security/vuxml: Document vulnerability in cloud-init version 20.4

https://bugs.launchpad.net/cloud-init/+bug/1911680

Reported by:	Mina Galic <me@igalic.co>

Document CVE-2020-25074 and CVE-2020-15275 for www/moinmoin

Document ghostscript9-agpl-base vulnerability committed in r544907

PR:		248580
Requested by:	joneum (ports-secteam)
Reported by:	VVD <vvd@unislabs.com>
MFH:		2021Q1
Security:	CVE-2020-15900

security/vuxml: document Node.js January 2021 Security Releases

https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/

Sponsored by:	Miles AS

Document gitlab vulnerability.

Document integer overflow in wavpack (CVE-2020-35738).

Document Jenkins Security Advisory 2021-01-13

Sponsored by:	The FreeBSD Foundation

Document phpmyfaq vulnerability

Document sudo CVE-2021-23239.

Document cairosvg vulnerability

Document gitlab vulnerabilities.

Document new vulnerabilities in www/chromium < 87.0.4280.141

Obtained
from:	https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html

security/vuxml: add dovecot CVE-2020-24386

PR:		252415
Submitted by:	Evilham <contact@evilham.com>
Relnotes:	https://dovecot.org/pipermail/dovecot-news/2021-January/000448.html

security/vuxml: Add entry for gitea < 1.13.1

PR:		252310
Submitted by:	maintainer

Document inspircd vulnerabilitiy

PR:		252291
Reported by:	Sadie Powell <sadie@witchery.services>

Document CVE-2020-0543 for Intel CPUs.

PR:		247197
Submitted by:	spam123@bitbert.com

Document new asterisk vulnerabilities.

Document vulns for powerdns and postsrsd

Reviewed by:	osa (mentor)
Approved by:	osa (mentor)
Differential Revision:	https://reviews.freebsd.org/D27706

Correct entries for mantis and libX11 (missing PORTEPOCH in package string).

PR:		251168
Submitted by:	zab@zltech.eu

Document vault issue

security/vuxml: Note FreeBSD 11.4 fix for CVE-2020-1971

Document jasper vulnerability

security/vuxml: Document net-im/py-matrix-synapse issue

PR:		251768
Submitted by:	contact@evilham.com
Security:	CVE-2020-26257

security/vuxml: Document p11-kit vulnerabilities

security/vuxml: Document Unbound/NSD vuln

security/vuxml: Update LibreSSL vuln

 * for 2020Q4 branch which is on 3.1

security/vuxml: Document LibreSSL vulnerability

security/vuxml: add 19 CVE entries related to www/glpi

PR:		251754
Submitted by:	Mathias Monnerville

security/vuxml: FreeBSD 11.4 is vulnerable to CVE-2020-1971

As noted in FreeBSD-SA-20:33.openssl, this vulnerability is also known
to affect OpenSSL versions included in FreeBSD 11.4.  However, the
OpenSSL project is only giving patches for that version to premium
support contract holders.  The FreeBSD project does not have access to
these patches and recommends FreeBSD 11.4 users to either upgrade to
FreeBSD 12.x or leverage up to date versions of OpenSSL in the ports/pkg
system. The FreeBSD Project may update this advisory to include FreeBSD
11.4 should patches become publicly available.

security/vuxml: add FreeBSD SA to OpenSSL entry

Reference FreeBSD-SA-20:33.openssl and note the fixed patch releases in
the recent OpenSSL entry.

security/vuxml: cURL vulnerabilities

security/vuxml: Document OpenSSL NULL pointer dereference

Document gitlab-ce vulnerabilities.

Document consul issue

PR:		251418
Submitted by:	brd

Document new vulnerabilities in www/chromium < 87.0.4280.88

- Unbreak build after previous commit

security/vuxml: Add entry for gitea < 1.13.0

PR:		251577
Submitted by:	maintainer

security/vuxml: add FreeBSD SA-20:32.rtsold

security/vuxml: add FreeBSD SA-20:31.icmp6

vuxml: document xorg-server vulnerabilities

Document new vulnerabilities in xorg-server and sub ports:
CVE-2020-14360 and CVE-2020-25712

These issues can lead to privileges elevations for authorized clients
on systems where the X server is running privileged.

vuxml: Add entry for nomad < 0.12.6

vuxml: Add entry for gitea < 1.12.6

security/vuxml: document Node.js November 2020 Security Releases

https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/

Sponsored by:	Miles AS

Document CVE-2020-28896 for mutt 2.0.2.

PR:		251278
Submitted by:	dereks@lifeofadishwasher.com
Security:	CVE-2020-28896

VuXML: document mozjpeg and libjpeg-turbo recent vulnerabilities

PR:		250190
Submitted by:	daniel.engberg.lists@pyret.net

security/vuxml: add entries for databases/mantis

PR:		251141
Submitted by:	Zoltan Alexanderson Besse <zab@zltech.eu>

security/vuxml: Document lang/go vulnerabilities

security/vuxml: New entry for sysutils/py-salt vulnerabilities

There are three security vulnerabilities described for sysutils/py-salt
in version 3002[1]: CVE-2020-16846, CVE-2020-17490, and VE-2020-25592.

[1] https://docs.saltstack.com/en/latest/topics/releases/3002.1.html

It is planned to update the port sysutils/py-salt soon, see PR 251013

Reported by:	michael.glaus@hostpoint.ch (in PR 251013)
Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D27189

Document vulnerability in editors/openoffice-4 < 4.1.8 and openoffice-devel

CVE-2020-13958 Unrestricted actions leads to arbitrary code execution
in crafted documents

A vulnerability in Apache OpenOffice scripting events allows an
attacker to construct documents containing hyperlinks pointing to
an executable on the target users file system. These hyperlinks can
be triggered unconditionally. In fixed versions no internal protocol
may be called from the document event handler and other hyperlinks
require a control-click.

<https://www.openoffice.org/security/cves/CVE-2020-13958.html>

Prefer graphics/ligvrsvg2-rust over graphics/librsvg2

- switch to the more modern version of librsvg2 on architectures
  supporting rust
- this will fix some graphical issues on these architectures

PR:		250276
Exp-run by:	antoine
Submitted by:	tobik
Differential Revision:	https://reviews.freebsd.org/D18878

Fix CVE name for 07c7ae7a-224b-11eb-aa6e-e0d55e2a8bf9

Sponsored by:	The FreeBSD Foundation

Document vulnerability in textproc/raptor2

From [1], [2], [3]:
raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF
Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML
writer, leading to heap-based buffer overflows (sometimes seen in
raptor_qname_format_as_xml).

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18926
[2] https://www.debian.org/security/2020/dsa-4785
[3] https://www.openwall.com/lists/oss-security/2017/06/07/1

PR:		250971
Security:	CVE-2017-18926

security/vuxml: Document www/py-notebook issue

Fix open redirect vulnerability GHSA-c7vm-f5p4-8fqh (CVE to be assigned).

security/vuxml: Document addl. MariaDB vulns

Document asterisk vulnerabilities.

Document new vulnerabilities in www/chromium < 86.0.4240.183

Obtained
from:	https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html

Document gitlab vulnerabilities.

Add entry for wordpress

Sponsored by:	Netzkommune GmbH

Add an entry about recent Samba vulnerabilities

Security:	CVE-2020-14318
		CVE-2020-14323
		CVE-2020-14383

security/vuxml: Document stack overflow in tmux

PR:		250737

security/vuxml: Add entry for multimedia/motion

Follow up commit for 553525.

For some reason, "Use MHD function for url decoding" actually means fixing
CVE-2020-26566

PR:	250660

print/freetype2: document vulnerability

PR:		250375
Security:	CVE-2020-15999

security/vuxml: Document 2020Q4 MySQL vulnerabilities

Document new vulnerabilities in www/chromium < 86.0.4240.111

Obtained
from:	https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html

security/vuxml: add powerdns-recursor

PR:		250318
Submitted by:	Ralf van der Enden <tremere@cainites.net>
Reported by:	michael.glaus@hostpoint.ch
Sponsored by:	SkunkWerks, GmbH

security/vuxml: Document MariaDB vulnerabilities

security/vuxml: Update entry date for the last issue added (r552574)

security/vuxml: Document net-im/py-matrix-synapse issue

PR:		249948
Submitted by:	Sascha Biberhofer <ports@skyforge.at>
Security:	CVE-2020-26891

Add entry for drupal7

Sponsored by:	Netzkommune GmbH

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb20-58.html

Document rails vulnerability

security/vuxml: add CVEs for www/payara

- CVE-2020-6950 Eclipse Mojarra vulnerable to path trasversal flaw
  via either loc/con parameters
- CVE-2019-12086 A Polymorphic Typing issue was discovered in
  FasterXML jackson-databind 2.x before 2.9.9
- some more

PR:		250207
Submitted by:	Dmytro Bilokha <dmytro@posteo.net>

security/vuxml: Mark zeek < 3.0.11 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v3.0.11

A memory leak in multipart MIME code has potential for remote
exploitation and cause for Denial of Service via resource exhaustion.

While we're here fix missing cite for "zeek < 3.0.10" entry.

Document new vulnerabilities in www/chromium < 86.0.4240.75

Obtained
from:	https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html

Document libexif vulnerability

vuxml: fix version check in r551354

vuxml: document deskutils/kdeconnect-kde vulnerability

KDE Project Security Advisory
=============================

Title:           KDE Connect: packet manipulation can be exploited in a Denial
of Service attack
Risk Rating:     Important
CVE:             CVE-2020-26164
Versions:        kdeconnect <= 20.08.1
Author:          Albert Vaca Cintora <albertvaka@gmail.com>
Date:            2 October 2020

Overview
========

vuxml: document vulnerability in devel/upnp

Security:	CVE-2020-13848

Document gitlab vulnerabilities.

Add recent tt-rss issues.

PR:		249472
Submitted by:	Derek Schrock (tt-rss's maintainer)
MFC after:	1 day
Security:	https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799

security/vuxml: Add CVE-2020-1945: Apache Ant insecure temporary file
vulnerability

PR:		248098
Submitted by:	mikael

security/vuxml: add entry dns/powerdns below 4.3.1

- CVE-2020-17482

PR:		249560
Submitted by:	Ralf van der Enden <tremere@cainites.net>
Relnotes:	https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html

vuxml: Update pango entry for CVE-2019-1010238

Update the pango entry for CVE-2019-1010238.
Since the fix to pango wasn't applied properly the first time around, the
pango version with the fix needed to be bumpt in the vuxml entry.

Document new vulnerabilities in www/chromium < 85.0.4183.121

Obtained
from:	https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html

security/vuxml: document libxml2 vulnerabilities

PR:		249386

security/vuxml: Document net-im/py-matrix-synapse issue

PR:		249375
Submitted by:	Denis Kasak <dkasak@termina.org.uk>
Submitted by:	Sascha Biberhofer <ports@skyforge.at> (earlier version)

- Document python35 multiple vulnerabilities

PR:		249187

Add an entry about CVE-2020-1472 - Unauthenticated domain takeover via netlogon
("ZeroLogon")

Security:	CVE-2020-1472

security/vuxml: Document Nextcloud 19.0.1 vuln

www/webkit2-gtk3: Multiple Vulnerabilities (vuxml entry)

PR:		247892
Submitted by:	rob2g2 <spam123@bitbert.com>
Security:	CVE-2020-9802
Security:	CVE-2020-9803
Security:	CVE-2020-9805
Security:	CVE-2020-9806
Security:	CVE-2020-9807
Security:	CVE-2020-9843
Security:	CVE-2020-9850
Security:	CVE-2020-13753

security/vuxml: document Node.js September 2020 Security Releases

https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/

Sponsored by:	Miles AS

security/vuxml: add FreeBSD SA-20:30.ftpd

security/vuxml: add FreeBSD SA-20:29.bhyve_svm

security/vuxml: add FreeBSD SA-20:28.bhyve_vmcs

security/vuxml: add FreeBSD SA-20:27.ure

Document rails vulnerability

security/vuxml: Mark zeek < 3.0.10 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v3.0.10

Memory leak has potential for remote DOS via resource exhaustion.

Document new vulnerabilities in www/chromium < 85.0.4183.102

Obtained
from:	https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html

Sigh, fix previous entry as it's already documented, combine the information
into previous entry.

Document mpd multiple vulnerabilities.