document possible vulnerabilities in sysutils/py-salt

PR:		200172
Submitted by:	Sevan Janiyan <venture37@geeklan.co.uk>

Add entry for mail/davmail.

PR:		198297
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
Approved by:	<john.c.prather@gmail.com> (maintainer (timeout))

Document dnsmasq and -devel vulnerabilities (CVE-2015-3294 and one other in rc).

Document PCRE and PHP multiple vulnerabilities.

Correct PR number.

Submitted by:	jason.unovitch gmail.com

Record some minor PostgreSQL sercurity problems.

"This update fixes three security vulnerabilities reported in PostgreSQL over
the past few months. Nether of these issues is seen as particularly urgent.
However, users should examine them in case their installations are vulnerable."

URL:	http://www.postgresql.org/about/news/1587/

Pass full path to the vuln.xml file to extra-validation.py.  Without this,
if .OBJDIR differs from .CURDIR, the validation would fail.

PR:		193923
Reported by:	jbeich

Document CVE-2015-3306 proftpd mod_copy unauthenticated copying of files
vulnerability.

Document vulnerability in security/ipsec-tools.

PR:		200334
Approved by:	bdrewery (mentor)

Document new vulnerabilities in www/chromium < 43.0.2357.65

Obtained
from:	http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html

Document ClamAV multiple vulnerabilities.

security/vuxml: Add CVE-2015-3900 entry for devel/ruby-gems

PR:		200264
Differential Revision:	https://reviews.freebsd.org/D2572
Approved by:	mat (mentor)
Security:	CVE-2015-3900

Document qemu "VENOM" vulnerability - CVE-2015-3456

PR:		200255
PR:		200256
PR:		200257
Submitted by:	venture37@geeklan.co.uk
Security:	http://vuxml.FreeBSD.org/freebsd/2780e442-fc59-11e4-b18b-6805ca1d3bb1.html

Document Quassel IRC vulnerability CVE-2015-3427

Correct entry for apache-openoffice-* / libreoffice CVE-2015-1774 so
that apache-openoffice-4.1.1_9 is not incorrectly flagged as vulnerable.

Approved by:	mat (mentor, implicit)

security/vuxml: document vulnerability in rubygem-redcarpet <3.2.3

PR:		200195
Differential Revision:	https://reviews.freebsd.org/D2548
Submitted by:	Sevan Janiyan <venture37@geeklan.co.uk>
Approved by:	mat (mentor)

security/vuxml: Add CVE-2015-3885 entry for graphics/ufraw

PR:		200197

Record two new phpMyAdmin security vulnerabilities

Document multiple vulnerabilities in www/linux-*-flashplugin11.

Security:	CVE-2015-3044
Security:	CVE-2015-3077
Security:	CVE-2015-3078
Security:	CVE-2015-3079
Security:	CVE-2015-3080
Security:	CVE-2015-3081
Security:	CVE-2015-3082
Security:	CVE-2015-3083
Security:	CVE-2015-3084
Security:	CVE-2015-3085
Security:	CVE-2015-3086
Security:	CVE-2015-3087
Security:	CVE-2015-3088
Security:	CVE-2015-3089
Security:	CVE-2015-3090
Security:	CVE-2015-3091
Security:	CVE-2015-3092
Security:	CVE-2015-3093

VuXML: document recent mozilla vulnerabilities

security/vuxml: Add CVE-2015-0971 entry for security/suricata

Revert r385940,r385932,r385864:

The usage of * is actually valid, as pointed out at the FreeBSD porter's
handbook:

https://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html

Which denotes "the smallest version number" (in other words, * < 0).

Requested by:	many
Pointy hat to:	delphij

Add entry for CVE-2015-3146 in security/libssh.

- fix a second postfix entry

PR:			200089 (followup)

Correct version range.

PR:		200089

* is not valid for version number, replace all instances with 0 and bump
modification date.

Submitted by:	Chris Nehren <cnehren tenable com> (version number part)

VuXML: update sqlite3 entry with verbose descriptions. CVE-2015-341[4-6]

PR:		199483

Document HWP filter vulnerability in editors/libreoffice < 4.3.7 and
editors/openoffice < 4.1.2, CVE-2015-1774.

Approved by:	mat (mentor)
Differential Revision:	https://reviews.freebsd.org/D2475

Document current and previous wordpress vulnabilities.

Fix version range of two ancient items.

Submitted by:	Chris Nehren <cnehren tenable com>

Add entry for powerdns and powerdns-recursor.

Approved by:	bdrewery (mentor)

Document new vulnerabities in www/chromium < 42.0.2311.135

Obtained
from:	http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html

Document new vulnerabilities in www/chromium < 42.0.2311.90

Obtained
from:	http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html

security/vuxml: Add entry for security/wpa_supplicant

Security:	CVE-2015-1863
PR:		199678

Document PHP multiple vulnerabilities.

Submitted by:	Bernard Spil <spil.oss gmail com>

There are actualy two chinese wordpress ports, which have both different
suffixes. List them both.

Add wordpress vulnabilities.

Add an entry for security/libtasn1 vulnerability.

Security:	CVE-2015-2806

Document new Firefox vulnerability. CVE-2015-2706

Document sqlite3 multiple vulnerabilites

PR:		199483

Document chrony multiple vulnerabilites.

PR:		199508

Document new Dulwich vulnerability. CVE-2015-0838

PR:		199162
Submitted by:	Marco Broder (maintainer)

Register Flash vulnerabilities.
Affected: www/linux-*-flashplugin11.

Document Wesnoth vulnerability. CVE-2015-0844

PR:		199414

Add entry for CVE-2015-1858, CVE-2015-1859 and CVE-2015-1860.

Multiple vulnerabilities in Qt image format handling (the 3 CVEs are part of
the same security advisory).

Document issues in ruby

Add mailman < 2.1.20 vulnerability.

Port update to arrive shortly.

Document new asterisk ports vulnerability.

Document NTP multiple vulnerabilities.

Document mozilla vulnerabilities in Firefox 37.0

Document multiple vulnerabilities in multimedia/libav prior to version 11.3

PR:		198873
Submitted by:	venture37@geeklan.co.uk
MFH:		2015Q2

Document multiple vulnerabilities of PHP.

Submitted by:	Bernard Spil <bernard bachfreund nl>

- document subversion issues
  http://subversion.apache.org/security/

Security:	 CVE-2015-0202
Security:	 CVE-2015-0248
Security:	 CVE-2015-0251

Document mozilla vulnerabilities

Add vulnerability for devel/osc.

Security:	CVE-2015-0778
PR:		198876
Submitted by:	venture37@geeklan.co.uk

Document GNU cpio vulnerabilities CVE-2014-9112 and CVE-2015-1197.

Document libzip vulnerability CVE-2015-2331

Document django vulnerability CVE-2015-2316 and CVE-2015-2317

Revert my previous commit.

Convert non-ASCII quotes to ASCII characters

Approved by: mat (mentor)

- fixing package name

$ make -C /usr/ports/devel/mingw64-binutils/ -V PKGNAME
x86_64-pc-mingw32-binutils-2.23.2_1

- Fix vuxml build: bad package names in f6a014cd-d268-11e4-8339-001e679db764
- Fix blockquote style to match rest

The ancient version of binutils in the cross-binutils port suffers for
several vulnerabilities.

This also effects devel/mingw64-binutils.

PR:		198816
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>

Document nodejs (libuv) CVE-2015-0278.

PR:		198861
Submitted by:	venture37@geeklan.co.uk

Document vulnerable linux-c6-openssl versions in vuxml entry from 2015-03-19

Approved by:    swills (mentor)

Document Jenkins Security Advisory 2015-03-23

Document mozilla issues disclosed at HP Zero Day Initiative's Pwn2Own

Mention LibreSSL too.  Use <ul>'s per suggestion from vsevolod [1].

PR:		198718 [1]

Document OpenSSL multiple vulnerabilities.

Record new libXfont security issues.

Add latest security vulnerabilities in linux-*-flashplugin11:

	CVE-2015-0332
	CVE-2015-0333
	CVE-2015-0334
	CVE-2015-0335
	CVE-2015-0336
	CVE-2015-0337
	CVE-2015-0338
	CVE-2015-0339
	CVE-2015-0340
	CVE-2015-0341
	CVE-2015-0342

Differential Revision:	https://reviews.freebsd.org/D2061
Approved by:		swills (mentor)

Add vulnerability for mail/sympa.

Approved by:	bapt
Security:	CVE-2015-1306

Document latest security vulnerabilities in rt42 and rt40:

      CVE-2014-9472
      CVE-2015-1165
      CVE-2015-1464

Document the latest phpMyAdmin vulnerability:  CVE-2015-2206

Document mono TLS bugs.

Reported by:	delphij

Document recently fixed PuTTY < 0.64 vuln. CVE-2015-2157.

Document new vulnerabilities in www/chromium < 41.0.2272.76

Submitted by:	Carlos Jacobo Puga Medina
Obtained from:	http://googlechromereleases.blogspot.nl/

Add entry for CVE-2015-0295 in qt4-gui and qt5-gui.

Add entry for security issue in jenkins

Reviewed by:	zi

Fix typo: s/MSFA/MFSA/. The source to follow later.

https://bugzilla.mozilla.org/show_bug.cgi?id=1137604

Document mozilla vulnerabilities

Document vulnerablities in php for CVE-2015-0235 and CVE-2015-0273.

Approved by:	zi (mentor)

Document bugs fixed in krb5 1.11.6.

* Handle certain invalid RFC 1964 GSS tokens correctly to avoid
  invalid memory reference vulnerabilities.  [CVE-2014-4341
  CVE-2014-4342]

* Fix memory management vulnerabilities in GSSAPI SPNEGO.
  [CVE-2014-4343 CVE-2014-4344]

* Fix buffer overflow vulnerability in LDAP KDB back end.
  [CVE-2014-4345]

* Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354 CVE-2014-5353]

* Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-9421 CVE-2014-9422
  CVE-2014-9423]

Security:	CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344
		CVE-2014-4345, CVE-2014-5354, CVE-2014-5353, CVE-2014-5352
		CVE-2014-9421, CVE-2014-9422, CVE-2014-9423

Document Samba remote code execution vulnerability.

Record two e2fsprogs vulnerabilities.CVE-2015-0247
    <URL:http://vuxml.freebsd.org/0f488b7b-bbb9-11e4-903c-080027ef73ec.html>

    Topic: e2fsprogs -- potential buffer overflow in closefs()
    Affects:
        e2fsprogs < 1.42.12_2
	References:
	   
url:http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73
	        cvename:CVE-2015-1572
		<URL:http://vuxml.freebsd.org/2a4bcd7d-bbb8-11e4-903c-080027ef73ec.html>

Security:	CVE-2015-0247
Security:	CVE-2015-1572
Security:	0f488b7b-bbb9-11e4-903c-080027ef73ec
Security:	2a4bcd7d-bbb8-11e4-903c-080027ef73ec.html

Document BIND DoS issue with trust anchor management.

Kerberos Version 5, Release 1.12.3 is released affecting
security/krb5-112. This fixes multiple vulnerabilities, some previously
committed by point patches and others newly fixed in this release.

* Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354] [CVE-2014-5353]

* Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421
  CVE-2014-9422 CVE-2014-9423]

Security:	CVE-2014-5354, CVE-2014-5353
Security:	CVE-2014-5352, CVE-2014-5352, CVE-2014-9421
Security:	CVE-2014-9422, CVE-2014-9423

Document unzip heap based buffer overflow in iconv patch.

PR:		ports/197772

Add modified date to entries I touched recently.

Noticed by:	kwm (thanks)

Add CVE number to asterisk advisory.

Backported patches for CVE-2014-5353 and CVE-2014-5354 received from MIT
for krb5-111 and krb5-112.

Obtained from:	Greg Hudson <ghudson@mit.edu>
Security:	CVE-2014-5353, CVE-2014-5354

- Additional fixes from the krb5 commit

- Correct errors in previous commit to resolve build

Document new krb5 vulnerabilities.

Security:	CVE-2014-5353, CVE-2014-5354

The xorg-server entry in commit 378888, also mention portepoch for the other
version we want to check.

Document xorg-server CVE-2015-0255.

Information leak in the XkbSetGeometry request of X servers

In r378499, PostgreSQL package names where not version-suffixed. Fixed this.
Submitted by:	kuriyama@

Fix CVE name for www/chromium entry

Submitted by:	bz via bot

Document two recent OpenLDAP DoS issues.

Document new vulnerabilities in www/chromium < 40.0.2214.111

Submitted by:	Carlos Jacobo Puga Medina
Obtained from:	http://googlechromereleases.blogspot.nl/