Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1_5 Matthias Fechner (mfechner) security/vuxml: document gitlab-ce vulnerabilities 1.1_5 Fernando Apesteguía (fernape) security/vuxml: Document unbound vulnerability
PR: 266654
Reported by: Herbert J. Skuhra <herbert@gojira.at>
Security: CVE-2022-3204 1.1_5 Ashish SHUKLA (ashish) security/vuxml: Document vulnerabilities for Matrix clients 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 106.0.5249.61
Obtained
from: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html 1.1_5 Tobias C. Berner (tcberner) security/vuxml: document vulnerability in expat < 2.4.9
Rhodri James discovered a heap use-after-free vulnerability in the
doContent function in Expat, an XML parsing C library, which could
result in denial of service or potentially the execution of arbitrary
code, if a malformed XML file is processed.
https://www.debian.org/security/2022/dsa-5236
https://nvd.nist.gov/vuln/detail/CVE-2022-40674
Security: CVE-2022-40674 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document exposure of sensitive information in cache manager of
squid 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document potential remote code execution vulnerability in redis 1.1_5 Nuno Teixeira (eduardo) Boris Korzun security/vuxml: Document Grafana vulnerabilies
PR: 266530 1.1_5 Craig Leres (leres) security/vuxml: Mark zeek < 5.0.2 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v5.0.2
The potential DoS vulnerabilities include:
- Fix a possible overflow and crash in the ICMP analyzer when
receiving a specially crafted packet
- Fix a possible overflow and crash in the IRC analyzer when
receiving a specially crafted packet
- Fix a possible overflow and crash in the SMB analyzer when
receiving a specially crafted packet
- Fix two possible crashes when converting IP headers for output
via the raw_packet event
Reported by: Tim Wojtulewicz 1.1_5 Romain Tartière (romain) security/vuxml: Document vulnerability in PuppetDB 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 105.0.5195.125
Obtained
from: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html 1.1_5 Ashish SHUKLA (ashish) security/vuxml: Document vulnerability for net-im/dendrite 1.1_5 Dmitri Goutnik (dmgk) Stefan Bethke security/vuxml: Document Gitea vulnerabilities
PR: 266359 1.1_5 Wen Heping (wen) security/vuxml: Document python multiple vulnerabilities 1.1_5 Dmitri Goutnik (dmgk) security/vuxml: Document Go vulnerabilities 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 105.0.5195.102
Obtained from:
https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html 1.1_5 Ashish SHUKLA (ashish) security/vuxml: Unbreak vuxml build
Fix malformed CVE entry which I added in 46eb6e07f37e2. Thanks to dbaio@
for pointing it out. 1.1_5 Neel Chauhan (nc) Ralf van der Enden dns/powerdns-recursor: Add VUXML entry 1.1_5 Nuno Teixeira (eduardo) security/vuxml: Document Grafana vulnerabilities
- vuxml: CVE-2022-31176 - Unauthorized file disclosure
PR: 266128 1.1_5 Ashish SHUKLA (ashish) security/vuxml: Document Matrix clients' vulnerabilities 1.1_5 Rene Ladan (rene) security/vuxml: document www/chromium < 105.0.5195.52
Obtained
from: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:13.zlib 1.1_5 Matthias Fechner (mfechner) security/vuxml: document gitlab-ce vulnerabilities 1.1_5 Craig Leres (leres) security/vuxml: Mark zeek < 5.0.1 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v5.0.1
The potential DoS vulnerabilities include:
- Fix a possible overflow and crash in the ARP analyzer when
receiving a specially crafted packet.
- Fix a possible overflow and crash in the Modbus analyzer when
receiving a specially crafted packet.
- Fix two possible crashes when converting IP headers for output
via the raw_packet event.
- Fix an abort related to an error related to the ordering of
record fields when processing DNS EDNS headers via events
Reported by: Tim Wojtulewicz 1.1_5 Ashish SHUKLA (ashish) security/vuxml: update Dendrite vulnerability
- add CVE information 1.1_5 Bernard Spil (brnrd) security/vuxml: Document MariaDB vulnerabilities 1.1_5 Matthias Fechner (mfechner) security/vuxml: Document gitlab vulnerability 1.1_5 Wen Heping (wen) security/vuxml: Document drupal9 multiple vulnerabilities 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 104.0.5112.101
Obtained
from: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html 1.1_5 Ashish SHUKLA (ashish) security/vuxml: Document dendrite vulnerability 1.1_5 Nuno Teixeira (eduardo) security/vuxml: Document Apache Tomcat vulnerability
CVE-2022-34305 Apache Tomcat - XSS in examples web application
PR: 265821
Approved by: riggs (ports-secteam) 1.1_5 Guido Falsi (madpilot) security/vuxml: Document xfce4-tumbler vulnerability.
The vulnerability details are undisclosed at present. 1.1_5 Danilo G. Baio (dbaio) security/vuxml: Document varnish cache vulnerability 1.1_5 Philip Paeps (philip) security/vuxml: correct entry for FreeBSD SA-22:10.aio
The vulnerability reported in FreeBSD-SA-22:10.aio was corrected on the
stable/13 branch before releng/13.1 was created. Consequently, FreeBSD
13.1-RELEASE-p0 is not affected. 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:12.lib9p 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:11.vm 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:10.aio 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:09.elf 1.1_5 Rodrigo Osorio (rodrigo) security/vuxml: Document rsync client-side arbitrary file write vulnerability
PR: 265633 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document double free vulnerability in GnuTLS 1.1_5 Santhosh Raju (fox) security/vuxml: Document wolfSSL multiple vulnerabilities. 1.1_5 Nuno Teixeira (eduardo) Stefan Bethke security/vuxml: Document Gitea multiple vulnerabilities
PR: 265527 1.1_5 Bernard Spil (brnrd) security/vuxml: Document Unbound vulnerabilities 1.1_5 Nuno Teixeira (eduardo) Stefan Bethke security/vuxml: Document Gitea multiple vulnerabilities
- Add write check for creating Commit status
https://github.com/go-gitea/gitea/pull/20334
- Check for permission when fetching user controlled issues
https://github.com/go-gitea/gitea/pull/20196
PR: 265526 1.1_5 Wen Heping (wen) security/vuxml: Document Django multiple vulnerabilities 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 104.0.5112.79
Obtained from:
https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html 1.1_5 Dmitri Goutnik (dmgk) security/vuxml: Document Go vulnerability 1.1_5 Matthias Fechner (mfechner) security/vuxml: Document www/gitlab-ce vulnerabilities 1.1_5 Nuno Teixeira (eduardo) Boris Korzun security/vuxml: Document new Grafana vulnerabilities
CVE-2022-31097 - Stored XSS
CVE-2022-31107 - OAuth Account Takeover
PR: 265330 1.1_5 Guido Falsi (madpilot) security/vuxml: Document new VirtualBox vulnerabilities.
PR: 265350 1.1_5 Bernard Spil (brnrd) security/vuxml: Document new MySQL vulnerabilities 1.1_5 Tobias C. Berner (tcberner) security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org> (Only the first 15 lines of the commit message are shown above 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 103.0.5060.134
Obtained
from: https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document potential remote code execution vulnerability in redis 1.1_5 Dmitri Goutnik (dmgk) security/vuxml: Document Go vulnerabilities 1.1_5 Brad Davis (brd) security/vuxml: document devel/git CVE-2022-29187 1.1_5 Joseph Mingrone (jrm) security/vuxml: Note that the 2022-07-08 Node.js entry was modified
Requested by: sunpoet 1.1_5 Dries Michiels (driesm) Robert Clausecker security/vuxml: document multimedia/py-mat2 CVE-2022-35410
PR: 265104 1.1_5 Matthias Fechner (mfechner) security/vuxml: document gitlab-ce vulnerabilities 1.1_5 Joseph Mingrone (jrm) security/vuxml: Remove extra dash in 2022-07-08 Node.js CVE name
Reported by: joneum 1.1_5 Joseph Mingrone (jrm) security/vuxml: Fix CVE Names in 2022-07-08 Node.js entry
Sponsored by: The FreeBSD Foundation 1.1_5 Joseph Mingrone (jrm) security/vuxml: Document Node.js July 7th 2022 Security Releases
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
Sponsored by: The FreeBSD Foundation 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 103.0.5060.114
Obtained
from: https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop.html 1.1_5 Bernard Spil (brnrd) security/vuxml: Add/update OpenSSL vulnerability
* Update the RSA key AVX512 vuln to 3.0.4 only
* Add new AES OCB vuln in 1.1.1q/3.0.5 1.1_5 Wen Heping (wen) security/vuxml: Fix a typo in previous commit of document django multiple
vulnerabilities 1.1_5 Wen Heping (wen) security/vuxml: Document Django multiple vulnerabilities 1.1_5 Bernard Spil (brnrd) security/vuxml: Document OpenSSL vulnerability 1.1_5 Wen Heping (wen) security/vuxml: Document mediawiki multiple vulnerabilities 1.1_5 Ashish SHUKLA (ashish) security/vuxml: Document vulnerability for net-im/py-matrix-synapse 1.1_5 Bernard Spil (brnrd) security/vuxml: Document cURL vulnerabilities 1.1_5 Li-Wen Hsu (lwhsu) security/vuxml: Fix vuxml build
<cvename> tag needs a valid CVE name
Fixes: 8f4091638ddd9e3c0484c5791359e58aa97b493a 1.1_5 Li-Wen Hsu (lwhsu) security/vuxml: Document Jenkins Security Advisory 2022-06-22
Sponsored by: The FreeBSD Foundation 1.1_5 Bernard Spil (brnrd) security/vuxml: Document OpenSSL vulnerability
* Pet `make validate`
* Fix spacing for 482456fb-e9af-11ec-93b6-318d1419ea39
* Add discovery date for 482456fb-e9af-11ec-93b6-318d1419ea39
using tor wiki page update date. 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 103.0.5060.53 1.1_5 Neel Chauhan (nc) Rafael Grether graphics/p5-Image-ExifTool: Add an vuxml entry for update 12.42
PR: 264618 1.1_5 Li-Wen Hsu (lwhsu) Hung-Yi Chen security/vuxml: Add CVE-2022-24766 for www/mitmproxy
PR: 264782 1.1_5 Yuri Victorovich (yuri) security/vuxml: Add vulnerability record for security/tor TROVE-2022-001[0] 1.1_5 Guido Falsi (madpilot) security/vuxml: Document XFCE libexo vulnerability. 1.1_5 Wen Heping (wen) security/vuxml: Document numpy vulnerabilities 1.1_5 Li-Wen Hsu (lwhsu) security/vuxml: Fix version range for 49adfbe5-e7d1-11ec-8fbd-d4c9ef517024
PR: 264589
Reported by: Jordan Ostreff <jordan@ostreff.info> 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 102.0.5005.115
Obtained
from: https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html 1.1_5 Bernard Spil (brnrd) security/vuxml: Document Apache httpd vulnerabilities 1.1_5 Dmitri Goutnik (dmgk) security/vuxml: Document Go vulnerabilities 1.1_5 Matthias Andree (mandree) security/vuxml: add e2fsprogs CVE-2022-1304 < 1.46.5_1
Security: CVE-2022-1304
Security: a58f3fde-e4e0-11ec-8340-2d623369b8b5 1.1_5 Matthias Fechner (mfechner) security/vuxml: Document gitlab vulnerabilities 1.1_5 Craig Leres (leres) security/vuxml: Mark zeek < 4.0.7 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v4.0.7
- Fix potential hang in the DNS analyzer when receiving a
specially-crafted packet. Due to the possibility of this happening
with packets received from the network, this is a potential DoS
vulnerability.
Reported by: Tim Wojtulewicz 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 102.0.5005.61
Obtained
from: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html 1.1_5 Bernard Spil (brnrd) security/vuxml: Add CVE numbers to latest MySQL vulnerabilities 1.1_5 Bernard Spil (brnrd) security/vuxml: Document MariaDB vulnerabilities 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Update and fix b2407db1-d79f-11ec-a15f-589cfc0f81b0
* security/clamav-lts is also vulnerable with them
* Fix range of security/clamav 1.1_5 Florian Smeets (flo) security/vuxml: Document ClamAV vulnerabilities 1.1_5 Dmitri Goutnik (dmgk) security/vuxml: Document Go vulnerability
While here, fix package names for the previous Go entry (we also have
go117 now). 1.1_5 Bernard Spil (brnrd) security/vuxml: Document curl vulnerabilities 1.1_5 Palle Girgensohn (girgen) security/vuxml: postgresql??-server vuln CVE-2022-1552 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 101.0.4951.64
Obtained
from: https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html 1.1_5 Matthew Seaman (matthew) security/vuxml: add sysutils/rsyslog8 heap buffer overflow
https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8 1.1_5 Dmitri Goutnik (dmgk) security/vuxml: Document devel/gogs vulnerability 1.1_5 Dmitri Goutnik (dmgk) Stefan Bethke security/vuxml: Document www/gitea vulnerability 1.1_5 Bernard Spil (brnrd) security/vuxml: Mark openssl-quictls vulnerable 1.1_5 Bernard Spil (brnrd) security/openssl: Security update to 1.1.1o
Security: fceb2b08-cb76-11ec-a06f-d4c9ef517024
MFH: 2022Q2
