <snabb@epipe.com> |
18 Jul 2010 22:44:05
1.1_1
|
kwm |
Document webkit-gtk2 vulnerabilities.
Security: http://blog.kov.eti.br/?p=116 |
10 Jul 2010 08:34:16
1.1_1
|
decke |
- Document redmine vulnerabilities
Approved by: miwi (secteam)
Security: http://www.redmine.org/news/41 |
07 Jul 2010 09:13:02
1.1_1
|
nemoliu |
- Update to 3.1.1
- VuXML entry for PNG decoder security vulnerability
- License information
PR: ports/147871
Approved by: Pavel Pankov <pankov_p@mail.ru> (maintainer)
Feature safe: yes |
06 Jul 2010 21:39:10
1.1_1
|
delphij |
Add bogofilter heap underrun on malformed base64 input.
Submitted by: mandree
PR: ports/148408
Feature safe: yes |
06 Jul 2010 04:38:12
1.1_1
|
miwi |
- Cleanup a bit
Feature safe: yes |
05 Jul 2010 15:41:27
1.1_1
|
skv |
Document "bugzilla" - information disclosure.
Feature safe: yes |
30 Jun 2010 21:00:07
1.1_1
|
makc |
Document multiple vulnerabilities in irc/kvirc*
Approved by: remko@
Feature safe: yes |
28 Jun 2010 17:38:13
1.1_1
|
delphij |
Add bid reference for libpng entry.
Feature safe: yes |
28 Jun 2010 16:18:53
1.1_1
|
dinoex |
- graphics/png CVE-2010-1205
Feature safe: yes |
28 Jun 2010 00:46:12
1.1_1
|
wen |
- Document moodle -- multiple vulnerabilities
Reviewed by: delphij@, miwi@
Feature safe: yes |
27 Jun 2010 21:14:28
1.1_1
|
rene |
Document mDNSResponder -- corrupted stack crash when parsing bad resolv.conf
This only happens on a system where one has a system where
resolv.conf is writable by an untrusted user or where mdnsd is setuid
and can be tricked into opening an alternate resolv.conf.
PR: ports/147007
Submitted by: jmallett@
Approved by: tabthorpe (mentor)
Feature safe: yes |
25 Jun 2010 23:29:50
1.1_1
|
shaun |
Document opera -- Data URIs can be used to allow cross-site scripting.
Assume opera-devel is vulnerable too, although snapshots aren't
mentioned in the advisory, and it's months out of date.
Feature safe: yes |
24 Jun 2010 12:54:49
1.1_1
|
niels |
- Cancelled movemail symlink vulnerability (doesnt affect our ports)
- Added entry for multiple vulnerabilities in cacti 0.8.7f
- Updated ziproxy entry to satisfy "make tidy"
Approved by: itetcu (mentor, implicit)
Feature safe: yes |
23 Jun 2010 18:01:10
1.1_1
|
beat |
- Document mozilla -- multiple vulnerabilities
Feature safe: yes
Approved by: delphij |
18 Jun 2010 00:38:36
1.1_1
|
delphij |
vuln 4e8344a3-ca52-11de-8ee8-00215c6a37bb has been fixed with
php4-gd-4.4.9_4.
Requested by: Michael Gmelin <mg bindone de> |
16 Jun 2010 12:42:09
1.1_1
|
erwin |
Fix typo in previous revision. |
16 Jun 2010 12:13:30
1.1_1
|
miwi |
- Cleanup, Formating |
16 Jun 2010 09:31:35
1.1_1
|
dinoex |
add CVE-2009-2347 tiff |
15 Jun 2010 19:46:47
1.1_1
|
nox |
Document linux-flashplugin -- multiple vulnerabilities.
Reviewed by: tmclaugh |
14 Jun 2010 03:04:22
1.1_1
|
miwi |
- Cleanup / Whitespace fixes |
12 Jun 2010 17:22:38
1.1_1
|
erwin |
Remove empty package in previous revision. |
12 Jun 2010 16:44:34
1.1_1
|
dinoex |
- report FAX3 decoder buffer overrun |
03 Jun 2010 00:10:57
1.1_1
|
wxs |
Document sudo secure path vulnerability. We are not vulnerable to this by
default but a user could build sudo with SUDO_SECURE_PATH defined or turn
it on in sudoers. |
02 Jun 2010 11:24:45
1.1_1
|
pav |
- Update to 3.0.1
PR: ports/147195
Submitted by: Pavel Pankov <pankov_p@mail.ru> (maintainer) |
02 Jun 2010 06:20:29
1.1_1
|
wen |
- Document two mediawiki security vulnerabilities
Approved by: delphij@(ports-security override) |
14 May 2010 18:28:43
1.1_1
|
decke |
- Document multiple redmine vulnerabilities
Approved by: miwi (secteam), beat (co-mentor)
Security: http://www.redmine.org/news/39 |
13 May 2010 09:12:02
1.1_1
|
niels |
Updated tomcat entry (CVE-2010-1157) with fixed version information.
This makes sure that the correct older versions are marked vulnerable
Approved by: itetcu (mentor, implicit)
Security:
http://www.vuxml.org/freebsd/3383e706-4fc3-11df-83fb-0015587e2cc1.html |
12 May 2010 09:46:13
1.1_1
|
niels |
- Added 109 missing CVE names to 60 VuXML entries
- Fixed Tomcat55 entry to mark current PORTREVISION vulnerable
PR: ports/146418
Approved by: itetcu (mentor, implicit)
Security: http://people.freebsd.org/~niels/vuxml/ |
07 May 2010 19:53:26
1.1_1
|
niels |
Added wireshark (DoS) and piwik (XSS) issues
Approved by: itetcu (mentor, implicit)
Security: http://www.wireshark.org/security/wnpa-sec-2010-03.html
Security: http://www.wireshark.org/security/wnpa-sec-2010-04.html
Security: http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/ |
06 May 2010 19:44:56
1.1_1
|
niels |
Added spamass-milter remote command execution vulnerability
Approved by: itetcu (mentor, implicit)
Security: CVE-2010-1132
Security:
http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html |
05 May 2010 19:12:37
1.1_1
|
niels |
- Added mediawiki and lxr vulnerabilities
- Fixed vlc topic format (lower case, portname first)
PR: ports/146337
Approved by: itetcu (mentor, implicit)
Security:
http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
Security:
http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com |
If you buy from Amazon USA, please support us by using this link.