Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1_4 rakuco Add entry for heap buffer overflow in sysutils/file.
PR: 241424
Submitted by: Nathan Owens <ndowens04@gmail.com>
Approved by: jharris@widomaker.com (maintainer) 1.1_4 kwm Document webkit-gtk3 vulnerabilities. 1.1_4 dmgk Document www/gitea information disclosure vulnerability
PR: 241599
Submitted by: stb@lassitu.de (maintainer)
Approved by: tz (mentor, implicit) 1.1_4 gjb Fix build.
Sponsored by: Rubicon Communications, LLC (Netgate) 1.1_4 timur Add entry about Samba vulnerabilities
o CVE-2019-10218:
Malicious servers can cause Samba client code to return filenames containing
path separators to calling code.
o CVE-2019-14833:
When the password contains multi-byte (non-ASCII) characters, the check
password script does not receive the full password string.
o CVE-2019-14847:
Users with the "get changes" extended access right can crash the AD DC LDAP
server by requesting an attribute using the range= syntax.
Security: CVE-2019-10218
CVE-2019-14833
CVE-2019-14847
Sponsored by: my wife 1.1_4 mfechner Document gitlab vulnerabilities. 1.1_4 feld Add missing FreeBSD SAs
Security: FreeBSD-SA-19:24.mqueuefs
Security: FreeBSD-SA-19:23.midi
Security: FreeBSD-SA-19:22.mbuf
Security: FreeBSD-SA-19:21.bhyve
Security: FreeBSD-SA-19:20.bsnmp
Security: FreeBSD-SA-19:19.mldv2
Security: FreeBSD-SA-19:18.bzip2 1.1_4 feld Document Varnish VSV00004 Workspace information leak 1.1_4 rodrigo Document potential bypass of Runas user restrictions in sudo
PR: 241244
Submitted by: Yasuhiro KIMURA <yasu@utahime.org> 1.1_4 sunpoet Document rubygem-loofah vulnerability 1.1_4 wen - Document python37 multiple vulnerabilities. 1.1_4 kai security/vuxml: Document graphics/py-pillow issue
PR: 241268
Security: CVE-2019-16865 1.1_4 pi security/vuxml: mongodb vulnerabilities
- CVE-2019-2386, CVE-2019-2389, CVE-2019-2390
PR: 239717
Submitted by: Ronald Klop <ronald-lists@klop.ws> 1.1_4 egypcio security/vuxml: add CVE-2011-2767 [www/mod_perl2]
https://nvd.nist.gov/vuln/detail/CVE-2011-2767 1.1_4 cy Take PORTEPOCH into account.
PR: 241066
Reported by: tobik 1.1_4 cy Document two new Xpdf vulnerabilities: CVE-2019-16927 and CVE-2019-9877.
PR: 241066
Security: https://nvd.nist.gov/vuln/detail/CVE-2019-16927
Security: https://nvd.nist.gov/vuln/detail/CVE-2019-9877
Security: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9877
Security: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16927 1.1_4 sunpoet Document unbound vulnerability 1.1_4 sunpoet Document ruby vulnerability 1.1_4 mfechner Document gitlab vulnerabilities. 1.1_4 mfechner Document gitlab vulnerabilities. 1.1_4 mfechner Documented gitlab vulnerabilities. 1.1_4 kai security/vuxml: Document net-mgmt/cacti issue
PR: 240999
Reported by: Michael Muenz <m.muenz@gmail.com>
Security: CVE-2019-16723 1.1_4 vsevolod Fix misprint 1.1_4 vsevolod Document RCE in Exim: CVE-2019-16928 1.1_4 dmgk security/vuxml: Add entry for lang/go and lang/go-devel CVE-2019-16276
Approved by: araujo (mentor)
Differential Revision: https://reviews.freebsd.org/D21802 1.1_4 tobik Document databases/mantis vulnerabilities 1.1_4 lwhsu Document Jenkins Security Advisory 2019-09-25
Sponsored by: The FreeBSD Foundation 1.1_4 tijl Add linux-c6-openssl to CVE-2019-1559 entry.
Security: https://access.redhat.com/errata/RHSA-2019:2471 1.1_4 pi security/vuxml: add CVEs for net/kea
PR: 240399
Submitted by: Andrey Pevnev <apevnev@me.com> 1.1_4 pi security/vuxml: add entry for CVE-2019-15903 in expat < 2.2.8
PR: 240613
Submitted by: Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer) 1.1_4 tijl Document Mbed TLS side channel attack on deterministic ECDSA.
Security: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10 1.1_4 leres security/vuxml: Mark bro < 2.6.4 as vulnerable as per:
https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS
The issue is inproper data handling of data that is either either
empty or unterminated, resulting in invalid memory access or heap
buffer over-read.
Approved by: matthew (mentor, implicit) 1.1_4 pi security/vuxml: fix vuln.xml entry for expat
PR: 238864
Submitted by: tobik 1.1_4 pi security/vuxml: document expat2 pre-2.2.7 vulnerability
PR: 238864
Submitted by: Sergei Vyshenski <svysh.fbsd@gmail.com> 1.1_4 brnrd security/vuxml: Fix latest openssl entry
Reported by: tobik 1.1_4 sunpoet Document curl vulnerability 1.1_4 brnrd security/vuxml: Document OpenSSL vulnerabilities 1.1_4 jkim Document the latest Flash Player vulnerabilities.
https://helpx.adobe.com/security/products/flash-player/apsb19-46.html 1.1_4 mandree Document devel/oniguruma < 6.9.3 vulnerabilities.
PR: 240368
Reported by: Pascal Christen
Obtained from: MITRE
Security: a8d87c7a-d1b1-11e9-a616-0992a4564e7c
Security: CVE-2019-13224
Security: CVE-2019-13225 1.1_4 feld Document recent xymon-server CVEs 1.1_4 joneum Add entry for wordpress
Sponsored by: Netzkommune GmbH 1.1_4 vsevolod Document Exim vulnerability 1.1_4 madpilot Document asterisk vulnerabilities. 1.1_4 timur Add entry about CVE-2019-10197
On a Samba SMB server for all versions of Samba from 4.9.0 clients are
able to escape outside the share root directory if certain
configuration parameters set in the smb.conf file.
Security: CVE-2019-10197 1.1_4 jbeich security/vuxml: mark firefox < 69 as vulnerable 1.1_4 zi - Document www/varnish6 vulnerability 1.1_4 cpm Document libgcrypt ECDSA side-channel attack vulnerability
Security: CVE-2019-13627 1.1_4 sunpoet Update ruby version
PR: 240227
Reported by: Trond Endrestol <Trond.Endrestol@ximalas.info> 1.1_4 tobik Document www/webkit2-gtk3 vulnerabilities
PR: 240196 1.1_4 mfechner Document www/gitlab-ce vulnerabilities. 1.1_4 sunpoet Document RDoc vulnerability 1.1_4 ler security/vuxml: document dovecot,dovecot-pigeonhole vulns 1.1_4 lwhsu Document Jenkins Security Advisory 2019-08-28
Sponsored by: The FreeBSD Foundation 1.1_4 jbeich security/vuxml: mark cliqz < 1.28.2 as vulnerable
PR: 239994
Submitted by: Santhosh Raju 1.1_4 dch security/vuxml: Document multiple vulnerabilities in www/h2o*
http://blog.kazuhooku.com/2019/08/h2o-version-226-230-beta2-released.html
PR: 239843
Reported by: Kazuho Oku
Approved by: jrm (mentor, implicit)
Security: CVE-2019-9512
Security: CVE-2019-9514
Security: CVE-2019-9515
Sponsored by: SkunkWerks, GmbH 1.1_4 kai security/vuxml: Document www/gitea issues
PR: 240046
Submitted by: stb@lassitu.de (maintainer) 1.1_4 pi security/vuxml: Document multiple vulnerabilities in ClamAV
PR: 240020
Submitted by: Yasuhiro KIMURA <yasu@utahime.org> (clamav maintainer) 1.1_4 bhughes security/vuxml: document recent Node.js vulnerabilities
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
Sponsored by: Miles AS 1.1_4 riggs Document vlc vulnerabilities prior to release 3.0.8 1.1_4 joneum Add dns/nsd
PR: 239964
Reported by: Jaap Akkerhuis <jaap@NLnetLabs.nl>
Sponsored by: Netzkommune GmbH 1.1_4 olgeni security/vuxml: add vuxml entry for webmin and usermin (CVE-2019-15107). 1.1_4 pi security/vuxml: add vuxml entry for gitea
PR: 239930
Submitted by: stb@lassitu.de 1.1_4 zeising Document x11/xdm vulnerability CVE-2013-2179 1.1_4 mfechner Document libgit2 vulnerabilities. 1.1_4 joneum Add www/apache24
Sponsored by: Netzkommune GmbH 1.1_4 sunpoet Document nghttp2 vulnerability 1.1_4 tijl Document CUPS CVE-2019-8675 and CVE-2019-8696.
Security: https://github.com/apple/cups/releases/tag/v2.2.12 1.1_4 kai security/vuxml: Update entry for security/doas
* Add a reference to OpenBSD's tech mailinglist that explains the issues
with doas(1)'s environmetal security in further detail.
* Clarify the origins of the reporting sources and fix a grammar nit.
PR: 239629
Reported by: Sander Bos 1.1_4 riggs Document http/2 denial of service in net/traefik before 1.7.14 1.1_4 joneum Edit entry for www/nginx
Sponsored by: Netzkommune GmbH 1.1_4 joneum Add entry for www/nginx and www/nginx-devel
Sponsored by: Netzkommune GmbH 1.1_4 sunpoet Document rubygem-nokogiri vulnerability 1.1_4 mfechner Document www/gitlab-ce vulnerabilities. 1.1_4 adridg Add vuxml for KDE Frameworks CVE 1.1_4 kai security/vuxml: Document security/doas issues
PR: 239629 1.1_4 leres security/vuxml: Mark bro < 2.6.3 as vulnerable as per:
https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS
The issues are a null pointer dereference in the RPC analysis code
and a signed integer overflow in BinPAC-generated parser code.
Approved by: matthew (mentor, implicit) 1.1_4 girgen Add security information for PostgreSQL 1.1_4 sunpoet Document Django vulnerability 1.1_4 tijl Add linux-c7-curl package to curl CVE-2018-14618 entry.
Security: https://access.redhat.com/errata/RHSA-2019:1880
Security: CVE-2018-14618 1.1_4 kai security/vuxml: Document www/gitea issues
PR: 239562
Submitted by: stb@lassitu.de (maintainer) 1.1_4 feld Document FreeBSD-SA-19:17.fd 1.1_4 feld Document FreeBSD-SA-19:16.bhyve 1.1_4 feld Document FreeBSD-SA-19:15.mqueuefs 1.1_4 feld Document FreeBSD-SA-19:14.freebsd32 1.1_4 feld Document FreeBSD-SA-19:13.pts 1.1_4 feld Document FreeBSD-SA-19:12.telnet 1.1_4 feld Document FreeBSD-SA-19:11.cd_ioctl 1.1_4 feld Document FreeBSD-SA-19:10.ufs 1.1_4 feld Document FreeBSD-SA-19:09.iconv 1.1_4 feld Document FreeBSD-SA-19:08.rack 1.1_4 feld Document FreeBSD-SA-19:07.mds 1.1_4 feld Document FreeBSD-SA-19:06.pf 1.1_4 feld Document FreeBSD-SA-19:05.pf 1.1_4 feld Add freebsdsa metadata for FreeBSD-SA-19:04.ntp 1.1_4 feld Add freebsdsa metadata to the entry detailing FreeBSD-SA-19:03.wpa 1.1_4 mfechner Document www/gitlab-ce vulnerabilities. 1.1_4 amdmi3 Add more CVE references to sdl2_image entry 1.1_4 kai security/vuxml: Document net-im/py-matrix-synapse issues
PR: 239013
Submitted by: Sascha Biberhofer <ports@skyforge.at> (maintainer) 1.1_4 tobik Fix version range of exim entry
It currently does not account for PORTREVISION, i.e., it excludes
4.92_1, 4.92_2, 4.92_3, 4.92_4 which are affected by CVE-2019-13917
too. 1.1_4 vsevolod Document exim vulnerability CVE-2019-13917
