Document expat2 vulnerability

Security:	CVE-2016-4472

Document dnsmasq vulnerability

Security:	CVE-2015-8899

Document python vulnerability

PR:		210541
Security:	CVE-2016-5699

Document openssl vulnerability

PR:		210550
Security:	CVE-2016-2177

Document remote denial of service via FileUpload component in Tomcat

PR:		209669 [1]
Reported by:	Geoffroy Desvernay <dgeo@centrale-marseille.fr> [1]
Reported by:	Roger Marquis <marquis@roble.com>
Security:	CVE-2016-3092
Security:	https://vuxml.FreeBSD.org/freebsd/cbceeb49-3bc7-11e6-8e82-002590263bf5.html

Document Wordpress vulnerabilities fixed in 4.5.3

PR:             210480 [1]
PR:             210581
Reported by:	Mihail Timofeev <9267096@gmail.com> [1]
Security:	CVE-2016-5832
Security:	CVE-2016-5833
Security:	CVE-2016-5834
Security:	CVE-2016-5835
Security:	CVE-2016-5836
Security:	CVE-2016-5837
Security:	CVE-2016-5838
Security:	CVE-2016-5839
Security:	https://vuxml.FreeBSD.org/freebsd/bfcc23b6-3b27-11e6-8e82-002590263bf5.html

Docment security issues fixed in PHP 7.0.8, 5.6.23, and 5.5.37

PR:		210491
PR:		210502
Reported by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Reported by:	Philip Jocks <freebsdbugs@filis.org>
Security:	CVE-2015-8874
Security:	CVE-2016-5766
Security:	CVE-2016-5767
Security:	CVE-2016-5768
Security:	CVE-2016-5769
Security:	CVE-2016-5770
Security:	CVE-2016-5771
Security:	CVE-2016-5772
Security:	CVE-2016-5773
Security:	https://vuxml.FreeBSD.org/freebsd/66d77c58-3b1d-11e6-8e82-002590263bf5.html

Fix vuxml

I didn't validate after updating "foo reports:" line

Pointyhat:	me

Document libarchive vulnerabilities

PR:		210493
Security:	CVE-2015-8934
Security:	CVE-2016-4300
Security:	CVE-2016-4301
Security:	CVE-2016-4302

Add piwik XSS to vuxml

No further information is available. No CVE has been assigned.

PR:		210458

Followup to r417190 - all versions of wget<1.18 are affected

Document ftp/wget's HTTP to FTP redirection file name confusion vulnerability

PR:		210420
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	CVE-2016-4971

Update vuxml for libxslt vulnerabilities

These vulnerabilities were previously reported by Google as they bundle
libxslt with Chrome. When we patched Chromium to address these
vulnerabilites it was overlooked that we do not bundle libxslt library
with Chromium, but instead use textproc/libxslt. Chromium users have
continued to be vulnerable to these CVEs as a result. This update fixes
the Chromium CVE entry and adds a separate one for libxslt.

PR:		210298
Security:	CVE-2016-1683
Security:	CVE-2016-1684

Update security/libressl vulnerability for quarterly branch

  - Mark vulnerable from 2.3.0 up to 2.3.6
  - Mark vulnerable below 2.2.9

Document Flash vulnerabilities in Adobe Security Bulletins APSB16-10,
APSB16-15, APSB16-18

PR:		209592
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2016-1006, CVE-2016-1011, CVE-2016-1012, CVE-2016-1013,
		CVE-2016-1014, CVE-2016-1015, CVE-2016-1016, CVE-2016-1017,
		CVE-2016-1018, CVE-2016-1019, CVE-2016-1020, CVE-2016-1021,
		CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025,
		CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,
		CVE-2016-1030, CVE-2016-1031, CVE-2016-1032, CVE-2016-1033,
		CVE-2016-1096, CVE-2016-1097, CVE-2016-1098, CVE-2016-1099,
		CVE-2016-1100, CVE-2016-1101, CVE-2016-1102, CVE-2016-1103,
		CVE-2016-1104, CVE-2016-1105, CVE-2016-1106, CVE-2016-1107,
		CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,

Fix vuxml <cvename> syntax for recent Chrome entry

Document new vulnerabilities in www/chromium < 51.0.2704.103

Obtained
from:	https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html

Document integer overflow in python's zipimport module

PR:		210324
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	CVE-2016-5636

Document Drupal vulnerabilities

PR:		210317
Reported by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	https://www.drupal.org/SA-CORE-2016-002
Security:	https://vuxml.FreeBSD.org/freebsd/7932548e-3427-11e6-8e82-002590263bf5.html

Document multiple issues in Botan

PR:		209595
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2015-7827
Security:	CVE-2016-2849
Security:	https://vuxml.FreeBSD.org/freebsd/ac0900df-31d0-11e6-8e82-002590263bf5.html
Security:	CVE-2014-9742
Security:	https://vuxml.FreeBSD.org/freebsd/f771880c-31cf-11e6-8e82-002590263bf5.html

Update vuxml

A backported fix was added to security/openssl

Document remote code execution vulnerability in multimedia vlc before 2.2.4

Chase MFSA typo fix

Document cross-site scripting CVE in Roundcube

PR:		209841
Reported by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	CVE-2016-5103
Security:	https://vuxml.FreeBSD.org/freebsd/97e86d10-2ea7-11e6-ae88-002590263bf5.html

Add entry for CVE-2016-2178 OpenSSL vulnerability

Security:	CVE-2016-2178

Fill in <freebsdpr> tag on last entry; I staged it prior to opening the PR
for tracking and forgot to fill it in pre-commit.

PR:		210155

Document two expat CVEs reported by upstream

PR:		210155
Reported by:	Sebastian Pipping <sebastian@pipping.org>
Security:	CVE-2012-6702
Security:	CVE-2016-5300
Security:	https://vuxml.FreeBSD.org/freebsd/c9c252f5-2def-11e6-ae88-002590263bf5.html

Add entry for recent iperf3 vulnerability.

Security:	d6bbf2d8-2cfc-11e6-800b-080027468580
Sponsored by:	ESnet

Document GNUTLS-SA-2016-1.

Document recent Firefox vulnerabilities

Fix cvename entries

Document new vulnerabilities in www/chromium < 51.0.2704.79

Obtained
from:	http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html

The Expat vulnerability also affects linux-*-expat.

Document OpenAFS vulnerabilities in 1.6.16 and 1.6.17

PR:		209534
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2015-8312
Security:	CVE-2016-2860
Security:	CVE-2016-4536
Security:	https://vuxml.FreeBSD.org/freebsd/2e8fe57e-2b46-11e6-ae88-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/bcbd3fe0-2b46-11e6-ae88-002590263bf5.html

Fixup invalid nginx version from r416222; it needed a PORTEPOCH to be valid.
Add version range valid for backported commit on 1.8 and 1.9 in quarterly.

Security:	CVE-2016-4450
Security:	https://vuxml.FreeBSD.org/freebsd/36cf7670-2774-11e6-af29-f0def16c5c1b.html

Document ikiwiki XSS vulnerability

PR:		209593
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2016-4561
Security:	https://vuxml.FreeBSD.org/freebsd/0297b260-2b3b-11e6-ae88-002590263bf5.html

- Document vulnerability in www/h2o

PR:		209926
Submitted by:	Dave Cottlehuber (maintainer)

Fix latest cacti entry.

Found by:	make validate
No cookie for:	brnrd

Add an entry about latest nginx vulnerability.

security/vuxml: Modify libressl < 2.3.4 range

  - Change existing range to >2.3.0 and <2.3.4
  - Add <2.2.7 range
  - Update modified date

This addresses pkg audit showing LibreSSL 2.2.7 as vulnerable

Document security issues fixed in cacti 0.8.8h

PR:		209809
Reported by:	Daniel Austin <freebsd-ports@dan.me.uk>
Security:	CVE-2016-3659
Security:	https://vuxml.FreeBSD.org/freebsd/6167b341-250c-11e6-a6fb-003048f2e514.html

- document openvswitch CVE-2016-2074

PR:		208404
Submitted by:	ohauer

Document vulnerabilities in www/chromium:
 < 50.0.2661.94
 < 50.0.2661.102
 < 51.0.2704.63

Obtained from:	http://googlechromereleases.blogspot.nl/

Document security issues fixed in PHP 7.0.7, 5.6.22, and 5.5.36

PR:		209779
Reported by:	Fabiano Sidler <fabianosidler@swissonline.ch>
Security:	CVE-2013-7456
Security:	CVE-2016-4343
Security:	CVE-2016-5093
Security:	CVE-2016-5094
Security:	CVE-2016-5096
Security:	https://vuxml.FreeBSD.org/freebsd/6b110175-246d-11e6-8dd3-002590263bf5.html

Add CVE names for the latest phpMyAdmin advisories, not that they have
been released.

fix typo.

Document two more phpMyAdmin vulnerabilities: PMSA-2016-14 and
PMSA-2016-16.

(For anyone wondering about the suspicious gap in the sequence:
PMSA-2016-15 only affected unreleased code in their git master
development branch)

Add a new keywork xmlcatmgr

It simplifies the handling of the XML and SMGL catalog
It brings a big of consistency by always specifying the catalog path absolute
instead of mixing absolute and relative path.
The keyword is also written a PKG_ROOTDIR friendly to simplify cross installing

Reviewed by:	hrs
Differential Revision:	https://reviews.freebsd.org/D6539

Document security announcement from MediaWiki 1.26.3, 1.25.6, and
1.23.14 release.

Document wpa_supplicant security advisory 2016-1

PR:		209564
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2016-4477
Security:	CVE-2016-4476
Security:	https://vuxml.FreeBSD.org/freebsd/967b852b-1e28-11e6-8dd3-002590263bf5.html

Document Expat XML Parser crash on malformed input

Security:	CVE-2016-0718
Security:	https://vuxml.FreeBSD.org/freebsd/57b3aba7-1e25-11e6-8dd3-002590263bf5.html

- document bugzilla Cross-Site Scripting issue

Mark openvpn-polarssl <v2.3.11 vulnerable, too, not just openvpn.

Security: 0dc8be9e-19af-11e6-8de0-080027ef73ec

Mark OpenVPN before 2.3.11 vulnerable.

v2.3.11 fixed a buffer overrun in PAM authentication,
and a port-share bug with denial-of-service potential.

Fix vuxml

Add basic imagemagick entry.

Fix affected versions

Document Jenkins Security Advisory 2016-05-11

Document Perl taint protection bypass vulnerability

PR:		208879
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2016-2381
Security:	https://vuxml.FreeBSD.org/freebsd/d9f99491-1656-11e6-94fa-002590263bf5.html

Document Wordpress vulnerabilities fixed in 4.5.2

PR:		209409
PR:		209378 [1]
Reported by:	Mihail Timofeev <9267096@gmail.com> [1]
Security:	CVE-2016-4566
Security:	CVE-2016-4567
Security:	https://vuxml.FreeBSD.org/freebsd/3686917b-164d-11e6-94fa-002590263bf5.html

Fix version range for libarchive entry. [1]

While here, add CVE and wrap lines at <80

PR:		209404 [1]
Reported by:	dereks@lifeofadishwasher.com [1]
Security:	CVE-2016-1541
Security:	https://vuxml.FreeBSD.org/freebsd/2b4c8e1f-1609-11e6-b55e-b499baebfeaf.html

security/vuxml: Add entry for libarchive

  - Vulnerable < 2.3.0

Reviewed by:	feld (mentor)
Approved by:	feld (mentor, ports-secteam)
Security:	CVE-2016-1541

Update recent squid, squid-devel entry to add CVE Numbers

Document three security advisories for the squid and squid-devel
ports.  CVE numbers are not yet available.

PR:		209334
Submitted by:	timp87@gmail.com (maintainer)

Add forgotten portepoch to the ImageMagick 6.x version.

PR:		209241
Reported by:	Ben Woods, Jason Unovitch

Document ImageMagick vulnabilities.

PR:		209241
Submitted by:	Ben Woods

Add entry of devel/jansson

PR:		209219
Submitted by:	junovitch@

Fix <url> -> <cvename> tags in OpenSSL entry plus spacing fixes.

While here, combine both entries as they both refer to the same CVEs and
we've typically done these as combined entries in the past.

security/vuxml: Document LibreSSL vulnerabilities

Reviewed by:	swills
MFH:		2016Q3

security/vuxml: Document OpenSSL 1.0.2g vulnerabilities

Reviewed by:	swills
MFH:		2016Q2

Document gitlab privilege escalation via "impersonate" feature

PR:		209225
Reported by:	Torsten Zuehlsdorff <ports@toco-domains.de>
Security:	CVE-2016-4340
Security:	https://vuxml.FreeBSD.org/freebsd/be72e773-1131-11e6-94fa-002590263bf5.html

Document php multiple vulnerabilities

PR:		209145
Reported by	Christian Schwarz <me@cschwarz.com>
Security:	CVE-2016-3074
Security:	https://vuxml.FreeBSD.org/freebsd/5764c634-10d2-11e6-94fa-002590263bf5.html

Document libksba local denial of service vulnerabilities

Security:	CVE-2016-4353
Security:	CVE-2016-4354
Security:	CVE-2016-4355
Security:	CVE-2016-4356
Security:	https://vuxml.FreeBSD.org/freebsd/a1134048-10c6-11e6-94fa-002590263bf5.html

Document denial of service advisories from Wireshark's recent release

Security:	https://vuxml.FreeBSD.org/freebsd/7e36c369-10c0-11e6-94fa-002590263bf5.html

Document arbitrary code execution vulnerability in Mercurial

Security:	CVE-2016-3105

security/vuxml: Add entry for MySQL/MariaDB/Percona April Critical Patch Update

  - Add entry for 31 security fixes for Oracle MySQL
  - Add also affected MariaDB packages
  - Add also affected Percona packages

Reviewed by:	junovitch (ports-secteam)
Approved by:	junovitch (ports-secteam)
Differential Revision:	D6159

Logstash password disclosure vulnerability.

  Add two CVEs for subversion:

   http://subversion.apache.org/security/CVE-2016-2167-advisory.txt
   http://subversion.apache.org/security/CVE-2016-2168-advisory.txt

Document NTP multiple vulnerabilities.

Document recent Firefox vulnerabilities

Document phpmyfaq vulnerability

Security:	https://vuxml.freebsd.org/freebsd/f87a9376-0943-11e6-8fc4-00a0986f28c4.html
Security:	http://www.phpmyfaq.de/security/advisory-2016-04-11
Sponsored by:	Essen Linuxhotel Hackathon 2016

Document libtasn1 denial of service via parsing malicious DER certificates

Security:	CVE-2016-4008
Security:	https://vuxml.FreeBSD.org/freebsd/1b0d2938-0766-11e6-94fa-002590263bf5.html

Document squid -- multiple vulnerabilities

PR:		208939
Reported by:	Pavel Timofeev <timp87@gmail.com>
Security:	CVE-2016-4054
Security:	CVE-2016-4053
Security:	CVE-2016-4052
Security:	CVE-2016-4051
Security:	https://vuxml.FreeBSD.org/freebsd/e05bfc92-0763-11e6-94fa-002590263bf5.html

CVE-2016-3096 -- ansible and ansible1 vulnerability due to using
predictable temporary file names when managing LXC containers.

Document security vulnerability in proftpd mod_tls.

PR:		208876
Security:	CVE-2016-3125

Doument new vulnerabilities in www/chromium < 50.0.2661.75

Obtained
from:	http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html

Document wpa_supplicant security advisories

PR:		208482
Security:	CVE-2015-5310
Security:	CVE-2015-5315
Security:	CVE-2015-5316
Security:	https://vuxml.FreeBSD.org/freebsd/976567f6-05c5-11e6-94fa-002590263bf5.html

Document earlier dhcpcd security issue that has been fixed in an earlier
version before the security implications were reported.

PR:		208840
Submitted by:	Ben Woods <woodsb02@gmail.com>
Submitted by:	Roy Marples <roy@marples.name>
Security:	CVE-2014-7912
Security:	https://vuxml.FreeBSD.org/freebsd/092156c9-04d7-11e6-b1ce-002590263bf5.html

Document dhcpcd security remote execution/denial of service

PR:		208840
Submitted by:	Ben Woods <woodsb02@gmail.com>
Security:	CVE-2014-7913
Security:	https://vuxml.FreeBSD.org/freebsd/6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1.html

Document Asterisk and PJsip vulnerabilities.

Document go remote denial of service

Security:	CVE-2016-3959
Security:	https://vuxml.FreeBSD.org/freebsd/f2217cdf-01e4-11e6-b1ce-002590263bf5.html

Document linux-c6-nspr which was overlooked in previous vuxml entry

Multiple vulnerabilities in Samba.
[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
(crashes and high cpu consumption) and man in the middle attacks.
[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected. A
man in the middle is able to clear even required flags,
    especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.
[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
attackers to spoof the computer name of a secure channel's endpoints,
    and obtain sensitive session information, by running a crafted application
and leveraging the ability to sniff network traffic.
[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections to no
integrity protection.
[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
connections (with ldaps://) and ncacn_http connections (with https://).
[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if
explicitly configured.
[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
the default for most the file server related protocols) is inherited
    from the underlying SMB connection.
[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC
traffic between a client and a server in order to impersonate the client
    and get the same privileges as the authenticated user account. This is most
problematic against active directory domain controllers.
Security:	CVE-2015-5370
		CVE-2016-2110
		CVE-2016-2111
		CVE-2016-2112
		CVE-2016-2113
		CVE-2016-2114
		CVE-2016-2115
		CVE-2016-2118
Sponsored by:	Micro$oft

Document multiple vulnerabilities from the 31 Mar 16 PHP releases

PR:		208465
Reported by	Christian Schwarz <me@cschwarz.com>
Security:	https://vuxml.FreeBSD.org/freebsd/482d40cb-f9a3-11e5-92ce-002590263bf5.html

Document PCRE heap overflow vulnerability

PR:		208260
Reported by:	Sevan Janiyan <venture37@geeklan.co.uk>
Security:	CVE-2016-1283
Security:	https://vuxml.FreeBSD.org/freebsd/497b82e0-f9a0-11e5-92ce-002590263bf5.html

Document djblets vulnerability from the 0.9.2 release notes

Security:	https://vuxml.FreeBSD.org/freebsd/df328fac-f942-11e5-92ce-002590263bf5.html

Document multiple security advisories for Moodle

Security:	CVE-2016-2151
Security:	CVE-2016-2152
Security:	CVE-2016-2153
Security:	CVE-2016-2154
Security:	CVE-2016-2155
Security:	CVE-2016-2156
Security:	CVE-2016-2157
Security:	CVE-2016-2158
Security:	CVE-2016-2159
Security:	CVE-2016-2190
Security:	https://vuxml.FreeBSD.org/freebsd/a430e15d-f93f-11e5-92ce-002590263bf5.html

Add additional reference URL for Kamailio entry from r411376

Security:	CVE-2016-2385
Security:	https://vuxml.FreeBSD.org/freebsd/c428de09-ed69-11e5-92ce-002590263bf5.html

Document squid multiple vulnerabilities

PR:		208463
Security:	CVE-2016-3947
Security:	CVE-2016-3948
Security:	https://vuxml.FreeBSD.org/freebsd/297117ba-f92d-11e5-92ce-002590263bf5.html

Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight