Add basic imagemagick entry.

Fix affected versions

Document Jenkins Security Advisory 2016-05-11

Document Perl taint protection bypass vulnerability

PR:		208879
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2016-2381
Security:	https://vuxml.FreeBSD.org/freebsd/d9f99491-1656-11e6-94fa-002590263bf5.html

Document Wordpress vulnerabilities fixed in 4.5.2

PR:		209409
PR:		209378 [1]
Reported by:	Mihail Timofeev <9267096@gmail.com> [1]
Security:	CVE-2016-4566
Security:	CVE-2016-4567
Security:	https://vuxml.FreeBSD.org/freebsd/3686917b-164d-11e6-94fa-002590263bf5.html

Fix version range for libarchive entry. [1]

While here, add CVE and wrap lines at <80

PR:		209404 [1]
Reported by:	dereks@lifeofadishwasher.com [1]
Security:	CVE-2016-1541
Security:	https://vuxml.FreeBSD.org/freebsd/2b4c8e1f-1609-11e6-b55e-b499baebfeaf.html

security/vuxml: Add entry for libarchive

  - Vulnerable < 2.3.0

Reviewed by:	feld (mentor)
Approved by:	feld (mentor, ports-secteam)
Security:	CVE-2016-1541

Update recent squid, squid-devel entry to add CVE Numbers

Document three security advisories for the squid and squid-devel
ports.  CVE numbers are not yet available.

PR:		209334
Submitted by:	timp87@gmail.com (maintainer)

Add forgotten portepoch to the ImageMagick 6.x version.

PR:		209241
Reported by:	Ben Woods, Jason Unovitch

Document ImageMagick vulnabilities.

PR:		209241
Submitted by:	Ben Woods

Add entry of devel/jansson

PR:		209219
Submitted by:	junovitch@

Fix <url> -> <cvename> tags in OpenSSL entry plus spacing fixes.

While here, combine both entries as they both refer to the same CVEs and
we've typically done these as combined entries in the past.

security/vuxml: Document LibreSSL vulnerabilities

Reviewed by:	swills
MFH:		2016Q3

security/vuxml: Document OpenSSL 1.0.2g vulnerabilities

Reviewed by:	swills
MFH:		2016Q2

Document gitlab privilege escalation via "impersonate" feature

PR:		209225
Reported by:	Torsten Zuehlsdorff <ports@toco-domains.de>
Security:	CVE-2016-4340
Security:	https://vuxml.FreeBSD.org/freebsd/be72e773-1131-11e6-94fa-002590263bf5.html

Document php multiple vulnerabilities

PR:		209145
Reported by	Christian Schwarz <me@cschwarz.com>
Security:	CVE-2016-3074
Security:	https://vuxml.FreeBSD.org/freebsd/5764c634-10d2-11e6-94fa-002590263bf5.html

Document libksba local denial of service vulnerabilities

Security:	CVE-2016-4353
Security:	CVE-2016-4354
Security:	CVE-2016-4355
Security:	CVE-2016-4356
Security:	https://vuxml.FreeBSD.org/freebsd/a1134048-10c6-11e6-94fa-002590263bf5.html

Document denial of service advisories from Wireshark's recent release

Security:	https://vuxml.FreeBSD.org/freebsd/7e36c369-10c0-11e6-94fa-002590263bf5.html

Document arbitrary code execution vulnerability in Mercurial

Security:	CVE-2016-3105

security/vuxml: Add entry for MySQL/MariaDB/Percona April Critical Patch Update

  - Add entry for 31 security fixes for Oracle MySQL
  - Add also affected MariaDB packages
  - Add also affected Percona packages

Reviewed by:	junovitch (ports-secteam)
Approved by:	junovitch (ports-secteam)
Differential Revision:	D6159

Logstash password disclosure vulnerability.

  Add two CVEs for subversion:

   http://subversion.apache.org/security/CVE-2016-2167-advisory.txt
   http://subversion.apache.org/security/CVE-2016-2168-advisory.txt

Document NTP multiple vulnerabilities.

Document recent Firefox vulnerabilities

Document phpmyfaq vulnerability

Security:	https://vuxml.freebsd.org/freebsd/f87a9376-0943-11e6-8fc4-00a0986f28c4.html
Security:	http://www.phpmyfaq.de/security/advisory-2016-04-11
Sponsored by:	Essen Linuxhotel Hackathon 2016

Document libtasn1 denial of service via parsing malicious DER certificates

Security:	CVE-2016-4008
Security:	https://vuxml.FreeBSD.org/freebsd/1b0d2938-0766-11e6-94fa-002590263bf5.html

Document squid -- multiple vulnerabilities

PR:		208939
Reported by:	Pavel Timofeev <timp87@gmail.com>
Security:	CVE-2016-4054
Security:	CVE-2016-4053
Security:	CVE-2016-4052
Security:	CVE-2016-4051
Security:	https://vuxml.FreeBSD.org/freebsd/e05bfc92-0763-11e6-94fa-002590263bf5.html

CVE-2016-3096 -- ansible and ansible1 vulnerability due to using
predictable temporary file names when managing LXC containers.

Document security vulnerability in proftpd mod_tls.

PR:		208876
Security:	CVE-2016-3125

Doument new vulnerabilities in www/chromium < 50.0.2661.75

Obtained
from:	http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html

Document wpa_supplicant security advisories

PR:		208482
Security:	CVE-2015-5310
Security:	CVE-2015-5315
Security:	CVE-2015-5316
Security:	https://vuxml.FreeBSD.org/freebsd/976567f6-05c5-11e6-94fa-002590263bf5.html

Document earlier dhcpcd security issue that has been fixed in an earlier
version before the security implications were reported.

PR:		208840
Submitted by:	Ben Woods <woodsb02@gmail.com>
Submitted by:	Roy Marples <roy@marples.name>
Security:	CVE-2014-7912
Security:	https://vuxml.FreeBSD.org/freebsd/092156c9-04d7-11e6-b1ce-002590263bf5.html

Document dhcpcd security remote execution/denial of service

PR:		208840
Submitted by:	Ben Woods <woodsb02@gmail.com>
Security:	CVE-2014-7913
Security:	https://vuxml.FreeBSD.org/freebsd/6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1.html

Document Asterisk and PJsip vulnerabilities.

Document go remote denial of service

Security:	CVE-2016-3959
Security:	https://vuxml.FreeBSD.org/freebsd/f2217cdf-01e4-11e6-b1ce-002590263bf5.html

Document linux-c6-nspr which was overlooked in previous vuxml entry

Multiple vulnerabilities in Samba.
[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
(crashes and high cpu consumption) and man in the middle attacks.
[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected. A
man in the middle is able to clear even required flags,
    especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.
[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
attackers to spoof the computer name of a secure channel's endpoints,
    and obtain sensitive session information, by running a crafted application
and leveraging the ability to sniff network traffic.
[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections to no
integrity protection.
[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
connections (with ldaps://) and ncacn_http connections (with https://).
[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if
explicitly configured.
[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
the default for most the file server related protocols) is inherited
    from the underlying SMB connection.
[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC
traffic between a client and a server in order to impersonate the client
    and get the same privileges as the authenticated user account. This is most
problematic against active directory domain controllers.
Security:	CVE-2015-5370
		CVE-2016-2110
		CVE-2016-2111
		CVE-2016-2112
		CVE-2016-2113
		CVE-2016-2114
		CVE-2016-2115
		CVE-2016-2118
Sponsored by:	Micro$oft

Document multiple vulnerabilities from the 31 Mar 16 PHP releases

PR:		208465
Reported by	Christian Schwarz <me@cschwarz.com>
Security:	https://vuxml.FreeBSD.org/freebsd/482d40cb-f9a3-11e5-92ce-002590263bf5.html

Document PCRE heap overflow vulnerability

PR:		208260
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2016-1283
Security:	https://vuxml.FreeBSD.org/freebsd/497b82e0-f9a0-11e5-92ce-002590263bf5.html

Document djblets vulnerability from the 0.9.2 release notes

Security:	https://vuxml.FreeBSD.org/freebsd/df328fac-f942-11e5-92ce-002590263bf5.html

Document multiple security advisories for Moodle

Security:	CVE-2016-2151
Security:	CVE-2016-2152
Security:	CVE-2016-2153
Security:	CVE-2016-2154
Security:	CVE-2016-2155
Security:	CVE-2016-2156
Security:	CVE-2016-2157
Security:	CVE-2016-2158
Security:	CVE-2016-2159
Security:	CVE-2016-2190
Security:	https://vuxml.FreeBSD.org/freebsd/a430e15d-f93f-11e5-92ce-002590263bf5.html

Add additional reference URL for Kamailio entry from r411376

Security:	CVE-2016-2385
Security:	https://vuxml.FreeBSD.org/freebsd/c428de09-ed69-11e5-92ce-002590263bf5.html

Document squid multiple vulnerabilities

PR:		208463
Security:	CVE-2016-3947
Security:	CVE-2016-3948
Security:	https://vuxml.FreeBSD.org/freebsd/297117ba-f92d-11e5-92ce-002590263bf5.html

Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight

This CVE is actually for the -contrib module:

Security: CVE-2016-3065

Add vuxml entries for "Security Fixes for RLS, BRIN"
in PostgreSQL 9.5

Security:	CVE-2016-2193
Security:	CVE-2016-3065

Document latest batch of flash plugin vulnerabilities.

Document mutiple Botan vulnerabilities.

PR:		208393
Submitted by:	Lapo Luchini <lapo at lapo.it>
Security:	CVE-2015-5726
Security:	CVE-2015-5727
Security:	CVE-2016-2194
Security:	CVE-2016-2195

Document multiple Mercurial vulnerabilities

Security:	CVE-2016-3630
Security:	CVE-2016-3068
Security:	CVE-2016-3069

Document chromium vulnerabilities

Approved by:	miwi (mentor), rene (mentor)

Document BIND security advisories

PR:		208034
Reported by:	martin@lispworks.com
Security:	CVE-2016-1285
Security:	CVE-2016-1286
Security:	CVE-2016-2088
Security:	https://vuxml.FreeBSD.org/freebsd/c9075321-f483-11e5-92ce-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/cba246d2-f483-11e5-92ce-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/cd409df7-f483-11e5-92ce-002590263bf5.html

Syntax fix, drop leading FreeBSD- in <freebsdsa> tags as it caused links with
a FreeBSD-FreeBSD-SA starting the URL.

Document Salt Insecure configuration of PAM external authentication service

PR:		208244
Security:	CVE-2016-3176
Security:	https://vuxml.FreeBSD.org/freebsd/6d25c306-f3bb-11e5-92ce-002590263bf5.html

Document multipule activemq vulnerabilities:
	CVE-2016-0782 - ActiveMQ Web Console - Cross-Site Scripting
	CVE-2016-0734 - ActiveMQ Web Console - Clickjacking
	CVE-2015-5254 - Unsafe deserialization in ActiveMQ

PR:		208163
PR:		208193
Security:	CVE-2015-5254
Security:	http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt
Security:	CVE-2016-0782
Security:	http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt
Security:	CVE-2016-0734
Security:	http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt

Fix version range for pcre2 vulnerability

PR:		208167
Security:	CVE-2016-3191

Document pcre vulnerability

PR:		208167
Security:	CVE-2016-3191

Document kamailio SEAS Module Heap overflow vulnerability

Security:	CVE-2016-2385
Security:	https://vuxml.FreeBSD.org/freebsd/c428de09-ed69-11e5-92ce-002590263bf5.html

Document hadoop2 unauthorized disclosure of data vulnerability

Security:	CVE-2015-1776
Security:	https://vuxml.FreeBSD.org/freebsd/5dd39f26-ed68-11e5-92ce-002590263bf5.html

Update git packages and versions affected by CVE-2016-2324

MFH:		2016Q1
Sponsored by:	Rubicon Communications (Netgate)

Document possible code execution and integer overflow issue in git

PR:		208074
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk> (via PR)
Reported by:	Tony Tung <tonytung@merly.org> (via email)
Security:	CVE-2016-2315
Security:	CVE-2016-2324
Security:	https://vuxml.FreeBSD.org/freebsd/93ee802e-ebde-11e5-92ce-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/d2a84feb-ebe0-11e5-92ce-002590263bf5.html

Document node vulnerabilities

PR:		207832
Security:	CVE-2016-0702
Security:	CVE-2016-0705
Security:	CVE-2016-0797

Document dropbear security vulnerability

PR:		207903
Security:	CVE-2016-3116

Document assigned CVE for recent ssh vulnerability

Security:	CVE-2016-3115

Document one more graphite2 vulnerability

Fix copy/paste error from previous commit

Document XSS vulnerability in graphics/jpgraph2 before 3.0.7_1

PR:		207001
Security:	CVE-2009-4422

Document issues in recent PHP security release

Security:	https://vuxml.FreeBSD.org/freebsd/e991ef79-e920-11e5-92ce-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/5af511e5-e928-11e5-92ce-002590263bf5.html

Expand February PHP entry with extra CVE and all security bugs on changelog

Security:	CVE-2016-2554
Security:	https://vuxml.FreeBSD.org/freebsd/85eb4e46-cf16-11e5-840f-485d605f4717.html

Document OpenSSH 7.2p2 fix for X11Forwarding command injection

Document net/quagga vulnerability

Security:	CVE-2016-2342

net-im/ricochet: Document vulnerability

PR:		207536

Document security/pidgin-otr vulnerability

Security:	CVE-2015-8833

Update libotr vulnerability information

Correct description is "integer overflow"

libotr3 has also been added as vulnerable. It appears vulnerable as it
also has datalen defined as unsigned int and identical functions.

Security:	http://www.vuxml.org/freebsd/c2b1652c-e647-11e5-85be-14dae9d210b8.html

Document security/libotr vulnerability

It is not clear at this time if security/libotr3 is also affected.

Security:	CVE-2016-2851

Adjust brotli vulnerability after MFH in r410670

Adjust brotli vulnerability after r410664

Move brotli to its own entry

Document recent Firefox vulnerabilities

Document Django multiple vulnerabilities

Security:	CVE-2016-2512
Security:	CVE-2016-2513
Security:	https://vuxml.FreeBSD.org/freebsd/f9e6c0d1-e4cc-11e5-b2bd-002590263bf5.html

Wrap long lines.  No content change.

Document Wordpress multiple vulnerabilities

While here, fix URL reference in last Wordpress entry

Security:	CVE-2016-2221
Security:	CVE-2016-2222
Security:	https://vuxml.FreeBSD.org/freebsd/fef03980-e4c6-11e5-b2bd-002590263bf5.html

Add CVE Names for old asterisk vulnerabilities.

New: remote buffer overflow in PuTTY < 0.67's scp documented

Security:	CVE-2016-2563

Add entries for CVE-2013-6892 and CVE-2016-2511 in devel/websvn.

Security:	CVE-2013-6892
Security:	CVE-2016-2511

- Document Ruby on Rails multiple vulnerabilities

Document recent chromium vulnerabilities

Approved by:	miwi (mentor), rene (mentor)
Obtained
from:	http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html

Make 7d09b9ee-e0ba-11e5-abc4-6fb07af136d2 pass `make validate'.

Add entry for security/libssh's CVE-2016-0739.

This was fixed in r409932, but the 2016Q1 branch is still vulnerable.

Document the latest exim vulnerability - local privilleges escalation via
insecure environment when using `perl_startup` option and setuid exim.

Update graphite vuxml entry to add another relevant URL

PR:		207574

Document SQL injection and authentication bypass in Cacti

Note CVE-2015-8369/upstream bug 0002646: SQL injection in graph.php
was also fixed in this release but that was backported to 0.8.8f and is
covered in a prior entry.

PR:		207444
Security:	CVE-2015-8377
Security:	CVE-2015-8604
Security:	CVE-2016-2313
Security:	https://vuxml.FreeBSD.org/freebsd/db3301be-e01c-11e5-b2bd-002590263bf5.html

Document the latest round of phpMyAdmin vulnerabilities.  Lots of XSS
problems, and a man-in-the-middle attack on API calls to GitHub.

Document wireshark multiple vulnerabilities

Security:	CVE-2016-2522
Security:	CVE-2016-2523
Security:	CVE-2016-2524
Security:	CVE-2016-2525
Security:	CVE-2016-2526
Security:	CVE-2016-2527
Security:	CVE-2016-2528
Security:	CVE-2016-2529
Security:	CVE-2016-2530
Security:	CVE-2016-2531
Security:	CVE-2016-2532
Security:	https://vuxml.FreeBSD.org/freebsd/45117749-df55-11e5-b2bd-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/42c2c422-df55-11e5-b2bd-002590263bf5.html

Update www/tomcat7 version.

Update tomcat vuxml entry

CVE-2015-5346 does not affect Tomcat 6.

Document additional tomcat vulnerabilities

Security:	CVE-2015-5346
Security:	CVE-2015-5351
Security:	CVE-2016-0763

Update documented tomcat vulnerabiltiies

Document tomcat vulnerabilities

Security:	CVE-2016-0714

Document vulnerability i xerces-c3

Security:	CVE-2016-0729