security/vuxml: document electron{31,32} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.1,
	 	https://github.com/electron/electron/releases/tag/v32.2.1

security/vuxml: Document element-web vulnerability

security/vuxml: document VSCode remote code execution vulnerability

Obtained from:	https://github.com/microsoft/vscode/issues/230824

security/vuxml: Fix typo in firefox entry

Reported by:	jbeich@

security/vuxml: Add firefox{-esr} use-after-free code execution

CVE-2024-9680

security/vuxml: document gitlab vulnerabilities

security/vuxml: Add record for www/gitea: Fix bug when a token is given public
only

PR:	281949

security/vuxml: Add record about CVE-2024-25590 in dns/powerdns-recursor

PowerDNS Recursor Security Advisory 2024-04:
https://blog.powerdns.com/2024/10/03/powerdns-recursor-4-9-9-5-0-9-5-1-2-released

PR:	281914

security/vuxml: add www/*chromium < 129.0.6668.{89,100}

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html
Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html

security/vuxml: Fix Thunderbird version

PR:		281960
Reported by:	John Hein <jcfyecrayz@liamekaens.com>
Fixes:		86d1aa3caa24c97cdc63962d13fef16be12c84b7

security/vuxml: document unbound vulnerability

PR:		281894
Security:	CVE-2024-8508
Security:	2368755b-83f6-11ef-8d2e-a04a5edf46d9

security/vuxml: Mark zeek < 7.0.3 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.3

This release fixes the following potential DoS vulnerability:

 - Adding to the POP3 hardening in 7.0.2, the parser now simply
   discards too many pending commands, rather than any attempting
   to process them. Further, invalid server responses do not result
   in command completion anymore. Processing out-of-order commands
   or finishing commands based on invalid server responses could
   result in inconsistent analyzer state, potentially triggering
   null pointer references for crafted traffic.

Reported by:	Tim Wojtulewicz

security/vuxml: Fix name tag for textproc/expat2

Reported by:	Adam McDougall <mcdouga9@egr.msu.edu>
Fixes:		47955717fc53

security/vuxml: Add firefox{-esr}, thunderbird vulnerabilities

CVE-2024-9392
CVE-2024-9396
CVE-2024-9400
CVE-2024-9401
CVE-2024-9402
CVE-2024-9403

security/vuxml: Update range of redis in 8b20f21a-8113-11ef-b988-08002784c58d

In 2024Q3 branch databases/redis still stays in 7.2.x.

Fixes:		e44e4021e418

security/vuxml: Document Jenkins Security Advisory 2024-10-02

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document multiple valnerabilities in Redis and Valkey

security/vuxml: Document PHP vulnerabilities

  There were 4 vulnerabilities found and fixed in PHP.

PR:		281770
Reported by:	FiLis <freebsdbugs@filis.org>

security/vuxml: Update cups-filters entry

security/vuxml: Add CVE-2022-45197

security/vuxml: add www/*chromium < 129.0.6668.70

Obtained
from:	https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html

security/vuxml: Fix typos

Add linux-*-sqlite3 to last entry.
s/mozilla/firefox in an older entry

Reported by:	Edward Sanford Sutton, III (mirror176@hotmail.com)

security/vuxml: Add sqlite use after free vulnerability

CVE-2024-0232
  * Base Score:	5.5 MEDIUM
  * Vector:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

security/vuxml: Add cups-browsed RCE

security/vuxml: Add textproc/expat2 vulnerabilities

CVE-2024-45490
CVE-2024-45491
CVE-2024-45492

PR:		281738
Reported by:	FiLiS <freebsdbugs@filis.org>

security/vuxml: document gitlab vulnerabilities

security/vuxml: document frr vulnerabilities

security/vuxml: Update zeek range for 6.X

Really, it was silly of me to add the <ge> range since there were
no commited 6.X versions that were not vulnerable to the new issue.

security/vuxml: Mark zeek < 7.0.2 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.2

This release fixes the following potential DoS vulnerability:

 - The POP3 parser has been hardened to avoid unbounded state growth
   in the face of one-sided traffic capture or when enabled for
   non-POP3 traffic.

Reported by:	Tim Wojtulewicz

security/vuxml: belatedly add FreeBSD SAs issued on 2024-08-07

FreeBSD-SA-24:05.pf affects all supported versions of FreeBSD
FreeBSD-SA-24:06.ktrace affects all supported versions of FreeBSD
FreeBSD-SA-24:07.nfsclient affects all supported versions of FreeBSD

security/vuxml: complete FreeBSD reference for CVE-2024-7589

FreeBSD-SA-24:08.openssh was issued on 2024-08-07 to address
CVE-2024-7589.  All supported versions of FreeBSD were affected.

While here, correct minor markup nits in the vuxml entry.

security/vuxml: reference FreeBSD-SA-24:04.openssh in CVE-2024-6387

All supported versions of FreeBSD were affected by CVE-2024-6387,
announced on 2024-07-01.  Reference FreeBSD-SA-24:04.openssh in the
vuxml entry.

security/vuxml: add FreeBSD SAs issued on 2024-09-19

FreeBSD-SA-24:15.bhyve affects all supported versions of FreeBSD
FreeBSD-SA-24:16.libnv affects all supported versions of FreeBSD

security/vuxml: document gitlab vulnerability

security/vuxml: correct vulnerable package range for nginx

14dc2636e72c396459a6559868033910ee8a4532 added a new vuxml entry, but
forgot to account for PORTEPOCH.

PR:		281250
Approved by:	maintainer timeout
Security:	CVE-2024-7347

security/vuxml: Document OpenSSH's CVE-2024-7589

Sponsored by:	Klara, Inc.

security/vuxml: Document multiple mXSS vulnerabilities in SnappyMail

security/vuxml: Fix entry

Correct number of recorded CVEs.

Fixes:	019e45d60224

security/vuxml: add www/*chromium < 128.0.6613.137

Obtained
from:	https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document Intel CPU vulnerabilities

Security:	CVE-2024-23984
Security:	CVE-2024-24968
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document multiple vulnerabilities in ClamAV

security/vuxml: Document recent netatalk3 CVEs

security/vuxml: add minio vulnerabilities

PR:		281362
Reported by:	tom@eborcom.com

security/vuxml: Fix firefox version

Reported by:	bapt@

security/vuxml: Record firefox vulnerability

CVE-2024-7652

security/vuxml: Fix topic

Reported by:	jhaley@
Fixes:		05d4a95e7f58

security/vuxml: really fix versionning for firefox

in 8a5936ed301ec363fd7e80762e74bacf0d69fd05 I added the missing
portepoch except I added the wrong one, portepoch is at 2, not at 1

Reported by:	Piotr Smyrak <piotr@smyrak.com>

security/vuxml: Add exiv2 >= 0.28.0 and < 0.28.3

security/vuxml: Add www/forgejo < 8.0.3 and www/forgejo7 < 7.0.9

PR:	281314

security/vuxml: Add portepoch

Noted by:	bapt
Pointy hat to:	cy

security/vuxml: devel/binutils: Correct reporting URL

security/vuxml: Add devel/binutils < 2.43

www/gitea: Update 1.21.11 → 1.22.2 (fixes security vulnerabilities)

Changelogs:
https://github.com/go-gitea/gitea/releases/tag/v1.22.0
https://github.com/go-gitea/gitea/releases/tag/v1.22.1
https://github.com/go-gitea/gitea/releases/tag/v1.22.2

While here replace spaces with tabs in Makefile.

PR:	281298
MFH:	2024Q3

security/vuxml: Fix the name of CVE-2024-43110

Sponsored by:	The FreeBSD Foundation

security/vuxml: Add www/qt5-webengine < 5.15.17p3

security/vuxml: Firefox multiple vulnerabilities

 CVE-2024-8381:
    * Base Score:	9.8 CRITICAL
    * Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 CVE-2024-8382:
    * Base Score:	8.8 HIGH
    * Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

 CVE-2024-8383:
    * Base Score:	7.5 HIGH
    * Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 CVE-2024-8384:

security/vuxml: reference FreeBSD-SA-24:13.openssl

Add a reference to FreeBSD-SA-24:13.openssl (issued 2024-09-04) to the
vuxml entry for OpenSSL CVE-2024-6119.

FreeBSD-SA-24:13.openssl affects FreeBSD 14.x

security/vuxml: add FreeBSD SAs issued 2024-09-04

FreeBSD-SA-24:09.libnv affects all supported releases
FreeBSD-SA-24:10.bhyve affects FreeBSD 14.x
FreeBSD-SA-24:11.ctl affects all supported releases
FreeBSD-SA-24:12.bhyve affects all supported releases
FreeBSD-SA-24:14.umtx affects all supported releases

security/vuxml: Fix urls in latest OpenSSL vulns

Reported by:	ashish

security/vuxml: fix firefox version

portepoch should be specified otherwise the version won't ever match the
installed version

security/vuxml: Document OpenSSL vulnerabilities

security/vuxml: add www/*chromium < 128.0.6613.119

fix syntax while here

Obtained
from:	https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html

security/vuxml: Record www/forgejo security vulnerability

Upstream issue:
https://codeberg.org/forgejo/forgejo/pulls/5149

PR:	281133

security/vuxml: add rabbitmq-c creds disclosure

security/vuxml: Record firefox multiple vulnerabilities

CVE-2024-6608
 * Base Score:	4.3 MEDIUM
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2024-6609
 * Base Score:	8.8 HIGH
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2024-6610
 * Base Score:	4.3 MEDIUM
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2024-7524
 * Base Score:	6.1 MEDIUM
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

security/vuxml: Revert "Record firefox multiple vulnerabilites"

This reverts commit 4453cf7eef05f9ac2b27bda7a87afb7da713f1c4.

The 3 CVEs only apply to firefox on iOS.

Reported by:	ronald-lists@klop.ws

security/vuxml: Record firefox multiple vulnerabilites

CVE-2024-43111
 * Base Score:	6.1 MEDIUM
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVE-2024-43112
 * Base Score:	6.1 MEDIUM
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVE-2024-43113
 * Base Score:	6.1 MEDIUM
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

security/vuxml: add www/*chromium < 128.0.6613.114

Obtained
from:	https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_28.html

security/vuxml: Add devel/py-configobj <= 5.0.8

security/vuxml: document gitlab vulnerabilities

security/vuxml: Record firefox multiple vulnerabilities

CVE-2024-5698
CVE-2024-5697

security/vuxml: Record heap buffer overflow for mcpp

PR:		280962
Reported by:	Älven <alster@vinterdalen.se>

security/vuxml: Record DoS vulnerability for md4c

PR:	280956
Reported by: Älven <alster@vinterdalen.se>

security/vuxml: add www/*chromium < 128.0.6613.84

Obtained
from:	https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html

security/vuxml: document buffer overread vulnerability in nginx

CVE-2024-7347

security/vuxml: Correct recent postgresql vulnerability

Commit 0c9ebc9a5f6feb6859c23e2ea875f9d4f59b3e38 added VID
48e6d514-5568-11ef-af48-6cc21735f730 for CVE-2024-7348 , but misspelled
the package names.  Fix the spelling.

Approved by:	lwhsu (ports)
Sponsored by:	Axcient

security/vuxml: Add devel/py-Jinja2 <= 3.1.3

Reference:	https://github.com/advisories/GHSA-h75v-3vvj-5mfj

PR:		279350

security/vuxml: Record firefox spoofing vulnerability

CVE-2024-7518

 * Base Score:	6.5 MEDIUM
 * Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.4.0

security/vuxml: document electron{29,30} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v29.4.6,
	 	https://github.com/electron/electron/releases/tag/v30.4.0

security/vuxml: Add an antry for dovecot.

security/vuxml: Document Intel CPU vulnerabilities

Security:	CVE-2024-24853
Security:	CVE-2024-25939
Security:	CVE-2024-24980
Security:	CVE-2023-42667
Security:	CVE-2023-49141
Sponsored by:	The FreeBSD Foundation

security/vuxml: Register firefox vulnerabilities

CVE-2024-7527
CVE-2024-7528
CVE-2024-7530
CVE-2024-7521
CVE-2024-7520
CVE-2024-7522
CVE-2024-7525
CVE-2024-7529
CVE-2024-7531

misc/openhab: update to 4.2.1

This is mainly for security fixes in the CometVisu plugin.

security/vuxml: Document vaultwarden vulnerabilities

security/vuxml: Document AMD CPU vulnerabilities

Security:	CVE-2023-31315
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document Roundcube 1.6.7 vulns

security/vuxml: Add firefox CVE

By monitoring the time certain operations take, an attacker could have guessed
which external protocol handlers were functional on a user's system.

security/vuxml: Document soft-serve vulnerability

security/vuxml: Document vulnerability in postgresql

security/vuxml: Document Jenkins Security Advisory 2024-08-07

Sponsored by:	The FreeBSD Foundation

security/vuxml: Correct mysql81-server typo

This was bothering me why mysql80-server 8.0.39 was being reported as
vulnerable when anything above 8.0.38 should be fine.  It wasn't until I
looked at the VuXML webpage that I saw mysql81-server had a typo calling
it mysql80-server.

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document Django's multiple vulnerabilities

security/vuxml: add www/*chromium < 127.0.6533.99

Obtained
from:	https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html

security/vuxml: add www/*chromium < 127.0.6533.88

Obtained
from:	https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html

security/vuxml: add www/*chromium < 127.0.6533.72

Obtained
from:	https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html

security/vuxml: document glpi vulnerability

PR:		280313

security/vuxml: Add irc/znc security issue

PR:		280477
Reported by:	John R <gamer@ryppn.com>