Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1_4 tcberner print/freetype2: document vulnerability
PR: 250375
Security: CVE-2020-15999 1.1_4 brnrd security/vuxml: Document 2020Q4 MySQL vulnerabilities 1.1_4 rene Document new vulnerabilities in www/chromium < 86.0.4240.111
Obtained
from: https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html 1.1_4 dch security/vuxml: add powerdns-recursor
PR: 250318
Submitted by: Ralf van der Enden <tremere@cainites.net>
Reported by: michael.glaus@hostpoint.ch
Sponsored by: SkunkWerks, GmbH 1.1_4 brnrd security/vuxml: Document MariaDB vulnerabilities 1.1_4 dbaio security/vuxml: Update entry date for the last issue added (r552574) 1.1_4 dbaio security/vuxml: Document net-im/py-matrix-synapse issue
PR: 249948
Submitted by: Sascha Biberhofer <ports@skyforge.at>
Security: CVE-2020-26891 1.1_4 joneum Add entry for drupal7
Sponsored by: Netzkommune GmbH 1.1_4 jkim Document the latest Flash Player vulnerability.
https://helpx.adobe.com/security/products/flash-player/apsb20-58.html 1.1_4 sunpoet Document rails vulnerability 1.1_4 pi security/vuxml: add CVEs for www/payara
- CVE-2020-6950 Eclipse Mojarra vulnerable to path trasversal flaw
via either loc/con parameters
- CVE-2019-12086 A Polymorphic Typing issue was discovered in
FasterXML jackson-databind 2.x before 2.9.9
- some more
PR: 250207
Submitted by: Dmytro Bilokha <dmytro@posteo.net> 1.1_4 leres security/vuxml: Mark zeek < 3.0.11 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v3.0.11
A memory leak in multipart MIME code has potential for remote
exploitation and cause for Denial of Service via resource exhaustion.
While we're here fix missing cite for "zeek < 3.0.10" entry. 1.1_4 rene Document new vulnerabilities in www/chromium < 86.0.4240.75
Obtained
from: https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html 1.1_4 sunpoet Document libexif vulnerability 1.1_4 tcberner vuxml: fix version check in r551354 1.1_4 tcberner vuxml: document deskutils/kdeconnect-kde vulnerability
KDE Project Security Advisory
=============================
Title: KDE Connect: packet manipulation can be exploited in a Denial
of Service attack
Risk Rating: Important
CVE: CVE-2020-26164
Versions: kdeconnect <= 20.08.1
Author: Albert Vaca Cintora <albertvaka@gmail.com>
Date: 2 October 2020
Overview
========
(Only the first 15 lines of the commit message are shown above 1.1_4 tcberner vuxml: document vulnerability in devel/upnp
Security: CVE-2020-13848 1.1_4 mfechner Document gitlab vulnerabilities. 1.1_4 thierry Add recent tt-rss issues.
PR: 249472
Submitted by: Derek Schrock (tt-rss's maintainer)
MFC after: 1 day
Security: https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799 1.1_4 pi security/vuxml: Add CVE-2020-1945: Apache Ant insecure temporary file
vulnerability
PR: 248098
Submitted by: mikael 1.1_4 pi security/vuxml: add entry dns/powerdns below 4.3.1
- CVE-2020-17482
PR: 249560
Submitted by: Ralf van der Enden <tremere@cainites.net>
Relnotes: https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html 1.1_4 zeising vuxml: Update pango entry for CVE-2019-1010238
Update the pango entry for CVE-2019-1010238.
Since the fix to pango wasn't applied properly the first time around, the
pango version with the fix needed to be bumpt in the vuxml entry. 1.1_4 rene Document new vulnerabilities in www/chromium < 85.0.4183.121
Obtained
from: https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html 1.1_4 tcberner security/vuxml: document libxml2 vulnerabilities
PR: 249386 1.1_4 dbaio security/vuxml: Document net-im/py-matrix-synapse issue
PR: 249375
Submitted by: Denis Kasak <dkasak@termina.org.uk>
Submitted by: Sascha Biberhofer <ports@skyforge.at> (earlier version) 1.1_4 fluffy - Document python35 multiple vulnerabilities
PR: 249187 1.1_4 timur Add an entry about CVE-2020-1472 - Unauthenticated domain takeover via netlogon
("ZeroLogon")
Security: CVE-2020-1472 1.1_4 brnrd security/vuxml: Document Nextcloud 19.0.1 vuln 1.1_4 mandree www/webkit2-gtk3: Multiple Vulnerabilities (vuxml entry)
PR: 247892
Submitted by: rob2g2 <spam123@bitbert.com>
Security: CVE-2020-9802
Security: CVE-2020-9803
Security: CVE-2020-9805
Security: CVE-2020-9806
Security: CVE-2020-9807
Security: CVE-2020-9843
Security: CVE-2020-9850
Security: CVE-2020-13753 1.1_4 bhughes security/vuxml: document Node.js September 2020 Security Releases
https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/
Sponsored by: Miles AS 1.1_4 philip security/vuxml: add FreeBSD SA-20:30.ftpd 1.1_4 philip security/vuxml: add FreeBSD SA-20:29.bhyve_svm 1.1_4 philip security/vuxml: add FreeBSD SA-20:28.bhyve_vmcs 1.1_4 philip security/vuxml: add FreeBSD SA-20:27.ure 1.1_4 sunpoet Document rails vulnerability 1.1_4 leres security/vuxml: Mark zeek < 3.0.10 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v3.0.10
Memory leak has potential for remote DOS via resource exhaustion. 1.1_4 rene Document new vulnerabilities in www/chromium < 85.0.4183.102
Obtained
from: https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html 1.1_4 delphij Sigh, fix previous entry as it's already documented, combine the information
into previous entry. 1.1_4 delphij Document mpd multiple vulnerabilities. 1.1_4 eugen Document remotely exploitable crash in the mpd5.
Reported by: chennan at SourceForge
Obtained from: http://mpd.sourceforge.net/doc5/mpd4.html#4 1.1_4 tijl Document Mbed TLS 2020-09-1 and 2020-09-2.
Security: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1
Security: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2 1.1_4 tijl Document GNUTLS-SA-2020-09-04.
Security: https://gnutls.org/security-new.html#GNUTLS-SA-2020-09-04 1.1_4 sunpoet Update jasper vulnerability 1.1_4 sunpoet Document Django vulnerability 1.1_4 adamw security/vuxml: Fix gnupg version range specification
Thanks to swills for pointing me to the error here.
PR: 249110
Reported by: jjuanino gmail 1.1_4 lwhsu Fix format 1.1_4 adamw vuxml: Add entry for gnupg 2.2.21 - 2.2.22 1.1_4 philip security/vuxml: add FreeBSD SA-20:26.dhclient 1.1_4 philip security/vuxml: add FreeBSD SA-20:25.sctp 1.1_4 philip security/vuxml: add FreeBSD SA-20:24.ipv6 1.1_4 mfechner Document gitlab vulnerabilities. 1.1_4 dmgk security/vuxml: Document lang/go vulnerability 1.1_4 tcberner security/vuxml: document vulnerability in ark 1.1_4 leres security/vuxml: Mark php72, php73, and php74 vulnerable as per:
https://www.php.net/ChangeLog-7.php#PHP_7_4
https://www.php.net/ChangeLog-7.php#PHP_7_3
https://www.php.net/ChangeLog-7.php#PHP_7_2
The phar_parse_zipfile function had [a] use-after-free vulnerability
because of [a] mishandling of the actual_alias variable.
Security: CVE-2020-7068 1.1_4 rene Document new vulnerabilities in www/chromium < 85.0.4183.83 1.1_4 sunpoet Document jasper vulnerability 1.1_4 zeising vuxml: Document xorg-server and libX11 vulns
Document newly announced vulnerabilities in libX11 and xorg-server. 1.1_4 mfechner Updated entry for gitlab to clarify that the previously reported version does
not fix the problem.
Please also see this upstream issue:
https://gitlab.com/gitlab-org/gitlab/-/issues/233881 1.1_4 mandree vuln.xml: add chrony < 3.5.1 pidfile symlink vulnerability
Security: 719f06af-e45e-11ea-95a1-c3b8167b8026
Security: CVE-2020-14367 1.1_4 freqlabs security/vuxml: Document sysutils/openzfs-kmod issues
PR: 248787
Reported by: Andrew Walker
Reviewed by: wg
Approved by: wg (ports)
Sponsored by: iXsystems, Inc.
Differential Revision: https://reviews.freebsd.org/D26121 1.1_4 dmgk security/vuxml: Document textproc/elasticsearch6 vulnerability
PR: 248761
Submitted by: Juraj Lutter <juraj@lutter.sk> (maintainer) 1.1_4 zeising vuxml: Document dns/adns security issues
Document several securiy issues in dns/adns.
While here, fix whitespace in adjacent entries, as reported by make
validate. 1.1_4 lme Document icingaweb2 vulnerability 1.1_4 sunpoet Document curl vulnerability 1.1_4 wen - Update a cvename entry 1.1_4 wen - Document python37 and python36 multiple vulnerabilities
PR: 248751
Submitted by: mwalker@carbonhouse.com 1.1_4 zeising vuxml: Document security/trousers issues
Reapply r545263, but do it properly this time.
Document security issues in security/trousers. 1.1_4 gjb Revert r545263, which excludes the package name, version(s) affected,
and includes "INSERT BLOCKQUOTE URL HERE" for a URL, suggesting the
'make validate' target was clearly not executed. 1.1_4 zeising vuxml: Document security issues in security/trousers 1.1_4 rene Document new vulnerability in www/chromium < 84.0.4147.135 1.1_4 flo Document ceph vulnerability
PR: 248673
Submitted by: Willem Jan Withagen <wjw@digiware.nl> 1.1_4 lwhsu Document Jenkins Security Advisory 2020-08-17
Sponsored by: The FreeBSD Foundation 1.1_4 rodrigo security/vuxml: Update rsync issues with zlib 1.1_4 swills Document py-ecdsa issue 1.1_4 dbaio security/vuxml: Document net-mgmt/snmptt issue
PR: 248162
Reported by: nistor@snickers.org 1.1_4 ler security/vuxml: mail/dovecot multiple vulnerabilities. 1.1_4 mandree graphics/ilmbase, graphics/openexr: mention security fixes in v2.5.3
No CVE numbers available at this time.
Security: b1d6b383-dd51-11ea-a688-7b12871ef3ad 1.1_4 lwhsu Document Jenkins Security Advisory 2020-08-12
Sponsored by: The FreeBSD Foundation 1.1_4 rene Document new vulnerabilities in www/chromium < 84.0.4147.125 1.1_4 romain Document puppetdb5 vulnerability 1.1_4 danilo - Document ftp/bftpd vulnerabilities 1.1_4 pi security/vuxml: add www/trafficserver entry for CVE-2020-9494
PR: 247713
Submitted by: spam123@bitbert.com 1.1_4 brnrd security/vuxml: www/mod_http2 also vulnerable to latest Apache httpd vulns 1.1_4 brnrd security/vuxml: Add Apache httpd vulnerabilities 1.1_4 dmgk security/vuxml: Document lang/go vulnerability 1.1_4 mfechner Document gitlab-ce vulnerabilities. 1.1_4 philip security/vuxml: correct a typo in SA-20:22.sqlite
Pointy hat to: philip 1.1_4 philip security/vuxml: add FreeBSD SA-20:23.sendmsg 1.1_4 philip security/vuxml: add FreeBSD SA-20:21.usb_net 1.1_4 philip security/vuxml: add FreeBSD SA to sqlite3 entry
Reference FreeBSD-SA-20:22.sqlite and correct the fixed patch releases
in the recent sqlite3 entry. 1.1_4 joneum add entry for typo3-9 and typo3-10
PR: 248430 248429
Sponsored by: Netzkommune GmbH 1.1_4 zeising vuxml: Document vulns in xorg-server and libX11
Document two vulnerabilities, one in xorg-server and one in libX11.
The one in libX11 is a heap corruption vulnerability. [1]
The one in xorg-server (and slave ports) is a uninitialized memory
disclosure. [2]
Security: CVE-2020-14344[1], CVE-2020-14347 [2] 1.1_4 wen - Document python38 multiple vulnerabilities 1.1_4 tcberner security/vuxml: fix randomly introduced typo
Pointy hat: tcberner
Reported by: kevans 1.1_4 tcberner Document vulnerability in archivers/ark
- fixed in r543704 (head), r543705 (2020Q3) 1.1_4 rene Document new vulnerabilities in www/chromium < 84.0.4147.105
Obtained
from: https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html 1.1_4 riggs Document out-of-bounds-read in libsndfile (CVE-2019-3832).
PR: 248268 1.1_4 kevans security/vuxml: document new vulnerability in net/freerdp < 2.2.0
PR: 248198 1.1_4 leres security/vuxml: Mark zeek < 3.0.8 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v3.0.8
Two potential stack overflows. 1.1_4 joneum Add entry for Cacti
PR: 248140
Sponsored by: Netzkommune GmbH
