vuxml Vulnerability and eXposure Markup Language DTD
1.1_3 security =31

Maintainer: ports-secteam@FreeBSD.org
Port Added: 12 Feb 2004 14:24:23
Also Listed In: textproc
License: BSD2CLAUSE

VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.

SVNWeb : PortsMon

Pseudo-pkg-plist information, but much better, from make generate-plist
Expand this list (10 items)

1. /usr/local/share/licenses/vuxml-1.1_3/catalog.mk
2. /usr/local/share/licenses/vuxml-1.1_3/LICENSE
3. /usr/local/share/licenses/vuxml-1.1_3/BSD2CLAUSE
4. @xmlcatmgr share/xml/dtd/vuxml/catalog
5. @xmlcatmgr share/xml/dtd/vuxml/catalog.xml
6. share/xml/dtd/vuxml/vuxml-10.dtd
7. share/xml/dtd/vuxml/vuxml-11.dtd
8. share/xml/dtd/vuxml/vuxml-model-10.mod
9. share/xml/dtd/vuxml/vuxml-model-11.mod
10. share/xml/dtd/vuxml/xml1.dcl
Collapse this list.

---

To install the port: cd /usr/ports/security/vuxml/ && make install clean
To add the package: pkg install vuxml

PKGNAME: vuxml

distinfo:

SHA256 (vuxml/vuxml-10.dtd) = 6a635ad2cf45f52361c8c2a29a689157fad4d00519045485bc822d34e04a524e
SIZE (vuxml/vuxml-10.dtd) = 2986
SHA256 (vuxml/vuxml-model-10.mod) = 051fed00b52bedde8ee901003fc29f7b95cd904157e31ceef34e6b06f2d1a14a
SIZE (vuxml/vuxml-model-10.mod) = 10599
SHA256 (vuxml/vuxml-11.dtd) = 12b50061d7bb34cecffede2e08d439e4469324376d55aeb7c73eb6aab0f36af1
SIZE (vuxml/vuxml-11.dtd) = 3063
SHA256 (vuxml/vuxml-model-11.mod) = a40777208625a3029c6f416aeeea733f614802a6a5f26035a4e445a09e61a47c
SIZE (vuxml/vuxml-model-11.mod) = 13282
SHA256 (vuxml/xml1.dcl) = 343efa94c4e1302e85e08b2d1791d86e50aac1ecdbc3161daecac100e4726847
SIZE (vuxml/xml1.dcl) = 7372
SHA256 (vuxml/catalog) = 479a69cf02995603443fd1f3b5b33f97811670931f87f53be99a727d664abc66
SIZE (vuxml/catalog) = 549
SHA256 (vuxml/catalog.xml) = 7b2e2850f57264eeba0ccd3d1fc161b9d5ce3071ae0ec51b9da7fa956f2a6509
SIZE (vuxml/catalog.xml) = 2150

---

NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.

Runtime dependencies:

1. xmlcatmgr : textproc/xmlcatmgr
2. xsltproc : textproc/libxslt
3. VERSION : textproc/xhtml-modularization
4. xhtml-basic10.dtd : textproc/xhtml-basic
5. python2.7 : lang/python27

There are no ports dependent upon this port

---

Configuration Options

     No options to configure

---

USES:

python:run

---

Master Sites:

1. http://www.vuxml.org/dtd/vuxml-1/

security/vuxml: update to 1.1_3

Document FreeBSD-SA-18:14.bhyve

Document FreeBSD-SA-18:13.nfs

security/vuxml: document Node.js vulnerabilities from November 2018

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

Sponsored by:	Miles AS

Document powerdns-recursor issue

PR:		233603
Submitted by:	Ralf van der Enden <tremere@cainites.net>

Correct entry date on previous entry

Pointyhat to:	swills

Document security/py-asyncssh issue

Document security vulnerability for gitlab-ce < 11.5.3.

Approved by:	mentors (implicit)

Document the latest Flash Player vulnerabilities.

https://helpx.adobe.com/security/products/flash-player/apsb18-42.html

Document Jenkins Security Advisory 2018-12-05

Sponsored by:	The FreeBSD Foundation

- Document moodle login CSRF vulnerability

Document Rails vulnerability

Document multiple vulnerabilities in net/uniparser

Reported by:	sebastian@pipping.org via e-mail

Add info about security vulnerability in messagelib.

security/vuxml: document www/payara vulnerabilities

PR:		233573
Submitted by:	Dmytro Bilokha <dmytro@posteo.net>

Document gitlab security vulnerabilities.

Approved by:	mentors (implicit)

Add an entry about new vulnerabilities in the Samba packages.

Security:	CVE-2018-14629
		CVE-2018-16841
		CVE-2018-16851
		CVE-2018-16852
		CVE-2018-16853
		CVE-2018-16857
Sponsored by:	my wife

Modified entry and add phpmailer

PR:		233420 233416
Sponsored by:	Netzkommune GmbH

Modified entry and add php70-imap

Sponsored by:	Netzkommune GmbH

Add VuXML entry for php-imap vulnerability.

Add entry for mail/phpmailer6

Sponsored by:	Netzkommune GmbH

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-44.html

Document vulnerabilities for gitlab-ce.

Approved by:	mentors (implicit)

Add entry for dns/powerdns

PR:		233139
Submitted by:	maintainer

Add entry for dns/powerdns-recursor40

PR:		233141
Sponsored by:	Netzkommune GmbH

Add entry for dns/powerdns-recursor

PR:		233140
Sponsored by:	Netzkommune GmbH

Document recent asterisk vulneraability.

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-39.html

security/vuxml: Document openssl vulnerability

security/vuxml: Add entry for devel/kio-extras <= 18.08.3_1

  https://www.kde.org/info/security/advisory-20181012-1.txt

Security:	CVE-2018-19120

Update openjpeg status

security/vuxml: list CVE numbers forgotten in r484705

security/vuxml: mark patch < 2.7.7 as vulnerable

Another copypasta because pkg-audit(8) doesn't grok CPE e.g.,
https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe:2.3:a:gnu:patch:2.7.6

security/vuxml: Update latest openssl entry

 - LibreSSL prior to 2.8 not vulnerable
 - LibreSSL likely not vulnerable to CVE-2018-0735

PR:		233109
Submitted by:	Franco Fichtner <franco opnsense org>

- lighttpd - use-after-free vulnerabilities
PR:		232278

Add info about security vulnerability in PostgreSQL

Security:	CVE-2018-16850

security/vuxml: Mark MariaDB 10.3.10 vulnerable

 - From MariaDB release notes (not released yet)

See: https://mariadb.com/kb/en/library/mariadb-10311-release-notes/

PR:		233068

Add modified entrey for drupal after changes in r484148

Sponsored by:	Netzkommune GmbH

Add entry for nginx and nginx-devel

Sponsored by:	Netzkommune GmbH

- Add www/drupal8 entry

Document gitea vulnerability

PR:		232897
Submitted by:	stb@lassitu.de (maintainer)

Document curl vulnerability

Document gilab-ce vulnerability.

Approved by:	mentors (implicit)

Document rubygem-loofah vulnerability

security/vuxml: Update latest OpenSSL entry

 - As per a LibreSSL dev, also vulnerable

Documented several security issues with www/gitlab-ce.

Approved by:	mentors (implicit)

security/vuxml: Document OpenSSL 1.1.x vulnerabilities

Document potential remote code execution in net/liveMedia (CVE-2018-4013)

Mark mini_httpd < 1.30 as vulnerable as per:

    http://acme.com/updates/archive/211.html

The issue is arbitrary file disclosure in some circumstances.

Reviewed by:	matthew (mentor)
Approved by:	matthew (mentor)
Differential Revision:	https://reviews.freebsd.org/D17718

Add entry for sysutils/py-salt

PR:		232663
Reported by:	Christer Edwards <christer.edwards@gmail.com>
Security:	https://www.vuxml.org/freebsd/4f7c6af3-6a2c-4ead-8453-04e509688d45.html

security/vuxml: mark firefox < 63 as vulnerable

Add entry for www/drupal7

Sponsored by:	Netzkommune GmbH

Document ruby vulnerability

PR:		232427 (based on)
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>

security/vuxml: Document 2018-10 MySQL vulnerabilities

Add entry for www/matomo

Sponsored by:	Netzkommune GmbH

Document libssh vulnerability

PR:		232344
Security:	CVE-2018-10933

Document security vulnerability with devel/libgit2 < 0.27.5.

Approved by:	mentors (implicit)

Add an entry for a memory leak bug in net-im/tox < v0.2.8.

Add entry for www/gitea

PR:		232123
Reported by:	maintainer
Sponsored by:	Netzkommune GmbH

Document Jenkins Security Advisory 2018-10-10

Sponsored by:	The FreeBSD Foundation

- add entry for tinc and tinc-devel

Document several vulnerabilities for gitlab-ce.

Approved by:	mentors (implicit)

security/vuxml: add multiple vulnerabilities in security/clamav.

PR:		231924
Submitted by:	yasu@utahime.org

- Document django21 vulnerability

security/vuxml: mark firefox < 62.0.3 as vulnerable

Document several vulnerabilities for gitlab-ce.

Approved by:	mentors (implicit)

Document pango DoS

Add entry for www/serendipity

Sponsored by:	Netzkommune GmbH

security/vuxml: Add entry for net-p2p/bitcoin CVE-2018-17144

Add VuXML for r480928

Approved by:	timur (mentor)
Differential Revision:	https://reviews.freebsd.org/D17360

Document spamassassin - multiple vulnerabilities

Document spamassassin vulnerabilities, as found in this announcement:
https://seclists.org/oss-sec/2018/q3/242

security/vuxml:

Document wesnoth vulnerability

security/vuxml: Add Apache 2.4 vulnerability

Update OpenJPEG vulnerability

CVE-2018-5785 was fixed in r480624.

Document mantis vulnerability

Document rubygem-smart_proxy_dynflow vulnerability

- Document mediawiki's multiple vulnerabilities

security/vuxml: mark firefox < 62.0.2 as vulnerable

Document new asterisk vulnerability.

- Document moodle multiple vulnerabilities

security/vuxml: add Joomla3 Vulnerabilities

security/vuxml: mark waterfox < 56.2.3 as vulnerable

Update OpenJPEG vulnerability

Only CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.

Notified by:	tijl

Document vulnerability in www/mybb

Sponsored by:	Netzkommune GmbH

Document FreeBSD-SA-18:12.elf

Add VuXML vulnerability CVE-2018-15598 for traefik.

Port update is already MFHed.

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-31.html

Improve formatting
Also add plexmediaserver-plexpass package as vulnerable

Document Plex vulnerability

Security:	CVE-2018-13415

The 0.18 release of x11/sddm contains a fix for a security error
that allows unlocking a session without a password, if the
ReuseSession configuration option is set to true. The default
configuration sets it to false.

I'm setting the version to < 0.17.0_1 here, because I'm going
to update 0.17 with backports rather than pull in 0.18 (there's
a lot more work in that update, because of reorganisation upstream
and none of our patches apply anymore).

PR:		230029
Reported by:	doctorwhoguy@gmail.com

Document vulnerability in www/mybb

Sponsored by:	Netzkommune GmbH

Document gitea vulnerability.

PR:		231180
Submitted by:	stb@lassitu.de
Security:	7c750960-b129-11e8-9fcd-080027f43a02

Remove duplicate entry for WPA EAPOL vulnerability. Use r477829 instead
as its version range is more complete.

PR:		231054
Reported by:	000.fbsd@quip.cz

Add VuXML entry for the fixed CVE-2017-11114 in www/links

PR:		230849
Submitted by:	Dmitri Goutnik <dg@syrec.org>

Document curl vulnerability

security/vuxml: mark firefox < 62 as vulnerable

Document Ghostscript -dSAFER sandbox bypass vulnerabilities.

PR:		231148
Security:	https://www.kb.cert.org/vuls/id/332928

Document grafana issues

PR:		 231019
PR:		 231020
PR:		 231021
PR:		 231022

Document several vulnerabilities for gitlab-ce.

Approved by:	mentors (implicit)

- Fix range for ja-mailman in CVE-2018-13796

Mark bro < 2.5.5 as vulnerable as per:

    https://www.bro.org/download/NEWS.bro.html

Reviewed by:	ler (mentor)
Approved by:	ler (mentor)
Differential Revision:	https://reviews.freebsd.org/D16948

12 vulnerabilities affecting 152 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities

Last updated:
2018-12-11 17:51:06