security/vuxml: document electron25 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.8

security/vuxml: correct last SA's affected range

FreeBSD-SA-23:17.pf only affects the kernel, not userland.  The first
patch level of the kernel without the vulnerability is 13.2_4, not
13.2_7.

Reported by:	dvl

security/vuxml: add FreeBSD SA released on 2023-12-05

FreeBSD-SA-23:17.pf affects all supported releases (12.4, 13.2, 14.0).

security/vuxml: Add Varnish Cache vulnerability

security/vuxml: Add www/qt6-webengine

qt6-webengine < 6.6.1 is also affected by the following VuXML IDs:
- 6d9c6aae-5eb1-11ee-8290-a8a1599412c6
- 07ee8c14-68f1-11ee-8290-a8a1599412c6
- a1e27775-7a61-11ee-8290-a8a1599412c6
- 0da4db89-84bf-11ee-8290-a8a1599412c6

security/vuxml: document gitlab vulnerabilities

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.7,
		https://github.com/electron/electron/releases/tag/v26.6.2

security/vuxml: add www/*chromium < 119.0.6045.199

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html

security/vuxml: Add devel/cmake-core

VuXML ID d6c19e8c-6806-11ee-9464-b42e991fc52e also affects the bundled
libcurl in devel/cmake-core < 3.27.8.

security/vuxml: Document MariaDB vulnerability

security/vuxml: Add www/qt5-webengine

VuXML ID 0da4db89-84bf-11ee-8290-a8a1599412c6 also affects
www/qt5-webengine < 5.15.16.p5

security/vuxml: document strongSwan vulnerability CVE-2023-41913

Security:	a62c0c50-8aa0-11ee-ac0d-00e0670f2660
Security:	CVE-2023-41913

security/vuxml: document electron use after free in Garbage Collection

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.6,
		https://github.com/electron/electron/releases/tag/v26.6.1

security/vuxml: add www/*chromium < 119.0.6045.159

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html

security/vuxml: document electron use after free in WebAudio

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.5,
		https://github.com/electron/electron/releases/tag/v26.6.0

security/vuxml: 2.6.0 <= openvpn < 2.6.7 vulnerabilities

Related to:

PR:		275055
Security:	2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security:	CVE-2023-46849
Security:	CVE-2023-46850

This specifically documents < 2.6.7_1 in order to collect the
regression fix for https://github.com/OpenVPN/openvpn/issues/449
which was a bug newly introduced into 2.6.7.

security/vuxml: Record typo3-1{12} vulnerabilities

PR: 275073 275074

security/vuxml: add issues for PostgreSQL

https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.4,
		https://github.com/electron/electron/releases/tag/v26.5.0

security/vuxml: Document libsndfile vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2022-33065

security/vuxml: add www/*chromium < 119.0.6045.123

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html

security/vuxml: Document OpenSSL vulnerability

security/vuxml: add FreeBSD SAs released on 2023-11-08

FreeBSD-SA-23:15.stdio affects 12.4 and 13.2
FreeBSD-SA-23:16.cap_net affects 13.2

security/vuxml: document vorbis-tools vulnerability

PR:		274900
Reported by:	diizzy

security/vuxml: document optipng vulnerability

PR:		274822
Reported by:	Thomas Hurst <tom@hur.st>

security/vuxml: add www/*chromium < 119.0.6045.105

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html

security/vuxml: add phpmyfaq < 3.2.2

security/vuxml: Add open-vm-tools vulnerabilities

Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: added gitlab vulnerabilities

security/vuxml: Mark zeek < 6.0.2 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v6.0.2

This release fixes the following potential DoS vulnerabilities:

 - A specially-crafted SSL packet could cause Zeek to leak memory
   and potentially crash.

 - A specially-crafted series of FTP packets could cause Zeek to
   log entries for requests that have already been completed, using
   resources unnecessarily and potentially causing Zeek to lose
   other traffic.

 - A specially-crafted series of SSL packets could cause Zeek to

security/vuxml: add www/*chromium < 118.0.5993.117

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html

security/vuxml: mark xorg-server < 21.1.9,1 as vulnerable

security/vuxml: Register multiple www/squid vulnerabilities

Denial of Service in FTP
	Base Score:	8.6
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Request/Response smuggling in HTTP/1.1 and ICAP
	Base Score:	9.3
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Denial of Service in HTTP Digest Authentication
	Base Score: 9.9
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

security/vuxml: Document OpenSSL vulnerability

security/vuxml: Document MySQL vulnerabilities

security/vuxml: security/vuxml: Document www/rt44 and www/rt50 vulnerabilities

security/vuxml: document electron use after free in site isolation

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.2,
	 	https://github.com/electron/electron/releases/tag/v26.4.1

security/vuxml: Document Apache httpd vulnerabilities

security/vuxml: add games/moonlight-embedded vulnerability

PR:		274452
Reported by:	Armin Zhu <lisp_25689@163.com>

security/vuxml: Document Jenkins Security Advisory 2023-10-18

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Roundcube vulnerability

security/vuxml: Document possible bypassing Unix socket permissions in redis

security/vuxml: Document a vulnerability in textproc/libcue

PR:	274413

security/vuxml: Document HTTP/2 DoS vulnerability in net/traefik

security/vuxml: Update version range for samba413 vulnerabilities

Security fixes were back-ported from Samba 4.6.11 to samba413-4.13.17_6
in fe495574527e3f97cbb57438f8c468fad8842e9d.

PR:		273595
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document libXpm recent CVEs

PR:	274266

security/vuxml: Document libX11 recent CVEs

PR:	274266

security/vuxml: add www/*chromium < 118.0.5993.70

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html

security/vuxml: document electron25 use after free in extensions

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.1

security/vuxml: Fix bca498407bf9e529936ebb68e9ca257bdd1428de

The pkg audit result before the fix:
curl-8.4.0 is vulnerable:
  curl -- SOCKS5 heap buffer overflow
  CVE: CVE-2023-38545
  WWW:
https://vuxml.FreeBSD.org/freebsd/d6c19e8c-6806-11ee-9464-b42e991fc52e.html

1 problem(s) in 1 installed package(s) found.

security/vuxml: Fix description body

Keep the original description body for "make newentry" without parameters.

security/vuxml: register ftp/curl heap buffer overflow

Severity: High
CVE-2023-38545 reserved:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38545

security/vuxml: add h2o-devel vuln details

Security:	CVE-2023-44487
Sponsored by:	SkunkWerks, GmbH

security/vuxml: Document Django multiple vulnerabilities

security/vuxml: add entry for recent libspf2 CVE-2023-42118

PR:	274215

security/vuxml: add www/*chromium < 117.0.5938.149

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html

security/vuxml: add FreeBSD SAs released on 2023-10-03

FreeBSD-SA-23:12.msdosfs affects 12.4 and 13.2
FreeBSD-SA-23:13.capsicum affects 13.2
FreeBSD-SA-23:14.smccc affects 13.2

security/vuxml: fix validation errors

Fix whitespace errors in vid 6e0ebb4a-5e75-11ee-a365-001b217b3468
introduced by commit 36a838e202256d5a528abfc8ff6a66ca7ce4d148.

security/vuxml: Document mediawiki multiple vulnerabilities

security/vuxml: add libvpx to the entry

The libvpx port was already updated.
https://chromium.googlesource.com/webm/libvpx/+log/v1.13.0..v1.13.1

Security: CVE-2023-5217

security/vuxml: Improve affected version ranges of composer vulnerability entry.

security/vuxml: Add devel/php-composer* vulnerability

security/vuxml: add www/*chromium < 117.0.5938.132

Obtained
from:	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

security/vuxml: fix long description warning

Eliminate an annoying warning from "make validate"

Modify entry 441e1e1a-27a5-11ee-a156-080027f5fec9 description and get rid of
empty lines and some expendable words. vuxml.freebsd.org prints all the lines
joined together.

security/vuxml: document electron heap buffer overflow in vp8 encoding

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.25,
		https://github.com/electron/electron/releases/tag/v24.8.5,
		https://github.com/electron/electron/releases/tag/v25.8.4

security/vuxml: add gitlab vulnerabilities 2023-09-28

security/vuxml: document multiple xrdp vulnerabilities

security/vuxml: Fix name

security/vuxml: Record net/routinator vulnerability

CVE-2023-39916

	Base Score:	6.5 MEDIUM
	Vector:		CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

PR:	274105

security/vuxml: Fix make newentry CVE_ID

Fix description body, broken when introducing SA_ID

Fixes:	e90a0b117fdc61d6d6bc4b02a4b7b5be5a878b2d

security/vuxml: Add SA_ID to make newentry

Automate registration of FreeBSD Security Advisories.

It adds a new parameter for the newentry subcommand accepting a SA ID as present
in the FreeBSD Security Advisories web page
(https://www.freebsd.org/security/advisories/)

Fills an entry following the common structure for FreeBSD SAs and leaves some
"FIXME" strings in those places that need special care.
Developers should NOT blindly trust the output of the script.

`make newentry SA_ID=FreeBSD-SA-23:11.wifi.asc`
`make newentry SA_ID=FreeBSD-SA-22:01.vt`

Reviewed by:		philip@
Differential Revision: https://reviews.freebsd.org/D41966

security/vuxml: Document Jenkins Security Advisory 2023-09-20

Sponsored by:	The FreeBSD Foundation

security/vuxml: Add information about mail/mailpit vulnerability.

security/vuxml: Remove spurious file

Fixes:	20c93ef1ae8f43a36f9b05e79e6531b6186f3a86

security/vuxml: add graphics/webp heap buffer overflow

graphics/webp was updated to 1.3.2

PR:		273766
Security:	CVE-2023-4863

security/vuxml: Add Tor browser libwebp vulnerability

CVE-2023-4863
	Base Score:  8.8 HIGH
	Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PR:		273416
Reported by:	kaltheat <kaltheat@gmail.com>
Security:	CVE-2023-4863

security/vuxml: document gitlab vulnerability

security/vuxml: document routinator vulnerabilities

Obtained from:	https://nlnetlabs.nl/news/2023/Sep/13/routinator-0.12.2-released/

security/vuxml: Document cURL vulnerability

PR:		273764
Reported by:	yasu

security/vuxml: Document Roundcube XSS vuln

security/vuxml: remove unnecessary placeholder for cvename and url

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.24,
		https://github.com/electron/electron/releases/tag/v24.8.3,
		https://github.com/electron/electron/releases/tag/v25.8.1

security/vuxml: add www/*chromium < 117.0.5938.62

Obtained
from:	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.htm

security/vuxml: document vscode remote code execution vulnerability

Obtained from:	https://github.com/microsoft/vscode/issues/192906

security/vuxml: Mark zeek < 6.0.1 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v6.0.1

This release fixes the following potential DoS vulnerabilities:

 - File extraction limits were not correctly enforced for files
   containing large amounts of missing bytes.

 - Sessions are sometimes not cleaned up completely within Zeek
   during shutdown,
   potentially causing a crash when using the -B dpd flag for debug logging.

 - A specially-crafted HTTP packet can cause Zeek's filename
   extraction code to take a long time to process the data.

 - A specially-crafted series of FTP packets made up of a CWD request
   followed by a large amount of ERPT requests may cause Zeek to
   spend a long time logging the commands.

 - A specially-crafted VLAN packet can cause Zeek to overflow memory
   and potentially crash.

Reported by:	Tim Wojtulewicz

security/vuxml: Document Gitea vulnerabilities

PR:		273691

security/vuxml: Document Python multiple vulnerabilities

security/vuxml: Document Go vulnerabilities

security/vuxml: add FreeBSD SA-2023:11.wifi

security/vuxml: add FreeBSD SA-23:10.pf

security/vuxml: Document possible bypassing ACL configuration in redis

security/vuxml: add www/*chromium < 116.0.5845.179

Obtained
from:	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html

security/vuxml: Fix a typo in previous commit

security/vuxml: Document Django multiple vulnerabilities

security/vuxml: document gitlab vulnerabilities

security/vuxml: document borgbackup < 1.2.5 archive spoofing

Security:	b8a52e5a-483d-11ee-971d-3df00e0f9020
Security:	CVE-2023-36811
Security:	https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.23,
		https://github.com/electron/electron/releases/tag/v24.8.2,
		https://github.com/electron/electron/releases/tag/v25.8.0

security/vuxml: Document 18 py*-* vulnerabilities

Vulnerable Python ports discovered with pysec2vuxml.
See also: <https://github.com/HubTou/pysec2vuxml>.

PR:		270923
Co-Authored by:	kai

security/vuxml: fix the vuxml build

Correctly spell the <cvename> entries added in d6f580f7470f.

Pointy hat to:	philip

security/vuxml: catch up with recent FreeBSD SAs

Add FreeBSD SAs issued since FreeBSD-SA-22:13.zlib in August 2022.

2022-11-15  FreeBSD-SA-22:14.heimdal
2022-11-29  FreeBSD-SA-22:15.ping
2023-02-08  FreeBSD-SA-23:01.geli
2023-02-16  FreeBSD-SA-23:02.openssh
2023-02-16  FreeBSD-SA-23:03.openssl
2023-06-21  FreeBSD-SA-23:04.pam_krb5
2023-06-21  FreeBSD-SA-23:05.openssh
2023-08-01  FreeBSD-SA-23:06.ipv6
2023-08-01  FreeBSD-SA-23:07.bhyve
2023-08-01  FreeBSD-SA-23:08.ssh
2023-08-01  FreeBSD-SA-23:09.pam_krb5