security/vuxml: Document vulnerability in www/awstats

Security:	CVE-2017-1000501

PR:		225007
Reported by:	Vidar Karlsen <vidar@karlsen.tech>

security/vuxml: Document multiple vulnerabilities in irc/irssi

Security:	CVE-2018-5205
Security:	CVE-2018-5206
Security:	CVE-2018-5207
Security:	CVE-2018-5208

PR:		224954
Reported by:	tj@mrsk.me (email)
Reported by:	David O'Rourke <dor.bsd@xm0.uk>

security/vuxml: mark firefox < 57.0.4 as vulnerable

* Add modified date to for libevhtp vulnerable
Thank you dbaio for catching this.

* Add libevhtp to list of vulnerable ports.

Libevhtp prior to 1.2.14 uses oniguruma 5.9.2 and is
vulnerable if using the REGEX option, which is the
default.

security/vuxml: Fix FreeBSD PR bugs references

security/vuxml: Document vulnerabilities in www/otrs

Security:	CVE-2017-16664
Security:	CVE-2017-16854
Security:	CVE-2017-16921

PR:		224729
Reported by:	Vidar Karlsen <vidar@karlsen.tech>

Fix cut-n-paste error in the previous addition for bouncycastle15
(6a131fbf-ec76-11e7-aa65-001b216d295b).

Document security defect in the Bouncy Castle Crypto APIs: CVE-2017-13098
("ROBOT")

Obtained from:  https://www.bouncycastle.org/releasenotes.html
Security:      
https://vuxml.FreeBSD.org/freebsd/6a131fbf-ec76-11e7-aa65-001b216d295b

security/vuxml: mark thunderbird < 52.5.2 as vulnerable

Document phpMyAdmin PMSA-2017-9: Critical XSRF/CSRF vulnerability.

security/vuxml: Fix typo in CVE number of latest Oracle CPU entry

Document new asterisk vulnerability.

security/vuxml: Document new MariaDB vuln

 - This is likely to also affect MySQL and other versions
   see https://security-tracker.debian.org/tracker/CVE-2017-15365

Document multiple vulnerabilities in rsync.

PR:		224478
Submitted by:	yasu@utahime.org

Document ruby issue

Add vuxml entry for CVE-2017-16355 to rubygem-passenger

The vulnerable version was already replaced by r452356

Reviewed by:	brd
Approved by:	brd (ports)
Sponsored by:	Spectra Logic Corp
Differential Revision:	https://reviews.freebsd.org/D13482

Document multiple vulnerabilities in libXfont and libXfont2.

The first two vulnerabilities are memory leaks when reading past valid
memory.

The last vulnerability is the possibility for an unprivileged X client to
read privileged files through symlinks

CVE-2017-13720
CVE-2017-13722
CVE-2017-16611

Add CVE to references.

Document x11/libXcursor -- integer overflow that can lead to heap buffer
overflow.

CVE-2017-16612

Document global vulnerability

Document Jenkins vulnerabilities.

security/vuxml: document Node.js vulnerabilities, December 2017

Approved by:	mat (co-mentor)
Differential Revision:	https://reviews.freebsd.org/D13489

Document GitLab Vulnerability

Security:
https://vuxml.FreeBSD.org/freebsd/e72a8864-e0bc-11e7-b627-d43d7e971a1b.html

Add entry for CVE-2017-8819.

Requested by:	Roger Marquis
Hat:		FreeBSD Security Team

- Add CVE names for old asterisk13 vulnerabilities
- Fix typo

Document asterisk13 vulnerability.

Document libxml2 issue

Fix version range in latest curl entry.

Add linux-c7-curl to latest curl entry.

Security:	301a01b7-d50e-11e7-ac58-b499baebfeaf

Document FreeBSD-SA-17:12.openssl

document latest wireshark vulnerabilities

Fix version range of mail/procmail

PR:		223777
Submitted by:	romain

secuirty/vuxml: Document OpenSSL vulnerabilities

Document FreeBSD-SA-17:11.openssl

Document FreeBSD-SA-17:10.kldstat

Document FreeBSD-SA-17:09.shm

Document FreeBSD-SA-17:08.ptrace

Document FreeBSD-SA-17:07.wpa

security/vuxml: mark firefox < 57.0.1 as vulnerable

Document varnish vulnerabilty

Security:	CVE-2017-8807

Document vulnerability in www/mybb

Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D13343

Document wordpress issues

Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D13323

Documeent net/asterisk13 vulnerability.

Document CVE-2017-16944 in Exim

security/vuxml: Document vulnerability in net/xrdp-devel

PR:		223931
Reported by:	meta+ports@vmeta.jp (maintainer)
Security:	CVE-2017-16927

security/vuxml: Fix formatting

security/vuxml: Document cURL vulnerabilities

security/vuxml: Document vulnerability in py-borgbackup

Document www/palemoon vulnerabilities

PR:		223934
Security:	CVE-2017-7832
Security:	CVE-2017-7835
Security:	CVE-2017-7840

Document mail/exim vulnerability: CVE-2017-16943

Document vulnerability in www/mybb

https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/

Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D13231

Document multiple vulnerabilities in sysutils/py-salt

Security:	CVE-2017-14695
Security:	CVE-2017-14696

Document security issue fixed in CodeIgniter 3.1.6

Security:	https://vuxml.FreeBSD.org/freebsd/ef3423e4-d056-11e7-a52c-002590263bf5.html

- Document vulnerability in procmail

Document vulnerability in net/frr

Security:	CVE-2017-15865
Sponsored by:	Orange

security/vuxml: Document multiple vulnerabilities in net-mgmt/cacti

PR:		223756
Reported by:	freebsd-ports@dan.me.uk
Approved by:	olivier (mentor)
Security:		CVE-2017-16641
Security:		CVE-2017-16660
Security:		CVE-2017-16661
Security:		CVE-2017-16785

- Document vulnerability in www/mediawiki127, www/mediawiki128 and
www/mediawiki129.

security/vuxml: Mark MariaDB <10.1.29 vulnerable

 - As per release notes [1]

1: https://mariadb.com/kb/en/library/mariadb-10129-release-notes/

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb17-33.html

Fix vuxml build.

Sponsored by:	The FreeBSD Foundation

Information about shibbloeth2-sp security issue

- This vulnerability aapplies to pjsip too.
- Fix typo.

security/vuxml: mark firefox < 57 as vulnerable

Fix wrong ranges of affected PHP versions

Reported by: Adam McDougall <mcdouga9@egr.msu.edu>

Document rubygem-geminabox vulnerability

security/vuxml: Document vulnerability in irc/konversation

Reported by:	tcberner
Approved by:	tcberner (mentor)
Security:       CVE-2017-15923

security/vuxml: Document vulnerability in in mail/roundcube

PR:		223557
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	CVE-2017-16651

Document new vulnerabilities in www/chromium < 62.0.3202.89

Obtained
from:	https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html

Document PostgreSQL vulnerabilities

Document jenkins vulnerabilities

Document Asterisk vulnerabilities.

security/vuxml: Fix MySQL 10.1 vulnerable version

PR:		223482
Reported by:	Marcin Gryszkalis <mg fork pl>

security/vuxml: Document new OpenSSL vulnerabilitities

Document wordpress issues

Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D12898

Document wireshark issues

Document PHP Vulnerability

Security: CVE-2016-1283
Security:
https://vuxml.FreeBSD.org/freebsd/de7a2b32-bd7d-11e7-b627-d43d7e971a1b.html

Document new vulnerability in www/chromium < 62.0.3202.75

Obtained
from:	https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html
Security:	CVE-2017-15396

Document ftp/wget's stack and heap overflow

Submitted by:	Andrew Perry <pez_098@yahoo.com>
Security:	CVE-2017-13089
Security:	CVE-2017-13090

Add headings to each Apache Openoffice vulnerability description.

Update Apache OpenOffice entry.

security/vuxml: add node.js remote DoS vulnerability announced 2017-10-24

Reviewed by:	swills
Approved by:	swills (ports-secteam)
Security:	d7d1cc94-b971-11e7-af3a-f1035dd0da62
Differential Revision:	https://reviews.freebsd.org/D12788

Revert r452836 to re-add Apache Openoffice entry.

Remove empty <cvename/> to hopefully not break the build this time.

This passes "make validate" just like the last version did.

Suggested by:	gavin

Document GitLab vulnerabilities

Security:
https://vuxml.FreeBSD.org/freebsd/418c172b-b96f-11e7-b627-d43d7e971a1b.html

Revert r452818, the vuxmlweb build does not like empty CVE IDs.

This should likely be tested for as part of "make validate".

Hat:	clusteradm

Placeholder entry for editors/openoffice-4 and editors/openoffice-devel
multiple vulnerabilities.  Details are currently embargoed.

security/vuxml: Document cURL vulnerability

 - While here, fix date in latest mysql entry

Multiple vulnerabilites in www/h2o

Reviewed by:	jrm (mentor)
Approved by:	jrm (mentor)
Security:	CVE-2017-10868
Security:	CVE-2017-10869
Differential Revision:	https://reviews.freebsd.org/D12763

security/vuxml: Document multiple vulnerabilities in irc/irssi

Security:	CVE-2017-15721
Security:	CVE-2017-15722
Security:	CVE-2017-15723
Security:	CVE-2017-15727
Security:	CVE-2017-15228

PR:		223169
Reported by:	David O'Rourke <dor.bsd@xm0.uk>

Document new vulnerabilities in www/chromium < 62.0.3202.62

Obtained
from:	https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html

Document cacti issue

- Document arj archiver vulnerabilities

Ensure all krb5 packages are listed in the recent vulnerability entry

Fix formatting (line length) in recent krb5 vulnerability entry

Doucument recent MIT Kerberos (krb5) vulnerabilities

security/vuxml: Document MySQL vulnerabilities Q4 2017

Document xorg issues

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb17-32.html

Fix version on solr issue

Document hostapd and wpa_supplicant issue

PR:		223051
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>