Document recent asterisk vulneraability.

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-39.html

security/vuxml: Document openssl vulnerability

security/vuxml: Add entry for devel/kio-extras <= 18.08.3_1

  https://www.kde.org/info/security/advisory-20181012-1.txt

Security:	CVE-2018-19120

Update openjpeg status

security/vuxml: list CVE numbers forgotten in r484705

security/vuxml: mark patch < 2.7.7 as vulnerable

Another copypasta because pkg-audit(8) doesn't grok CPE e.g.,
https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe:2.3:a:gnu:patch:2.7.6

security/vuxml: Update latest openssl entry

 - LibreSSL prior to 2.8 not vulnerable
 - LibreSSL likely not vulnerable to CVE-2018-0735

PR:		233109
Submitted by:	Franco Fichtner <franco opnsense org>

- lighttpd - use-after-free vulnerabilities
PR:		232278

Add info about security vulnerability in PostgreSQL

Security:	CVE-2018-16850

security/vuxml: Mark MariaDB 10.3.10 vulnerable

 - From MariaDB release notes (not released yet)

See: https://mariadb.com/kb/en/library/mariadb-10311-release-notes/

PR:		233068

Add modified entrey for drupal after changes in r484148

Sponsored by:	Netzkommune GmbH

Add entry for nginx and nginx-devel

Sponsored by:	Netzkommune GmbH

- Add www/drupal8 entry

Document gitea vulnerability

PR:		232897
Submitted by:	stb@lassitu.de (maintainer)

Document curl vulnerability

Document gilab-ce vulnerability.

Approved by:	mentors (implicit)

Document rubygem-loofah vulnerability

security/vuxml: Update latest OpenSSL entry

 - As per a LibreSSL dev, also vulnerable

Documented several security issues with www/gitlab-ce.

Approved by:	mentors (implicit)

security/vuxml: Document OpenSSL 1.1.x vulnerabilities

Document potential remote code execution in net/liveMedia (CVE-2018-4013)

Mark mini_httpd < 1.30 as vulnerable as per:

    http://acme.com/updates/archive/211.html

The issue is arbitrary file disclosure in some circumstances.

Reviewed by:	matthew (mentor)
Approved by:	matthew (mentor)
Differential Revision:	https://reviews.freebsd.org/D17718

Add entry for sysutils/py-salt

PR:		232663
Reported by:	Christer Edwards <christer.edwards@gmail.com>
Security:	https://www.vuxml.org/freebsd/4f7c6af3-6a2c-4ead-8453-04e509688d45.html

security/vuxml: mark firefox < 63 as vulnerable

Add entry for www/drupal7

Sponsored by:	Netzkommune GmbH

Document ruby vulnerability

PR:		232427 (based on)
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>

security/vuxml: Document 2018-10 MySQL vulnerabilities

Add entry for www/matomo

Sponsored by:	Netzkommune GmbH

Document libssh vulnerability

PR:		232344
Security:	CVE-2018-10933

Document security vulnerability with devel/libgit2 < 0.27.5.

Approved by:	mentors (implicit)

Add an entry for a memory leak bug in net-im/tox < v0.2.8.

Add entry for www/gitea

PR:		232123
Reported by:	maintainer
Sponsored by:	Netzkommune GmbH

Document Jenkins Security Advisory 2018-10-10

Sponsored by:	The FreeBSD Foundation

- add entry for tinc and tinc-devel

Document several vulnerabilities for gitlab-ce.

Approved by:	mentors (implicit)

security/vuxml: add multiple vulnerabilities in security/clamav.

PR:		231924
Submitted by:	yasu@utahime.org

- Document django21 vulnerability

security/vuxml: mark firefox < 62.0.3 as vulnerable

Document several vulnerabilities for gitlab-ce.

Approved by:	mentors (implicit)

Document pango DoS

Add entry for www/serendipity

Sponsored by:	Netzkommune GmbH

security/vuxml: Add entry for net-p2p/bitcoin CVE-2018-17144

Add VuXML for r480928

Approved by:	timur (mentor)
Differential Revision:	https://reviews.freebsd.org/D17360

Document spamassassin - multiple vulnerabilities

Document spamassassin vulnerabilities, as found in this announcement:
https://seclists.org/oss-sec/2018/q3/242

security/vuxml:

Document wesnoth vulnerability

security/vuxml: Add Apache 2.4 vulnerability

Update OpenJPEG vulnerability

CVE-2018-5785 was fixed in r480624.

Document mantis vulnerability

Document rubygem-smart_proxy_dynflow vulnerability

- Document mediawiki's multiple vulnerabilities

security/vuxml: mark firefox < 62.0.2 as vulnerable

Document new asterisk vulnerability.

- Document moodle multiple vulnerabilities

security/vuxml: add Joomla3 Vulnerabilities

security/vuxml: mark waterfox < 56.2.3 as vulnerable

Update OpenJPEG vulnerability

Only CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.

Notified by:	tijl

Document vulnerability in www/mybb

Sponsored by:	Netzkommune GmbH

Document FreeBSD-SA-18:12.elf

Add VuXML vulnerability CVE-2018-15598 for traefik.

Port update is already MFHed.

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-31.html

Improve formatting
Also add plexmediaserver-plexpass package as vulnerable

Document Plex vulnerability

Security:	CVE-2018-13415

The 0.18 release of x11/sddm contains a fix for a security error
that allows unlocking a session without a password, if the
ReuseSession configuration option is set to true. The default
configuration sets it to false.

I'm setting the version to < 0.17.0_1 here, because I'm going
to update 0.17 with backports rather than pull in 0.18 (there's
a lot more work in that update, because of reorganisation upstream
and none of our patches apply anymore).

PR:		230029
Reported by:	doctorwhoguy@gmail.com

Document vulnerability in www/mybb

Sponsored by:	Netzkommune GmbH

Document gitea vulnerability.

PR:		231180
Submitted by:	stb@lassitu.de
Security:	7c750960-b129-11e8-9fcd-080027f43a02

Remove duplicate entry for WPA EAPOL vulnerability. Use r477829 instead
as its version range is more complete.

PR:		231054
Reported by:	000.fbsd@quip.cz

Add VuXML entry for the fixed CVE-2017-11114 in www/links

PR:		230849
Submitted by:	Dmitri Goutnik <dg@syrec.org>

Document curl vulnerability

security/vuxml: mark firefox < 62 as vulnerable

Document Ghostscript -dSAFER sandbox bypass vulnerabilities.

PR:		231148
Security:	https://www.kb.cert.org/vuls/id/332928

Document grafana issues

PR:		 231019
PR:		 231020
PR:		 231021
PR:		 231022

Document several vulnerabilities for gitlab-ce.

Approved by:	mentors (implicit)

- Fix range for ja-mailman in CVE-2018-13796

Mark bro < 2.5.5 as vulnerable as per:

    https://www.bro.org/download/NEWS.bro.html

Reviewed by:	ler (mentor)
Approved by:	ler (mentor)
Differential Revision:	https://reviews.freebsd.org/D16948

security/vuxml: document Node.js vulnerabilities

https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/

Sponsored by:	Miles AS

Fix databases/mantis entry after r477954

Apparently you can have more than on <name></name> item inside a
<package></packge> group.  Also, re-add plain 'phpMyAdmin' without a
flavour suffix as a possible package name -- it's only been a few
months since flavourization, and there may well be some older installs
still out there.  (Although those should already be flagging for the
previous PMASA)

Reported by:	mat

Third time's the charm.  Now capitalize the package names correctly.

phpMyAdmin is flavoured now: use the correct package names.

Document FreeBSD-SA-18:11.hostapd

Document FreeBSD-SA-18:10.ip

Document FreeBSD-SA-18:09.l1tf

Document gogs open redirect issue

PR:		230800
Submitted by:	Dmitri Goutnik <dg@syrec.org>

Document the latest phpMyAdmin security advisory PMASA-2018-5

Document libX11 vulnerabilities.

CVE-2018-14598
CVE-2018-14599
CVE-2018-14600

https://lists.x.org/archives/xorg-announce/2018-August/002915.html

security/vuxml: add CVE-2018-11769 for databases/couchdb versions < 2.2.0

Reported by:	Apache CouchDB PMC
Approved by:	jrm
Security:	CVE-2018-11769
Security:	https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75@%3Cdev.couchdb.apache.org%3E
Differential Revision:	https://reviews.freebsd.org/D16820

Document issue in security/botan2

PR:		230666

Document Jenkins Security Advisory 2018-08-15

Sponsored by:	The FreeBSD Foundation

Document WPA unauthenticated encrypted EAPOL-Key data vunlerability.

Security:	CVE-2018-14526

Document the latest Flash Player vulnerabilities.

https://helpx.adobe.com/security/products/flash-player/apsb18-25.html

Add an entry about multiple Samba vulnerabilities:

* CVE-2018-1139  (Weak authentication protocol allowed.)
* CVE-2018-1140  (Denial of Service Attack on DNS and LDAP server.)
* CVE-2018-10858 (Insufficient input validation on client directory
  listing in libsmbclient.)
* CVE-2018-10918 (Denial of Service Attack on AD DC DRSUAPI server.)
* CVE-2018-10919 (Confidential attribute disclosure from the AD LDAP
  server.)

Security:	CVE-2018-1139
		CVE-2018-1140
		CVE-2018-10858
		CVE-2018-10918
		CVE-2018-10919
Sponsored by:	iXsystems Inc.

Document GraphicsMagick vulnerability

Document lang/chicken vulerabilities

Document www/gitea vulnerability, with the scarce details provided by Gitea

PR:		230512

Document mbed TLS Security Advisory 2018-02.

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02

Add entry about postgresql vulnerabilites

security/vuxml: Document Oracle's Crititcal Patch Update

Add vulnerability information about apache-xml-security-c

Document FreeBSD-SA-18:08.tcp

security/py-cryptography: Add tag forgery vulnerability

PR:	226906