Document fontconfig insufficiently cache file validation

Security:	CVE-2016-5384

Fix ruby version range which was missing the important portepoch

Add postgres and mysql to the EoL port list

PR:		211975

Fix PKGNAME matching for old ruby in vuxml

PR:		211975

Fixup Perl package names in the EoL vuln.

Sponsored by:	Absolight

unbreak build (validation and tests pass)

Reported by:	feld
With hat:	ports-secteam

Add a number of old expired and End of Life ports to vuxml

PR:		211975

Fix CVE name for security/gnupg and security/libgcrypt.  There was a typo in
the official release announcement.

Register recent gnupg1/libgcrypt vuln.

Document 26 new security advisories from phpmadmin.  Some of these are
described as 'critical'.

Note where the XSLoader thing is being fixed in Perl 5.18 and 5.20.

Sponsored by:	Absolight

security/vuxml: Fix/Improve a few entry titles (<topic)

 - TeamSpeak 3 Server: Use standard "Product -- Description" title format
 - TeamSpeak 3 Server: Include RCE in title so people dont miss it. Importante.
 - puppet-agent MCollective: Remove duplicate name in title, use software name
 - FreeBSD ntp entry: Fix grammo

audio/teamspeak3-server: Document remote code execution

PR:		211846
Security:	http://seclists.org/fulldisclosure/2016/Aug/61
Submitted by:	Ultima1252@gmail.com

Fix PKGNAME for collectd5

PR:		211613

Add entry for CVE-2015-7331

mcollective-puppet-agent -- Remote Code Execution in mcollective-puppet-agent
plugin

Fix the perl5* section for the two recent vuln.

For some reason, perl5-devel was having a wrongly special treatment, and
it was failing to take into account the fact that we've had 5.21 and
5.23 in the tree.
Also, correct the version at which the XSLoader thing was solved in 5.25.

Sponsored by:	Absolight

The perl5 release candidate versions also address the XSLoader local
arbitrary code execution vulnerability (CVE-2016-6185), as documented
in perldelta(1)

So perl5.22-5.22.3.r2 and perl5.24-5.24.1.r2 are not vulnerable.

I can't confirm if the updates to perl5.18 and perl5.20 also solve the
XSLoader bug or not but by inspection of the source code, I don't
believe that to be the case.

Correct the syntax for the <freebsdsa> entries.

They should not be prefixed with FreeBSD-

Correct old vuxml entries for FreeBSD that use <ge>0</ge> or a <ge> without an
<le>

One entry has been cancelled in preference of a much newer entry referring to
the same CVE as it has more detail.

Add missing FreeBSD SA entries from 2016 to vuxml

Add missing FreeBSD SA entries from 2015 to vuxml

Add missing FreeBSD SA entries from 2014 to vuxml

Fix vuxml build.

Approved by:	ports-secteam (implicit)
Sponsored by:	The FreeBSD Foundation

security/vuxml: Make PostgreSQL entry more explicit

Be more explicit in the title of the PostgreSQL entry as to the nature
of the vulnerabilities. Remove possibly subjective description of the
severity (minor) from the title, err on the side of allow users to make
the assessment based on their environments instead.

Approved by:	feld (ports-secteam)

Add missing FreeBSD SA to vuxml

Security:	SA-14:01.bsnmpd

Add security info for upcoming PostgreSQL updates.

Security: CVE-2016-5424, CVE-2016-5423

Fixup Perl versions for CVE-2016-1238.

Sponsored by:	Absolight

www/piwik: Document XSS issues

PR:          211590
Security:   
https://vuxml.freebsd.org/freebsd/28bf62ef-5e2c-11e6-a15f-00248c0c745d.html
Approved by: pi (mentor)

Document denial of service vector via oversized AXFR, IXFR, or Dynamic DNS
updates in BIND, Knot, NSD, and PowerDNS

Security:	CVE-2016-6170
Security:	CVE-2016-6171
Security:	CVE-2016-6172
Security:	CVE-2016-6173
Security:	https://vuxml.FreeBSD.org/freebsd/7d08e608-5e95-11e6-b334-002590263bf5.html

Add missing FreeBSD SA vuxml entries for 2013

Entries that only affected BETA/RC releases were ignored

Security:	SA-13:10.sctp
Security:	SA-13:09.ip_multicast
Security:	SA-13:08.nfsserver

Change all FreeBSD SA entries in vuxml from <system> to <package>

Add FreeBSD SA information to recent libarchive vuxml entry

Security:	SA-16:22.libarchive
Security:	SA-16:23.libarchive

Add FreeBSD SA information to old openssl vuxml entry

Security:	SA-16:17.openssl

Add FreeBSD SA information to old ntp vuxml entry

Security:	SA-16:16.ntp

Add FreeBSD SA information to old openssh vuxml entry

Security:	SA-16:14.openssh

Update many historical vuxml entries for FreeBSD with incorrect ranges

PR:		208522

Add FreeBSD SA information to old openssl vuxml entry

Security:	SA-16:11.openssl

Add FreeBSD SA information to old ntp vuxml entry

Security:	SA-16:09.ntp

Add FreeBSD SA information to old bind vuxml entry

Security:	SA-16:08.bind

Add FreeBSD SA information to old openssh vuxml entry

Security:	SA-16:07.openssh

Add FreeBSD SA information to old ntp vuxml entry

Security:	SA-16:02.ntp

Add FreeBSD SA information to old bind vuxml entry

Security:	SA-15:27.bind

Add FreeBSD SA information to old openssl vuxml entry

Security:	SA-15:26.openssl

Add FreeBSD SA information to old ntp vuxml entry

Security:	SA-15:25.ntp

Add FreeBSD SA information to old bind vuxml entry

Also correct range of affected FreeBSD versions

Security:	SA-15:23.bind

Add FreeBSD SA information to old openssh vuxml entry

Security:	SA-15:22.openssh

Add FreeBSD SA information to old bind vuxml entry

Also correct range of affected FreeBSD versions

Security:	SA-15:17.bind

Add FreeBSD SA information to old openssh vuxml entry

Security:	SA-15:16.openssh

Add FreeBSD SA information to old bind vuxml entry

Security:	SA-15:11.bind

Add FreeBSD SA information to old openssl vuxml entry

Security:	SA-15:10.openssl

Add FreeBSD SA information to old ntp vuxml entry

Security:	SA-15:07.ntp

Add FreeBSD SA information to old openssl vuxml entry

Security:	SA-15:06.openssl

Add FreeBSD SA information to old bind vuxml entry

Security:	SA-15:05.bind

Add FreeBSD SA information to old openssl vuxml entry

Security:	SA-15:01.openssl

Add FreeBSD SA info to old unbound vuxml entry

Security:	SA-14:30.unbound

Add FreeBSD SA reference to old bind vuxml entry

Security:	SA-14:29.bind

Update another openssl vuxml entry to add FreeBSD SA information

Security:	SA-14:23.openssl

Add FreeBSD SA information to old openssl vuxml entry

Security:	SA-14:18.openssl

Update another old openssl vuxml entry to add FreeBSD SA information

Security:	SA-14:10.openssl

Update old openssl vuxml entry to include <freebsdsa> information and affected
FreeBSD versions

Add <freebsdsa> to old vuxml entry for openssl

Affected FreeBSD versions were not added as they were all 10.0-RC.

Correct <date> fields for last commit regarding SA 14:02

Add affected FreeBSD versions to vuxml entry for SA-14:02

Correct another FreeBSD SA in an old vuxml entry

Correct FreeBSD SA in old vuxml entry

Document collectd security advisory.

PR:		211613
Security:	CVE-2016-6254

security/vuxml: Add versions for lates MariaDB vulns

PR:		211274

Document multiple security advisories for Moodle (MSA-16-0019 - MSA-16-0021)

Security:	CVE-2016-5012
Security:	CVE-2016-5013
Security:	CVE-2016-5014
Security:	https://vuxml.FreeBSD.org/freebsd/3ddcb42b-5b78-11e6-b334-002590263bf5.html

Document BIND security advisory

Security:	CVE-2016-2775
Security:	https://vuxml.FreeBSD.org/freebsd/7a31e0de-5b6d-11e6-b334-002590263bf5.html

Document wnpa-sec-2016-41 through wnpa-sec-2016-49 for issues fixed in
Wireshark 2.0.5

Security:	CVE-2016-6505
Security:	CVE-2016-6506
Security:	CVE-2016-6508
Security:	CVE-2016-6509
Security:	CVE-2016-6510
Security:	CVE-2016-6511
Security:	CVE-2016-6512
Security:	CVE-2016-6513
Security:	https://vuxml.FreeBSD.org/freebsd/610101ea-5b6a-11e6-b334-002590263bf5.html

Update perl vuxml entries

Perl package names changed somewhat recently, so add more <name> entries
to improve coverage for users on systems with outdated ports/packages

PR:		211561

Cancel tiff vuxml entry for CVE-2016-5102

Upstream has marked it WONTFIX and is removing the utility in 4.0.7.
There is no indication that this bug does anything other than crash the
utility.

Update vuxml entry for perl to correct range for perl5-devel

Fix vuxml entry for recent perl vulnerabilities to correctly match package names

PR:		211561

Document p5-XSLoader vulnerability

PR:		211561
Security:	CVE-2016-6185

Document perl vulnerability

PR:		211561
Security:	CVE-2016-1238

Document gd vulnerabilities

PR:		211562

Document curl vulnerabilities

PR:		211575

Document lighttpd vulnerabilities

PR:		211495

Document Xen Security Advisories (XSAs 182, 183, and 184)

PR:		211482
Security:	CVE-2016-5403
Security:	CVE-2016-6259
Security:	CVE-2016-6258
Security:	https://vuxml.FreeBSD.org/freebsd/06574c62-5854-11e6-b334-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/04cf89e3-5854-11e6-b334-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/032aa524-5854-11e6-b334-002590263bf5.html

Document security issues fixed Libidn 1.33

PR:		211407
Reported by:	Piotr Kubaj <pkubaj@anongoth.pl>
Security:	CVE-2015-8948
Security:	CVE-2016-6261
Security:	CVE-2016-6262
Security:	CVE-2016-6263
Security:	https://vuxml.FreeBSD.org/freebsd/cb5189eb-572f-11e6-b334-002590263bf5.html

document Gimp XCF loader vulnerability

Approved by:	rene (mentor)

With the release of krb5 1.13.6, which also fixes the KDC denial of
service vulnerability (CVE-2016-3120 -- same vulnerability fixed in
krb5 1.14.3), update entry 62d45229-4fa0-11e6-9d13-206a8a720317 to
also document the same in krb5 1.13.6.

Security:	62d45229-4fa0-11e6-9d13-206a8a720317
Security:	CVE-2016-3120

Document xerces-c3 vulnerabilities

PR:		211023
Security:	CVE-2016-2099
Security:	CVE-2016-4463

Document php vulnerabilities

Security:	CVE-2015-8879
Security:	CVE-2016-5385
Security:	CVE-2016-5399
Security:	CVE-2016-6288
Security:	CVE-2016-6289
Security:	CVE-2016-6290
Security:	CVE-2016-6291
Security:	CVE-2016-6292
Security:	CVE-2016-6294
Security:	CVE-2016-6295
Security:	CVE-2016-6296
Security:	CVE-2016-6297

Document new vulnerabilities in www/chromium < 52.0.2743.82

Obtained
from:	https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html

Document a rare KDC denial of service vulnerability when anonymous
client principals are restricted to obtaining TGTs only [CVE-2016-3120]

URL:		http://web.mit.edu/kerberos/krb5-1.14/
Security:	CVE-2016-3120

security/vuxml: Current mysql57 is NOT vulnerable

PR:		211248

Apache OpenOffice CVE-2016-1513 Memory Corruption Vulnerability
(Impress Presentations)

security/vuxml: Add MySQL vulnerabilities from quarterly update

  - Add MariaDB ports
  - Add Percona ports

PR:		211248

Properly cancel the httpoxy vuxml entry

Remove HTTPoxy entry in vuxml until a we know if upstream vendors will
patch this so things aren't marked vulnerable forever.

www/typo3 and www/typo3-lts: Document missing access check in Extbase

PR:          210870, 210871
Security:    CVE-2016-5091
Security:   
https://vuxml.freebsd.org/freebsd/3caf4e6c-4cef-11e6-a15f-00248c0c745d.html
Approved by: junovitch (mentor)

net/haproxy: Mark vulnerable to httpoxy in vuxml

Security:	cf0b5668-4d1b-11e6-b2ec-b499baebfeaf

lang/go: Mark 1.6.3 as NOT vulnerable to httpoxy

  - Version 1.6.3 includes fix for "httpoxy" [1]

1: https://groups.google.com/forum/#!topic/golang-announce/7jZDOQ8f8tM

Security:	cf0b5668-4d1b-11e6-b2ec-b499baebfeaf
Security:	CVE-2016-5386

www/apache24: Fix httpoxy vulnerability (+2.2)

  - Mark new Apache revisions not vulnerable
  - Add apache22-mpm-* ports
  - Add Apache CVE-number

Security:       cf0b5668-4d1b-11e6-b2ec-b499baebfeaf
Security:       CVE-2016-5387

httpoxy: Mark ports as vulnerable

  - apache22, apache24, go, go14, php55, php56, php70, python27, python33,
    python34, python35, nginx are all vulnerable.
  - No new versions fixing the HTTP Proxy header vulnerability

Fix CVE-2016-0772 entry to not blame only Python 2.7

Document security issues from ATutor 2.2.1 and 2.2.2 changelog

Security:	https://vuxml.FreeBSD.org/freebsd/00cb1469-4afc-11e6-97ea-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/ffa8ca79-4afb-11e6-97ea-002590263bf5.html

Update Drupal SA-CORE-2016-002 with the assigned CVEs

PR:		210317
Security:	CVE-2016-6211
Security:	CVE-2016-6212
Security:	https://vuxml.FreeBSD.org/freebsd/7932548e-3427-11e6-8e82-002590263bf5.html

Document Flash vulnerabilities in Adobe Security Bulletins APSB16-25

Security:	CVE-2016-4172
Security:	CVE-2016-4173
Security:	CVE-2016-4174
Security:	CVE-2016-4175
Security:	CVE-2016-4176
Security:	CVE-2016-4177
Security:	CVE-2016-4178
Security:	CVE-2016-4179
Security:	CVE-2016-4180
Security:	CVE-2016-4181
Security:	CVE-2016-4182
Security:	CVE-2016-4183
Security:	CVE-2016-4184