vuxml Vulnerability and eXposure Markup Language DTD

1.1_4 security =30 1.1Version of this port present on the latest quarterly branch.

Maintainer: ports-secteam@FreeBSD.org

Port Added: 2004-02-12 14:24:23

Last Update: 2020-05-25 19:04:40

SVN Revision: 536490

People watching this port, also watch: gnupg, libxml2, curl, nmap, postfix

Also Listed In: textproc

License: BSD2CLAUSE

Description:

VuXML (the Vulnerability and eXposure Markup Language) is an XML application for documenting security bugs and corrections within a software package collection such as the FreeBSD Ports Collection. This port installs the DTDs required for validating VuXML documents.

SVNWeb

pkg-plist: as obtained via: make generate-plist

Expand this list (10 items)

1. /usr/local/share/licenses/vuxml-1.1_4/catalog.mk
2. /usr/local/share/licenses/vuxml-1.1_4/LICENSE
3. /usr/local/share/licenses/vuxml-1.1_4/BSD2CLAUSE
4. @xmlcatmgr share/xml/dtd/vuxml/catalog
5. @xmlcatmgr share/xml/dtd/vuxml/catalog.xml
6. share/xml/dtd/vuxml/vuxml-10.dtd
7. share/xml/dtd/vuxml/vuxml-11.dtd
8. share/xml/dtd/vuxml/vuxml-model-10.mod
9. share/xml/dtd/vuxml/vuxml-model-11.mod
10. share/xml/dtd/vuxml/xml1.dcl

Collapse this list.

Dependency lines:

• vuxml>0:security/vuxml

To install the port: cd /usr/ports/security/vuxml/ && make install clean

To add the package: pkg install vuxml

PKGNAME: vuxml

Flavors: there is no flavor information for this port.

distinfo:

SHA256 (vuxml/vuxml-10.dtd) = 6a635ad2cf45f52361c8c2a29a689157fad4d00519045485bc822d34e04a524e SIZE (vuxml/vuxml-10.dtd) = 2986 SHA256 (vuxml/vuxml-model-10.mod) = 051fed00b52bedde8ee901003fc29f7b95cd904157e31ceef34e6b06f2d1a14a SIZE (vuxml/vuxml-model-10.mod) = 10599 SHA256 (vuxml/vuxml-11.dtd) = 12b50061d7bb34cecffede2e08d439e4469324376d55aeb7c73eb6aab0f36af1 SIZE (vuxml/vuxml-11.dtd) = 3063 SHA256 (vuxml/vuxml-model-11.mod) = a40777208625a3029c6f416aeeea733f614802a6a5f26035a4e445a09e61a47c SIZE (vuxml/vuxml-model-11.mod) = 13282 SHA256 (vuxml/xml1.dcl) = 343efa94c4e1302e85e08b2d1791d86e50aac1ecdbc3161daecac100e4726847 SIZE (vuxml/xml1.dcl) = 7372 SHA256 (vuxml/catalog) = 479a69cf02995603443fd1f3b5b33f97811670931f87f53be99a727d664abc66 SIZE (vuxml/catalog) = 549 SHA256 (vuxml/catalog.xml) = 7b2e2850f57264eeba0ccd3d1fc161b9d5ce3071ae0ec51b9da7fa956f2a6509 SIZE (vuxml/catalog.xml) = 2150

Dependencies

NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.

Runtime dependencies:

1. xmlcatmgr : textproc/xmlcatmgr
2. xsltproc : textproc/libxslt
3. VERSION : textproc/xhtml-modularization
4. xhtml-basic10.dtd : textproc/xhtml-basic
5. python3.7 : lang/python37

There are no ports dependent upon this port

Configuration Options

No options to configure

USES:

python:run

Master Sites:

1. http://www.vuxml.org/dtd/vuxml-1/

security/vuxml: add three CVEs for qmail

PR:		245010
Submitted by:	erdgeist@erdgeist.org

Document new vulnerabilities in www/chromium 83.0.4103.61.

The website is somewhat crippled and does not show the full text.

Add entry for piwigo

PR:		245153
Sponsored by:	Netzkommune GmbH

Add entry for tomcat

PR:		246657
Sponsored by:	Netzkommune GmbH

Document unbound multiple vulnerabilities.

Add entry for drual7

Sponsored by:	Netzkommune GmbH

security/vuxml: Document net-mgmt/zabbix3 issue

Security:	CVE-2020-11800

Document rails vulnerability

- Document CVE-2019-18348, CVE-2020-8492 for python38

security/vuxml: Report multiple dovecot vulnerabilities.

- Document security/clamav vulnerabilities

Update json-c vulnerability

- While I'm here, fix format

json-c 0.14 will land the ports tree along with the fix, thus I change it to
0.14.

PR:		246389

Document rails vulnerability

security/vuxml: MariaDB vulnerabilities

Add new sysutils/py-salt vulnerabilities

PR:		246061
Reported by:	Christer Edwards <christer.edwards@gmail.com>
Security:	CVE-2020-11651
Security:	CVE-2020-11652

devel/json-c: CVE-2020-12762 integer overflow, out of bounds write

Reported by:	Daniel Engberg
Security:	abc3ef37-95d4-11ea-9004-25fadb81abf4
Security:	CVE-2020-12762

Document typo3 vulnerability

Add proper links for the html output of vuln.xml.

Add freebsdsa as a proper type.
Correct link to CVEs.

Reviewed by:	gjb, joneum
Approved by:	ports-secteam (joneum)
Differential Revision:	https://reviews.freebsd.org/D24824

Add data for today's SA batch.

Approved by:	so

security/vuxml: log www/qutebrowser CVE-2020-11054

- Document python27 CVE-2019-18348

add entry for www/glpi

PR:		244971
Sponsored by:	Netzkommune GmbH

mail/mailman: extend content injection vuln via private archive login

This led up to mailman 2.1.33 today.
https://bugs.launchpad.net/mailman/+bug/1877379
https://launchpadlibrarian.net/478684932/private.diff
https://mail.python.org/archives/list/mailman-developers@python.org/thread/SYBIZ3MNSQZLKN6PVKO7ZKR7QMOBMS45/

Approved by:	ports-secteam@ (blanket for security fixes)
Security:	88760f4d-8ef7-11ea-a66d-4b2ef158be83

security/vuxml: Mark zeek < 3.0.6 as vulnerable as per:

    https://raw.githubusercontent.com/zeek/zeek/v3.0.6/NEWS

Various issues including buffer over-reads, uninitialized field
access, memory leak, and stack overflows.

security/vuxml: Update discovery date for CVE-2020-1730

Update discovery date for CVE-2020-1730 based on information obtained from
the libssh team.

Approved by:	gerald (mentor)

Document wagtail vulnerability

Permit mail/mailman vulnerability to be fixed in 2.1.30_3 already

...not in 2.1.31 only. We can't just easily backport 2.1.31 to 2020Q2.

Security:	88760f4d-8ef7-11ea-a66d-4b2ef158be83

new mailman < 2.1.31 content injection vulnerability

similar to CVE-2018-13796 (not sure if they'll reuse that no. so
not including in Security: tags below)

https://bugs.launchpad.net/mailman/+bug/1873722

Security:	88760f4d-8ef7-11ea-a66d-4b2ef158be83

Fix version range for 97fcc60a-6ec0-11ea-a84a-4c72b94353b5:
phpMyAdmin 4.9.5 is not vulnerable

PR:		245096

security/vuxml: Document net-mgmt/cacti issue

PR:		246164
Submitted by:	Michael Muenz <m.muenz@gmail.com>
Security:	CVE-2020-7106

security/vuxml: add squid 4.10 CVEs

PR:		245433
Submitted by:	Michael Muenz <m.muenz@gmail.com>

Document audio/taglib vulnerability

Documented gitlab vulnerabilities.

security/vuxml: Add other flavors of py-yaml

Document multimedia/vlc vulnerabilities

Security:	CVE-2019-19721 CVE-2020-6071 CVE-2020-6072 CVE-2020-6073 CVE-2020-6077
CVE-2020-6078 CVE-2020-6079

Add an entry about CVE-2020-10700, CVE-2020-10704 in samba410 and 411.

Security:	CVE-2020-10700
		CVE-2020-10704

net/ceph14: document CVE-2020-1759, CVE-2020-1760

Document OpenLDAP CVE-2020-12243.

PR:		213895
Submitted by:	rob2g2 <spam123 bitbert com>

Add entry for py-yaml vulnerability

security/vuxml: Document www/py-bleach issue

PR:		245943
Security:	CVE-2020-6817

security/vuxml: MySQL Server 2020Q2 vulnerabilities

security/vuxml: MySQL client 2020Q2 vulnerabilities

security/vuxml: Register Nextcloud vulnerabilities

security/vuxml: Document lang/python issue

PR:		245819
Security:	CVE-2020-8492

Document wagtail vulnerability

11.3 isn't vulenrable to the recent OpenSSL vulnerability.

Approved by:	so
X-Pointy-Hat to: gordon

security/vuxml: Restore openssl port version range to the 2020-04-21 entry

I tested that this passes "make validate" and correctly flags
openssl-1.1.1f,1 as vulnerable.

Approved by:	gjb

Revert r532466, adding back 'FreeBSD' to the topic.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

The vuxml build is now fixed.  Remove the 'ignore' block and its
contents.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Comment the second name tag, which I believe is what is causing the
vuxml build to fail.  If I am wrong, I will revert this commit.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Um, ok.  Third attempt to try to fix the vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Attempt number 2 to fix the vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Fix vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

security/vuxml: Fix OpenSSL port commit

security/vuxml: Mark OpenSSL 1.1.1f from ports vulnerable too

Document libntlm vulnerability

Add new entries for SA-20:10 and SA-20:11.

security/vuxml: Document devel/py-twisted vulnerabilities

PR:		245252
Submitted by:	Sascha Biberhofer <ports@skyforge.at>
Reported by:	contact@evilham.com

security/vuxml: Add CVE-2020-1730 affecting security/libssh

Approved by:	gerald (mentor)
Differential Revision:	https://reviews.freebsd.org/D24377

Document webkit2-gtk3 vulnability

- Add www/drupal8 entry

sysutils/ansible*: Add multiple Vulnerabilities

- Add vuxml entry for CVE-2020-1737, CVE-2020-1739 and CVE-2020-1740

Security:       CVE-2020-1737
Security:       CVE-2020-1739
Security:       CVE-2020-1740

Document new vulnerabilities in www/chromium < 81.0.4044.113

Obtained from:	Google Chrome Releases

document security/openvpn{,-mbedtls,-devel} illegal client float DoS

URL:		https://community.openvpn.net/openvpn/ticket/1272

Reported by:	Lev Stipakov
Security:	CVE-2020-11810
Security:	8604121c-7fc2-11ea-bcac-7781e90b0c8f

Document Mbed TLS CVE-2020-10932.

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-04

Document gitlab vulnerabilities.

security/vuxml: Mark zeek < 3.0.4 as vulnerable as per:

   
https://github.com/zeek/zeek/blob/e059d4ec2e689b3c8942f4aa08b272f24ed3f612/NEWS

An attacker can crash Zeek remotely via crafted packet sequence via
a stack overflow in POP3 analyzer.

Document new vulnerabilities in www/chromium < 81.0.4044.92

Document partial new vulnerabilities in www/chromium < 80.0.3987.162

Add an entry for the HAproxy vulnerability announced today. The ports have
already been fixed.

PR:		245282
Discussed with:	demon

Fix rubygem-json entry (40194e1c-6d89-11ea-8082-80ee73419af3)

rubygem-json 2.3.0 was erroneously marked as vulnerable.

% cd /usr/ports/devel/rubygem-json
% make fetch
===>  rubygem-json-2.3.0 has known vulnerabilities:
rubygem-json-2.3.0 is vulnerable:
rubygem-json -- Unsafe Objection Creation Vulnerability in JSON (Additional fix)
CVE: CVE-2020-10663
WWW: https://vuxml.FreeBSD.org/freebsd/40194e1c-6d89-11ea-8082-80ee73419af3.html

1 problem(s) in 1 installed package(s) found.
=> Please update your ports tree and try again.
=> Note: Vulnerable ports are marked as such even if there is no update
available.
=> If you wish to ignore this vulnerability rebuild with 'make
DISABLE_VULNERABILITIES=yes'
*** Error code 1

Stop.
make: stopped in /usr/ports/devel/rubygem-json

Add entry for Apache 2.4

Sponsored by:	Netzkommune GmbH

Document multiple vulnerabilities in net-mgmt/cacti < 1.2.10

PR:		245205
Submitted by:	Michael Muenz <m.muenz@gmail.com>

Add entry for GNUTLS-SA-2020-03-31 (flaw in DTLS).

Security:	https://gnutls.org/security-new.html#GNUTLS-SA-2020-03-31

Fix validation error

Add vuxml entry for CVE-2020-1720

- Document mediawiki's multiple vulnerabilities

Fix vuxml build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Document gitlab vulnerabilities.

security/vuxml: Document CVE-2020-10663 (devel/rubygem-json)

PR:		245023

Document Jenkins Security Advisory 2020-03-25

Sponsored by:	The FreeBSD Foundation

Add entry for phpmyadmin

Sponsored by:	Netzkommune GmbH

Add details for two Puppet-related CVEs

Add details for today's SAs.

Approved by:	so

security/vuxml: Add www/py-bleach entry

security/vuxml: Mark zeek < 3.0.3 as vulnerable as per:

   
https://raw.githubusercontent.com/zeek/zeek/9dda3602a760f00d9532c6314ea79108106033fa/NEWS

There are a number of potential denial of service issues due to
memory leaks, buffer overflows, and a null pointer dereference.

Approved by:	matthew (mentor, implicit)

scurity/vuxml: fix range

Document security issue in graphics/okular

https://kde.org/info/security/advisory-20200312-1.txt:

Overview
========
Okular can be tricked into executing local binaries via specially crafted
PDF files.

This binary execution can require almost no user interaction.

No parameters can be passed to those local binaries.

We have not been able to identify any binary that will cause actual damage,
be it in the hardware or software level, when run without parameters.

Document gitlab-ce vulnerability.

- Document django's potential SQL injection vulnerability

Document py-matrix-synapse vulnerabilities

PR:		244279
Submitted by:	Sascha Biberhofer <ports@skyforge.at>

security/vuxml: document recent Node.js vulnerabilities

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/

While here, fix errors from `make validate` for the preceeding gitea
vulnerabilities.

Sponsored by:	Miles AS

Fix closing tag

Reported by:	joneum

Add entry for www/gitea

PR:		244025
Submitted by:	maintainer

Document vulnerability in sysutils/py-salt

PR:		243908
Reported by:	Christer Edwards <christer.edwards@gmail.com>
Security:	CVE-2019-17361

Documment gitlab vulnerabilities.

Document the latest nwtime.org ntp security advisory found at:
http://support.ntp.org/bin/view/Main/SecurityNotice#\
March_2020_ntp_4_2_8p14_NTP_Rele

No CVEs have been documented yet.

Security:	http://support.ntp.org/bin/view/Main/NtpBug3610
		http://support.ntp.org/bin/view/Main/NtpBug3596
		http://support.ntp.org/bin/view/Main/NtpBug3592

Document librsvg2 vulnabilities.

Security:	CVE-2019-20446

Document some audio/timidity++* vulnerabilities

PR:		244429
Reported by:	pi
Security:	CVE-2017-11546
Security:	CVE-2017-11547
Security:	CVE-2017-11549

Document apache-solr vulnerabilities.

14 vulnerabilities affecting 165 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities

Last updated:
2020-05-25 19:05:09