security/vuxml: add xwayland-devel to 62bb32d7090f list

security/vuxml: Document xorg-server and xwayland recent vulnerabilities

Sponsored by:	Beckhoff Automation GmbH & Co. KG

security/vuxml: document electron{26,27} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.5,
		https://github.com/electron/electron/releases/tag/v27.2.2

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document OpenSSL ppc vulnerability

security/vuxml: add www/*chromium < 120.0.6099.216

Obtained
from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html

security/vuxml: Fix copypasta typo

security/vuxml: Document QtNetwork buffer overflow

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17,
6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before
6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer
overflow check.

Base Score:	9.8 CRITICAL
Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

security/vuxml: add databases/mantis-php* < 2.25.8

Obtained from https://mantisbt.org/bugs/changelog_page.php?version_id=370

PR:		276146

security/vuxml: add www/*chromium < 120.0.6099.199

Obtained
from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html

security/vuxml: document electron27 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.2.1

security/vuxml: document electron26 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.4

security/vuxml: add FreeBSD SA released on 2023-12-19

FreeBSD-SA-23:19.openssl affects all supported releases of FreeBSD.

FreeBSD 12.4 reached its end of life at the end of December 2023.  Users
are encouraged to either implement the documented workaround or leverage
an up to date version of OpenSSH from the ports/pkg collection.

security/vuxml: add 2024 entity

security/vuxml: unexpand spaces for gitea 482bb980-99a3-11ee-b5f7-6bd56600d90c

security/vuxml: extend openvpn vuln entry to openvpn-devel < g20231109,1

Security:	2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security:	CVE-2023-46849
Security:	CVE-2023-46850

security/vuxml: Add www/qt5-webengine

qt5-webengine < 5.15.16.p5_2 is also affected by the following VuXML
IDs:

- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6

security/vuxml: Add www/qt6-webengine

qt6-webengine < 6.6.1_1 is also affected by the following VuXML IDs:

- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6

devel/zookeeper: Update version 3.8.1=>3.8.3

- Fixes critical security vulnerability
- Return to pool
- Add entry in vuxml

PR:		275999
Approved by:	submitter is maintainer

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.3,
		https://github.com/electron/electron/releases/tag/v27.2.0

www/gitea: Update version 1.21.0=>1.21.3

- Add relevant vuxml entry
- Move pkg-message to SUB_FILES as we are using PREFIX

Changelog: https://blog.gitea.com/release-of-1.21.3/

PR:		275742
Approved by:	submitter is maintainer

security/vuxml: document nebula vulnerability

security/vuxml: add www/*chromium < 120.0.6099.129

Obtained
from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html

security/vuxml: add security/putty[-nogtk] < 0.80 'Terrapin' vulnerability

Security:	91955195-9ebb-11ee-bc14-a703705db3a6
Security:	CVE-2023-48795

security/vuxml: add an entry for slurm-wlm

security/vuxml: add CouchDB CVE details

Security:	CVE-2023-26268
Sponsored by:	SkunkWerks, GmbH

security/vuxml: document gitlab vulnerabilities

security/vuxml: adjust 12.4 range of FreeBSD SA-23:17.pf

Similar to what I did in 4826396e5d1555b9eebf58cac290490b24bf1243,
adjust the 12.4 releases affected by FreeBSD SA-23:17.pf.

There is no 100% correct way to encode this issue in vuxml.  Since the
issue only affects pf.ko, freebsd-update does not rebuild the kernel.

PR:		275743
Reported by:	martin@lispworks.com

security/vuxml: add www/*chromium < 120.0.6099.109

Obtained
from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html

security/vuxml: add FreeBSD SA released on 2023-12-12

FreeBSD-SA-23:18.nfsclient affects FreeBSD 14.0 and 13.2.

security/vuxml: mark xorg-server < 21.1.10,1 as vulnerable

security/vuxml: add www/*chromium < 120.0.6099.62

Obtained
from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html

secuirty/vuxml: Remove duplicate entry

A previous entry for CVE-2023-41913 was added in
8c6ee1a1c2df0d7a769c1fd50f0366ded3798e86

PR:		275620
Reported by:	eugen@
Fixes:		eea55ca7b5c621fd4f032b1f256b8472fbae2b15

security/vuxml: Record kafka vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Apache
ZooKeeper.

Note that this only affects SASL Quorum Peer authentication which is
not enabled by default.

 Base Score:	9.1 CRITICAL
 Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

PR:	275611

security/vuxml: Record strongswan buffer overflow

strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated
remote code execution via a DH public value that exceeds the internal buffer in
charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can
occur via a crafted IKE_SA_INIT message.

NVD score not yet provided.

PR:	275620

security/vuxml: document electron25 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.8

security/vuxml: correct last SA's affected range

FreeBSD-SA-23:17.pf only affects the kernel, not userland.  The first
patch level of the kernel without the vulnerability is 13.2_4, not
13.2_7.

Reported by:	dvl

security/vuxml: add FreeBSD SA released on 2023-12-05

FreeBSD-SA-23:17.pf affects all supported releases (12.4, 13.2, 14.0).

security/vuxml: Add Varnish Cache vulnerability

security/vuxml: Add www/qt6-webengine

qt6-webengine < 6.6.1 is also affected by the following VuXML IDs:
- 6d9c6aae-5eb1-11ee-8290-a8a1599412c6
- 07ee8c14-68f1-11ee-8290-a8a1599412c6
- a1e27775-7a61-11ee-8290-a8a1599412c6
- 0da4db89-84bf-11ee-8290-a8a1599412c6

security/vuxml: document gitlab vulnerabilities

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.7,
		https://github.com/electron/electron/releases/tag/v26.6.2

security/vuxml: add www/*chromium < 119.0.6045.199

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html

security/vuxml: Add devel/cmake-core

VuXML ID d6c19e8c-6806-11ee-9464-b42e991fc52e also affects the bundled
libcurl in devel/cmake-core < 3.27.8.

security/vuxml: Document MariaDB vulnerability

security/vuxml: Add www/qt5-webengine

VuXML ID 0da4db89-84bf-11ee-8290-a8a1599412c6 also affects
www/qt5-webengine < 5.15.16.p5

security/vuxml: document strongSwan vulnerability CVE-2023-41913

Security:	a62c0c50-8aa0-11ee-ac0d-00e0670f2660
Security:	CVE-2023-41913

security/vuxml: document electron use after free in Garbage Collection

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.6,
		https://github.com/electron/electron/releases/tag/v26.6.1

security/vuxml: add www/*chromium < 119.0.6045.159

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html

security/vuxml: document electron use after free in WebAudio

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.5,
		https://github.com/electron/electron/releases/tag/v26.6.0

security/vuxml: 2.6.0 <= openvpn < 2.6.7 vulnerabilities

Related to:

PR:		275055
Security:	2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security:	CVE-2023-46849
Security:	CVE-2023-46850

This specifically documents < 2.6.7_1 in order to collect the
regression fix for https://github.com/OpenVPN/openvpn/issues/449
which was a bug newly introduced into 2.6.7.

security/vuxml: Record typo3-1{12} vulnerabilities

PR: 275073 275074

security/vuxml: add issues for PostgreSQL

https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.4,
		https://github.com/electron/electron/releases/tag/v26.5.0

security/vuxml: Document libsndfile vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2022-33065

security/vuxml: add www/*chromium < 119.0.6045.123

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html

security/vuxml: Document OpenSSL vulnerability

security/vuxml: add FreeBSD SAs released on 2023-11-08

FreeBSD-SA-23:15.stdio affects 12.4 and 13.2
FreeBSD-SA-23:16.cap_net affects 13.2

security/vuxml: document vorbis-tools vulnerability

PR:		274900
Reported by:	diizzy

security/vuxml: document optipng vulnerability

PR:		274822
Reported by:	Thomas Hurst <tom@hur.st>

security/vuxml: add www/*chromium < 119.0.6045.105

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html

security/vuxml: add phpmyfaq < 3.2.2

security/vuxml: Add open-vm-tools vulnerabilities

Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: added gitlab vulnerabilities

security/vuxml: Mark zeek < 6.0.2 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v6.0.2

This release fixes the following potential DoS vulnerabilities:

 - A specially-crafted SSL packet could cause Zeek to leak memory
   and potentially crash.

 - A specially-crafted series of FTP packets could cause Zeek to
   log entries for requests that have already been completed, using
   resources unnecessarily and potentially causing Zeek to lose
   other traffic.

 - A specially-crafted series of SSL packets could cause Zeek to

security/vuxml: add www/*chromium < 118.0.5993.117

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_24.html

security/vuxml: mark xorg-server < 21.1.9,1 as vulnerable

security/vuxml: Register multiple www/squid vulnerabilities

Denial of Service in FTP
	Base Score:	8.6
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Request/Response smuggling in HTTP/1.1 and ICAP
	Base Score:	9.3
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Denial of Service in HTTP Digest Authentication
	Base Score: 9.9
	Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

security/vuxml: Document OpenSSL vulnerability

security/vuxml: Document MySQL vulnerabilities

security/vuxml: security/vuxml: Document www/rt44 and www/rt50 vulnerabilities

security/vuxml: document electron use after free in site isolation

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.2,
	 	https://github.com/electron/electron/releases/tag/v26.4.1

security/vuxml: Document Apache httpd vulnerabilities

security/vuxml: add games/moonlight-embedded vulnerability

PR:		274452
Reported by:	Armin Zhu <lisp_25689@163.com>

security/vuxml: Document Jenkins Security Advisory 2023-10-18

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Roundcube vulnerability

security/vuxml: Document possible bypassing Unix socket permissions in redis

security/vuxml: Document a vulnerability in textproc/libcue

PR:	274413

security/vuxml: Document HTTP/2 DoS vulnerability in net/traefik

security/vuxml: Update version range for samba413 vulnerabilities

Security fixes were back-ported from Samba 4.6.11 to samba413-4.13.17_6
in fe495574527e3f97cbb57438f8c468fad8842e9d.

PR:		273595
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document libXpm recent CVEs

PR:	274266

security/vuxml: Document libX11 recent CVEs

PR:	274266

security/vuxml: add www/*chromium < 118.0.5993.70

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html

security/vuxml: document electron25 use after free in extensions

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.1

security/vuxml: Fix bca498407bf9e529936ebb68e9ca257bdd1428de

The pkg audit result before the fix:
curl-8.4.0 is vulnerable:
  curl -- SOCKS5 heap buffer overflow
  CVE: CVE-2023-38545
  WWW:
https://vuxml.FreeBSD.org/freebsd/d6c19e8c-6806-11ee-9464-b42e991fc52e.html

1 problem(s) in 1 installed package(s) found.

security/vuxml: Fix description body

Keep the original description body for "make newentry" without parameters.

security/vuxml: register ftp/curl heap buffer overflow

Severity: High
CVE-2023-38545 reserved:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38545

security/vuxml: add h2o-devel vuln details

Security:	CVE-2023-44487
Sponsored by:	SkunkWerks, GmbH

security/vuxml: Document Django multiple vulnerabilities

security/vuxml: add entry for recent libspf2 CVE-2023-42118

PR:	274215

security/vuxml: add www/*chromium < 117.0.5938.149

Obtained
from:	https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop.html

security/vuxml: add FreeBSD SAs released on 2023-10-03

FreeBSD-SA-23:12.msdosfs affects 12.4 and 13.2
FreeBSD-SA-23:13.capsicum affects 13.2
FreeBSD-SA-23:14.smccc affects 13.2

security/vuxml: fix validation errors

Fix whitespace errors in vid 6e0ebb4a-5e75-11ee-a365-001b217b3468
introduced by commit 36a838e202256d5a528abfc8ff6a66ca7ce4d148.

security/vuxml: Document mediawiki multiple vulnerabilities

security/vuxml: add libvpx to the entry

The libvpx port was already updated.
https://chromium.googlesource.com/webm/libvpx/+log/v1.13.0..v1.13.1

Security: CVE-2023-5217

security/vuxml: Improve affected version ranges of composer vulnerability entry.

security/vuxml: Add devel/php-composer* vulnerability

security/vuxml: add www/*chromium < 117.0.5938.132

Obtained
from:	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

security/vuxml: fix long description warning

Eliminate an annoying warning from "make validate"

Modify entry 441e1e1a-27a5-11ee-a156-080027f5fec9 description and get rid of
empty lines and some expendable words. vuxml.freebsd.org prints all the lines
joined together.

security/vuxml: document electron heap buffer overflow in vp8 encoding

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.25,
		https://github.com/electron/electron/releases/tag/v24.8.5,
		https://github.com/electron/electron/releases/tag/v25.8.4