Document Jenkins Security Advisory 2019-04-10

Sponsored by:	The FreeBSD Foundation

Document the latest Flash Player vulnerabilities.

https://helpx.adobe.com/security/products/flash-player/apsb19-19.html

Update py-notebook status

Documented vulnerabilities for clamav.

Update sysutils/puppetserver5 entry

Puppetlabs released version 5.3.8 of Puppet Server which address the issue:
https://puppet.com/docs/puppetserver/5.3/release_notes.html#puppet-server-538

With hat:	puppet

Documented gitlab vulnerability.

security/vuxml: Document Apache httpd vulnerabilities

- Document sysutils/kubectl CVE-2019-1002101

security/vuxml: Document irc/znc issue

Security:	CVE-2019-9917

Document py-notebook vulnerability

Update openjpeg status

vuxml: Document mail/dovecot buffer overflow.

Add modified line for drupal after r496987

Sponsored by:	Netzkommune GmbH

- Update 94d63fd7-508b-11e9-9ba0-4c72b94353b5 entry

Update Python vulnerability (d74371d2-4fee-11e9-a5cd-1df8a848de3d)

Add entry for www/drupal7

Sponsored by:	Netzkommune GmbH

Document Python vulnerability

Update the libXdmcp entry to make it clearer.

Add entry for wordpress

Sponsored by:	Netzkommune GmbH

Documented gitlab vulnerability.

Add entry for x11/libXdmcp vulnerabilty.

Add entry for x11/libXdmcp vulnerabilty, insufficient entripy generating
session keys.  It is unknown if this actually affects FreeBSD.

Security:	CVE-2017-2625

Documented security vulnerability for gitlab < 11.8.2.

Add entry for www/gitea

PR:		236563

security/vuxml: mark firefox < 66 as vulnerable

Document PowerDNS issue

PR:		236634
Reported by:	Dani <i.dani@outlook.com>

Document Rails vulnerability

Record PuTTY security vulnerabilities in versions before 0.71.

Document py-notebook vulnerability

Document ruby-gems vulnerability

Document CVE fixes in libsndfile-1.0.28_2

PR:		227669
Reported by:	p5B2E9A8F@t-online.de

Fill in the actual URL for March 2019 ntp-4.2.8p13 NTP Release and
Security Vulnerability Announcement

security/vuxml: Document OpenSSL 1.1.1 vulnerability

Document crafted ull dereference ntp attack.

Security:	CVE-2019-8936
Obtained from:	nwtime.org

security/vuxml: Document shells/rssh < 2.3.4_2 vulnerabilities

PR:		235121
Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D19473

Document a jQuery related XSS security fix in rt4.4.4 and rt4.2.16

Note: the release notes also mention 3 other security issues in perl
modules depended on by these packages.  Of those, vulnerabilities in
the Email::Address and Email::Address::List perl modules have already
been addressed in their respective ports, while the third: HTML::Gumbo
is not currently in the ports at all.

Document a slixmpp < 1.4.1 vulnerability

Reviewed by:	krion, mat
Approved by:	krion (mentor), mat (mentor)
MFH:		2019Q1

Doucumented several www/gitlab-ce security vulnerabilities.

Document www/py-gunicorn vulnerability

Update mybb entry

Sponsored by:	Netzkommune GmbH

security/vuxml: document Node.js February 2019 Security Releases

https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/

Sponsored by:	Miles AS

Document vulnerability in www/mybb

Sponsored by:	Netzkommune GmbH

Document new asterisk vulnerability.

Security:	CVE-2019-7251

security/vuxml: Update OpenSSL 1.0.2r entry

Document webkit-gtk CVE's

Security:	CVE-2019-6212, CVE-2019-6215, CVE-2019-6216, CVE-2019-6217, \
		CVE-2019-6226, CVE-2019-6227, CVE-2019-6229, CVE-2019-6233, \
		CVE-2019-6234.

security/vuxml: dokument rdesktop < 1.8.4 vulnerabilities

PR:		235885, 229029

Document sysutils/puppetserver* vulnerabilities.

PuppetServer bundles Bouncy Castle, so add affected ports to the Bouncy Castle
entry.

sysutils/puppetserver is EOL and will likely never get a fix;
sysutils/puppetserver5 may get fixed in a future release of the 5.x branch;
sysutils/puppetserver6 was fixed in the latest release.

With hat:	puppet

- Add drupal8 vulnerability entry

security/vuxml: Document announced OpenSSL vulnerability

 - To be updated with more specifics on 2019-02-26

Document mail/msmtp certificate verification issue

fix firefox-esr PORTEPOCH in latest entry

Submitted by:	jbeich

add more mozilla products to latest entry

https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/
(same CVEs as mfsa2019-04, so not creating another entry)

document firefox vulnerabilities

https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb19-06.html

Fix r492723 for the name of NVD report

Update openjpeg status

There were 5 vulnerabilities in openjpeg and 4 of them are fixed.
The current status  is described in [1] as follows:
- CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.
- CVE-2018-5785 was fixed in r480624.
- CVE-2018-6616 was fixed in r489415.
- CVE-2018-5727 is not fixed yet.

Though I keep committing fixes and updating the status, it does not show in the
"pkg audit" result. Users have to follow the link but apparently few people
would do that. Therefore, I got mails asking if the CVEs are fixed, etc.

I don't know if there's a better way to handle this condition (partly fixed over
several months). Instead of removing fixed CVEs from vuln.xml, I decided to add
a new entry (5efd7a93-2dfb-11e9-9549-e980e869c2e9) which is split from the old
entry (11dc3890-0e64-11e8-99b0-d017c2987f9a). It should be clearer for users if
they only read the "pkg audit" result.

[1] https://www.vuxml.org/freebsd/11dc3890-0e64-11e8-99b0-d017c2987f9a.html

Document FreeBSD-SA-19:02.fd

Document FreeBSD-SA-19:01.syscall

Document kf5-kauth vulnerability.

Update versions range for recent unit vulnerability.

Document unit vulnerability.

Document curl vulnerability

Document gitlab-ce vulnerability.

mail/dovecot: update reporter for latest vuln

mail/dovecot: Suitable client certificate can be used to login as other user

update vuxml

Document typo3 vulnerability

PR:		235187, 235188

security/vuxml: Document Gitea < 1.7.1 vulnerabilities

PR:		235399
Submitted by:	stb@lassitu.de (www/gitea maintainer)

Document vulnerability addressed by release 0.06 of p5-Email-Address-List

Unfortunately there is very little real description of the
vulnerability available, other than what is in the changelog.  Even
the CVE number only leads to a page saying the number is reserved.

Documented multiple vulnerabilities for www/gitlab-ce.

security/vuxml: document vulnerabilities in net/turnserver

Sponsored by:	Miles AS

security/vuxml: mark firefox < 65 as vulnerable

Document powerdns-recursor issue

PR:		235113
Submitted by:	Ralf van der Enden <tremere@cainites.net>

Update py-requests entry

Reference:	https://lists.freebsd.org/pipermail/svn-ports-head/2019-January/198601.html

security/vuxml: Document recent MySQL vulnerabilities

 - 5.5 branch see https://mariadb.com/kb/en/library/mariadb-5563-release-notes/

security/vuxml: Document security/botan2 vulnerability

PR:		234938
Submitted by:	Ralf van der Enden <tremere@cainites.net> (maintainer)

Document PMASA-2019-1 and PMSA-2019-2 security advisories: Arbitrary
file disclosure and SQL injection attacks.

Add entry for www/gitea

PR:		235140
Sponsored by:	Netzkommune GmbH

security/vuxml: Add libzmq4 -- Remote Code Execution Vulnerability

PR:	230575

- Add package name validation

Fix invalid package name in previous commit for
4af3241d-1f0c-11e9-b4bd-d43d7eed0ce2

Add entry for www/apache24

Sponsored by:	Netzkommune GmbH

 Add CVE-2018-11803 for www/mod_dav_svn.

Attempt to fix vuxml build.

Sponsored by:	The FreeBSD Foundation

security/vuxml: Add www/py-requests: Information disclosure vulnerability

security/vuxml: Document joomla 3 vulnerabilities.

- Add drupal7 and drupal8 vulnerability entry

Document helm security advisory

Documented gitlab security vulnerability.

Document Jenkins Security Advisory 2019-01-16

Sponsored by:	The FreeBSD Foundation

Document py-matrix-synapse issue

PR:		234828
Submitted by:	Sascha Biberhofer <ports@skyforge.at> (with slight editing)

security/vuxml: Document irc/irssi issue

Security:	CVE-2019-5882

PR:		234798

Document out-of-bounds vulnerability in net/uriparser < 0.9.1

Reported by:	sebastian@pipping.org (via e-mail)

Document gitea issue

PR:		234659
Submitted by:	stb@lassitu.de

Update openjpeg status

Document new vulnerability in www/chromium < 71.0.3578.98

Obtained
from:	https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html

Document new vulnerabilities in www/chromium < 71.0.3578.80

Obtained
from:	https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html

- Documented security vulnerability of Django

Documented several gitlab-ce security vulnerabilities.

Approved by:	mentors (implicit)

Document gitea issue

Add entry for archivers/rpm4 security isssue on 4.14.2

Update handbrake entries now that 1.2.0 has been released.

PR:		234322
Submitted by:	Nei Teng  You Yi Lang  <naito.yuichiro@gmail.com> (maintainer)