vuxml Vulnerability and eXposure Markup Language DTD
1.1_3 security =31

Maintainer: ports-secteam@FreeBSD.org
Port Added: 12 Feb 2004 14:24:23
Also Listed In: textproc
License: BSD2CLAUSE

VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.

SVNWeb : PortsMon

---

To install the port: cd /usr/ports/security/vuxml/ && make install clean
To add the package: pkg install vuxml

PKGNAME: vuxml

distinfo:

SHA256 (vuxml/vuxml-10.dtd) = 6a635ad2cf45f52361c8c2a29a689157fad4d00519045485bc822d34e04a524e
SIZE (vuxml/vuxml-10.dtd) = 2986
SHA256 (vuxml/vuxml-model-10.mod) = 051fed00b52bedde8ee901003fc29f7b95cd904157e31ceef34e6b06f2d1a14a
SIZE (vuxml/vuxml-model-10.mod) = 10599
SHA256 (vuxml/vuxml-11.dtd) = 12b50061d7bb34cecffede2e08d439e4469324376d55aeb7c73eb6aab0f36af1
SIZE (vuxml/vuxml-11.dtd) = 3063
SHA256 (vuxml/vuxml-model-11.mod) = a40777208625a3029c6f416aeeea733f614802a6a5f26035a4e445a09e61a47c
SIZE (vuxml/vuxml-model-11.mod) = 13282
SHA256 (vuxml/xml1.dcl) = 343efa94c4e1302e85e08b2d1791d86e50aac1ecdbc3161daecac100e4726847
SIZE (vuxml/xml1.dcl) = 7372
SHA256 (vuxml/catalog) = 479a69cf02995603443fd1f3b5b33f97811670931f87f53be99a727d664abc66
SIZE (vuxml/catalog) = 549
SHA256 (vuxml/catalog.xml) = 7b2e2850f57264eeba0ccd3d1fc161b9d5ce3071ae0ec51b9da7fa956f2a6509
SIZE (vuxml/catalog.xml) = 2150

---

NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.

Runtime dependencies:

1. xmlcatmgr : textproc/xmlcatmgr
2. xsltproc : textproc/libxslt
3. VERSION : textproc/xhtml-modularization
4. xhtml-basic10.dtd : textproc/xhtml-basic
5. python2.7 : lang/python27

There are no ports dependent upon this port

---

Configuration Options

     No options to configure

---

USES:

python:run

---

Master Sites:

1. http://www.vuxml.org/dtd/vuxml-1/

security/vuxml: Add jabberd vulnerability

PR:		221014
Security:	CVE-2017-10807

Document webkit2-gtk3 CVE's

Document gsoap vulnerability

security/vuxml: Add Percona to recent MySQL vulns

Security:	cda2f3c2-6c8b-11e7-867f-b499baebfeaf

security/vuxml: Correct MySQL versions

Security:	cda2f3c2-6c8b-11e7-867f-b499baebfeaf

Fix collectd5's range version

Reported by:	romain

Document GitLab vulnerabilities

security/vuxml: Document MySQL vulnerabilities

Fix vuxmlbuild by replacing lower case by upper case in cvename

Reported by:	bz

Document vulnerability in collectd5

PR:		220797
Reported by:	luca.pizzamiglio@gmail.com
Security:	CVE-2017-7401

Document vulnerability in strongswan

PR:		220823
Reported by:	i.dani@outlook.com
Security:	CVE-2017-9022
Security:	CVE-2017-9023

security/vuxml: Document vulnerability in cacti

Security:	CVE-2017-10970

Approved by:	garga (mentor)
Differential Revision:	https://reviews.freebsd.org/D11611

security/vuxml: Document vulnerability in apache24

Document latest Flash Player vulnerabilities.

https://helpx.adobe.com/security/products/flash-player/apsb17-21.html

Add an entry for the CVE-2017-11103 in Samba.

Security:	CVE-2017-11103

ecurity/vuxml: add node.js vulnerabilities announced 2017-07-11

The vulnerability in the bundled c-ares dependency is not included,
since the Node.js ports use dns/c-ares as a dependency instead.

Approved by:	mat (co-mentor)
MFH:		2017Q3
Security:	http://www.vuxml.org/freebsd/3eff66c5-66c9-11e7-aa1d-3d2e663cef42.html
Differential Revision:	https://reviews.freebsd.org/D11561

Document nginx security advisory (CVE-2017-7529).

Document security issue fixed in CodeIgniter 3.1.5

Security:	https://vuxml.FreeBSD.org/freebsd/aaedf196-6436-11e7-8b49-002590263bf5.html

Document irssi vulnerabilities

PR:		220544
Security:	CVE-2017-10965
Security:	CVE-2017-10966

security/vuxml: Fix <url> for latest PHP entry

security/vuxml: Register oniguruma/php-mbstring vulns

- Add drupal7 to vuxml entry

- Document new vulnerabilities in www/drupal8 < 8.3.4

Another round of spelling fixes, covering entries of the year 2015.

Fix a bunch of noticed typos and spelling mistakes, covering years
2016-2017.  Some of those are so common that I've taken liberty to
fix them all over the file.

Added vxvml entry for security/dropbear

PR:		220158
Submitted by:	Piotr Kubaj <pkubaj@anongoth.pl> (maintainer)
Reviewed by:	lifanov (mentor)
Approved by:	lifanov (mentor)
MFH:		2017Q3
Security:	http://www.vuxml.org/freebsd/60931f98-55a7-11e7-8514-589cfc0654e1.html
Differential Revision:	https://reviews.freebsd.org/D11400

security/vuxml: Document smarty3 shell injection vuln

- Document libgcrypt side-channel attack on RSA secret keys

Security:	CVE-2017-7526

Document GitLab vulnerabilities

- Document tor security regression

Security:	CVE-2017-0377

security/vuxml: Correct apache22 version

 - vulns fixed in unreleased 2.2.33

Reported by:		filis (irc)

Document Stack Clash vulnerability related to Exim

Document pear-Horde_Image vulnerabilities.

Security:	CVE-2017-9773
Security:	CVE-2017-9774

Document OpenVPN vulnerabilities.

Security:	9f65d382-56a4-11e7-83e3-080027ef73ec
Security:	CVE-2017-7508
Security:	CVE-2017-7512
Security:	CVE-2017-7520
Security:	CVE-2017-7521
Security:	CVE-2017-7522

security/vuxml: Fix entry uppercasing

 - Introduced in 443943

security/vuxml: Document Apache httpd vulnerabilities

Document new vulnerabilities in www/chromium < 59.0.3071.104

Obtained
from:	https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html

Document cURL vulnerability

Fix the range of vulnerable versions for p5-RT-Authen-ExternalAuth --
BestPractical have released a tarball of patches, but they've also
pushed 0.27 up to CPAN and that has the fixes incorporated.

Document multiple vulnerabilities in www/rt42, www/rt44 and
www/p5-RT-Authen-ExternalAuth

Document latest Flash Player vulnerabilities.

https://helpx.adobe.com/security/products/flash-player/apsb17-17.html

security/vuxml: mark firefox < 54 as vulnerable

Correct vulnerable versions of security/heimdal after the security fix
was backported in 7.1.0_3

PR:		219657
Security:	CVE-2017-6594

Document roundcube vulnerability

PR:		219789

Document GNUTLS-SA-2017-4.

Security:	https://gnutls.org/security.html#GNUTLS-SA-2017-4

- Document remote DoS in irc/irssi

Document new vulnerabilities in www/chromium < 59.0.3071.86

Obtained
from:	https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html

Document vulnerability in sysutils/ansible (CVE-2017-7481)

- Document authentication bypass in security/duo

- Document vulnerability in net/freeradius3 (CVE-2017-9148)

Document heimdal vulnerability

PR:		219657
Security:	CVE-2017-6594

Modify GitLab entries:
- wrap long lines
- add missing modfied

Update imagemagick entry

* Fix indention
* Add ranges to the imagemagick 6 version check, to prep for
  ImageMagick patch for the branch.
* Add portepoch's to the imagemagick 6 versions.
* Bump imagemagick 6 version. This version fixes at least one of
  the mentioned CVE's.
* Change CVE-2017-8365 to CVE-2017-8765. CVE-2017-8365 is a
  libsndfile CVE.
* Add modified tag.

security/vuxml: Fix latest ImageMagick entry

 - Fix case in pkgname
 - Add version 7
 - add -nox pkgnamesuffix

PR:		219497
Submitted by:	Dani <i.dani@outlook.com>

Document FreeBSD-SA-17:04.ipfilter

Document FreeBSD-SA-17:03.ntp

Add missing info for FreeBSD-SA-17:02.openssl

Document remote code execution via subtitles in multimedia/vlc

Document OpenEXR 2.2.0 vulnerabilities

Reported by:	Brandon Perry
Security:	803879e9-4195-11e7-9b08-080027ef73ec
Security:	CVE-2017-9116
Security:	CVE-2017-9115
Security:	CVE-2017-9114
Security:	CVE-2017-9113
Security:	CVE-2017-9112
Security:	CVE-2017-9111
Security:	CVE-2017-9110

security/vuxml: Document ImageMagick vulnerabilities

PR:		219497
Reported by:	dani <i.dani@outlook.com>

security/vuxml: Document samba RCE vulnerability

 - Add entry for samba
 - Fix tabs/space previous entry

Security:	CVE-2017-7494

Document another round of multiple vulnerabilities found in the kernel
mode layer handler of nVidia GPU display driver.

Security:	CVE-2017-0350, CVE-2017-0351, CVE-2017-0352
PR:		219465
Submitted by:	Andrew Marks

- add miniupnpc CVE-2017-8798

- Fix spelling

Reported by:	remko

- Document Wordpress multible vulnerabilities

Approved by:	miwi (mentor)
Differential Revision:	https://reviews.freebsd.org/D10789

Document net/asterisk13 and net/pjsip vulnerabilities.

Clean up joomla3 entry.

Submitted by:	zi

Add cvename

Add entry for Joomla3 20170501.

Document recent GitLab vulnerabilities.

Security:
https://vuxml.FreeBSD.org/freebsd/9704930c-3bb7-11e7-93f7-d43d7e971a1b.html

Fix name of old gitlab-entry, its gitlab instead of rubygem-gitlab

Document GitLab vulnerabilities.

Security: CVE-2017-0882
Security:
https://vuxml.FreeBSD.org/freebsd/5d62950f-3bb5-11e7-93f7-d43d7e971a1b.html

Document freetype2 vulnability.

Security:	CVE-2017-8105, CVE-2017-8287

Add openvpn < 2.3.15/< 2.4.2 DoS vuln.

https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits

Reported by:	Samuli Seppanen
Security:	04cc7bd2-3686-11e7-aa64-080027ef73ec
Security:	CVE-2017-7478
Security:	CVE-2017-7479

Add information about vulnerabilities in PostgreSQL

Security:	CVE-2017-7484 CVE-2017-7485 CVE-2017-7486

Document kauth privilege escalation.

Reviewed by:	rakuco
Approved by:	rakuco (mentor)
Security:	CVE-2017-8422
Differential Revision:	https://reviews.freebsd.org/D10660

Document mail/libetpan null dereference vulnerability

CVE-2017-7867 and CVE-2017-7868 were fixed in r440117.

Document new vulnerability in www/chromium < 58.0.3029.96

Obtained
from:	https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html

security/vuxml: Document dovecot2 vulnerability

PR:		218671
Approved by:	adamw (mentor, implicit), ports-secteam (maintainer timeout)
Security:	CVE-2017-2669

security/libressl-devel: Mark vulnerabile 2.5.3

security/vuxml: Document LibreSSL vulnerability

 - CVE-2017-8301 TLS verification vulnerability

Document Jenkins Security Advisory 2017-04-26

Document security issues fixed in CodeIgniter 3.1.4

Security:	https://vuxml.FreeBSD.org/freebsd/df0144fb-295e-11e7-970f-002590263bf5.html

security/vuxml: Document weechat vulnerability

PR:		218852
Submitted by:	Jochen Neumeister <joneum@bsdproject.de>

and make validate for something I did not do.

Pointy hat:	acm
Sponsored by:	Absolight

I'm stupid.

Pointy hat:	mat
Sponsored by:	Absolight

This was fixed a while ago.

Sponsored by:	Absolight

- Document new vulnerability in www/drupal8 < 8.3.1

Document new vulnerabilities in www/chromium < 58.0.3029.81

Obtained
from:	https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html

Add a separate entry for linux-c7-graphite2.  It is not fixed yet.

CVE-2017-5436 was fixed by r438984.

security/vuxml: back out r438981 as I've confused already extracted directory

security/vuxml: icu 59.1 doesn't have the fix

security/vuxml: oops, forgot PORTEPOCH from r418152

security/vuxml: mark icu < 59.1 as vulnerable

security/vuxml: mark old sndfile/samplerate/tiff as vulnerable

Document cURL vulnerability

security/vuxml: mark some firefox < 53 bundled deps as vulnerable

security/vuxml: mark firefox < 53 as vulnerable

13 vulnerabilities affecting 67 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities