Add the following KRB5 CVEs.

CVE-2014-5352: gss_process_context_token() incorrectly frees context

CVE-2014-9421: kadmind doubly frees partial deserialization results

CVE-2014-9422: kadmind incorrectly validates server principal name

CVE-2014-9423: libgssrpc server applications leak uninitialized bytes

Security:	CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423

Document unzip out of boundary access issues in test_compr_eb.

PR:		ports/197300

Add linux-f10-devtools (any version) and linux-c6-devtools (prior to 6.6_3) to
the CVE-2015-0235 entry from 2015-01-28.

Approved by:	swills (mentor)

Add net-mgmt/xymon-server CVE-2015-1430

www/linux-*-flashplugin11: Add CVE-2015-0313

Spotted by:	kwm
Approved by:	swills (mentor)

Add CVE-2015-0862 for net/rabbitmq.

- document apache24 issues

Document asterisk security issues.

While here, add CVE number to a previous asterisk entry.

Add CVE-2015-0235.

- Affects linux_base-*

Approved by:	so@ (des)

Document critical Adobe Flash Player vulnerability (CVE-2015-0311)

- document bugzilla security issues

- Fix description of 9c7b6c20-a324-11e4-879c-00e0814cab4e

Document Django 2014-01-13 vulnerabilty

Add a note about the just-fixed vulnerability of applications using net/libutp.

PR:		196351
Differential Revision:	D1575
Submitted by:	Jan Beich
Approved by:	bapt

Amend linux-c6-openssl version in OpenSSL entry from 2015-01-08.

Approved by:	swills (mentor)

Add CVE-2015-0206 description for LibreSSL port.

Document Adobe Flash Player vulnerabilities

Document new vulnerabilities in www/chromium < 40.0.2214.91

Also affects FFmpeg, ICU, DOM but the links on the webpage all result in a 403.

Obtained from:	http://googlechromereleases.blogspot.nl

security/vuxml:
- Document security/polarssl and security/polarssl13 crafted certificates
  vulnerability (CVE-2015-1182)

Document multiple archivers/unzip vulnerabilities (CVE-2014-8139,
CVE-2014-8140, CVE-2014-8141).

PR:		196777 (based on)
Submitted by:	rsimmons0@gmail.com

Add description of CVE-2014-8143 in net/samba4 and net/samba41

Add entry for CVE-2013-7252 in x11/kde4-runtime.

Document mozilla vulnerabilities

Add vuln.xml entry for libevent CVE-2014-6272

PR:	ports/199640

- Fix more typo

- Fix typo

- Document cURL URL request injection vulnerability (CVE-2014-8150)

Document webkit-gtk[23] vulnabilities.

Document OpenSSL multiple vulnerabilities.

Add three upstream patches to busybox 1.22.1, bumping PORTREVISION to 2.
One fixes the CVE-2014-4608 buffer overrun in LZO2,
one fixes the nc app, one fixes the zcat and related apps when accessing
files without extension.

List busybox < 1.22.1_2 as vulnerable, and add CVE Name to the vulndb.

Security:	CVE-2014-4608
Security:	d1f5e12a-fd5a-11e3-a108-080027ef73ec

VuXML: document multiple vulnerabilities in WordPress

CVE-2014-9033 to CVE-2014-9039.

VuXML: document heap overflow in 32-bit builds of libpng

Document file multiple vulnerabilities.

Fix whitespace in entry for ntp (4033d826-87dd-11e4-9079-3c970e169bc2)

Document CVE-2014-9116 in mutt

Document ntp multiple vulnerabilities.

Document git vulerability

Approved by:	swills
Security:	CVE-2014-9390

OTRS security announcement

Register portepoch in the xorg-server entry.

Submitted by:	Adam McDougall <mcdouga9@egr.msu.edu>
Pointyhat to:	kwm@

Fix version information on several subversion vulnerabilities

- document Subversion remote DoS

The GLX indirect rendering support supplied on NVIDIA products is subject to
the recently disclosed X.Org vulnerabilities (CVE-2014-8093, CVE-2014-8098)
as well as internally identified vulnerabilities (CVE-2014-8298).

Document BIND vulnerability.

Document vulnerability in asterisk11.

Document xserver security advisories.

- Remove a redundant dot

Document unbound vulnerability

Document freetype 2 vulnability.

The latest in a long line of phpMyAdmin security advisories: DoS and
XSS vulnerabilities.

Security:	c9c46fbf-7b83-11e4-a96e-6805ca0b3d42

Document mozilla vulnerabilities

PR:		195559
Submitted by:	Jan Beich

Document OpenVPN Denial of Service vulnerability.

Document CVE-2014-8962 and CVE-2014-9028 in audio/flac.

Add CVE names for recent asterisk vulnerabilities.

Document multiple vulnerabilities in asterisk ports.

Document the latest round of phpMyAdmin vulnerabilities.

Security:	a5d4a82a-7153-11e4-88c7-6805ca0b3d42

Add note about CVE-2014-8600 in kde4-runtime and kwebkitpart.

Document yii vulnerability CVE-2014-4672.

Document new vulnerabilities in www/chromium < 39.0.2171.65

Obtained
from:	http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html

Fix version check for the entry added in r372686.

4.11.14 is not in ports yet, the fix was backported to 4.11.13 so we are
safe with 4.11.13_1.

Add entry for CVE-2014-8651 in x11/kde4-workspace.

Cleanup plist

document dbus CVE-2014-7824

ftp/wget: document CVE-2014-4877, path traversal in recursive FTP mode

VuXML: fix spelling for the latest entry

Noticed by:	ports-secteam (rea)

VuXML: document CVE-2014-8483 for irc/konversation-kde4

Approved by:	ports-secteam (zi)

VuXML: document remote Perl code execution in TWiki

Crafted GET parameter "debugenableplugins" can be used to trigger
code execution,
  http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236

VuXML: document vulnerability in Jenkins

CVE-2014-3665, remote code execution on master servers that can
be initiated by (untrusted) slaves,
 
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30

Add entry for libssh's CVE-2014-0017.

- Document recent vulnerabilities in libpurple/pidgin

Document cross site scripting vulnerabilities in phpMyAdmin

Security:	25b78f04-59c8-11e4-b711-6805ca0b3d42

Document asterisk susceptibility to the POODLE vulnerability,
described in CVE-2014-3566.

Document libxml2 denial of service

Add linux-c6-openssl to OpenSSL entry from 2014-10-15.

Approved by:	swills (mentor)

Document critical SQL Injection Vulnerability in www/drupal7

- Mark libxul as vulnerable too

Submitted by:	Jan Beich

Document OpenSSL multiple vulnerabilities.

Document mozilla vulnerabilities

PR:		194356
Submitted by:	Jan Beich

Convert USE_PYTHON_RUN to new USES syntax;
Appease the angry DEVELOPER=YES god

Approved by:	mat

Add entry for foreman-proxy

Obtained from:	mmoll

Document new vulnerabilities in www/chromium < 38.0.2125.101

Obtained
from:	http://googlechromereleases.blogspot.nl/2014/10/stable-channel-update.html
MFH:		2014Q4

- document bugzilla security issues

Fix rsyslog entry for pkgname matching

www/rt42 < 4.2.8 is vulnerable to shellshock related exploits through
its SMIME integration.

Security:	81e2b308-4a6c-11e4-b711-6805ca0b3d42

- Update the rsyslog entry to reflect the new versions

Reviewed by:	bdrewery

Update Jenkins entry 549a2771-49cc-11e4-ae2c-c80aa9043978 to be readable.

Update grammar of DoS in Jenkins entry

Fix Jenkins entry to note that XSS is an issue, not as compiler

Document Jenkins vulnerabilities

Security:		CVE-2014-3661
Security:		CVE-2014-3662
Security:		CVE-2014-3663
Security:		CVE-2014-3664
Security:		CVE-2014-3680
Security:		CVE-2014-3681
Security:		CVE-2014-3666
Security:		CVE-2014-3667
Security:		CVE-2013-2186
Security:		CVE-2014-1869
Security:		CVE-2014-3678
Security:		CVE-2014-3679

Fix bash entries to also mark bash-static vulnerable

Document CVE-2014-6277 and CVE-2014-6278 for bash.

- Document CVE-2014-7187 fixed in bash-4.3.27_1

Document the latest phpMyAdmin vulnerability.

  - while here fix the '>' breakage in the rsyslogd entry.

Security:	3e8b7f8a-49b0-11e4-b711-6805ca0b3d42

Document CVE-2014-7186 for bash

- Document sysutils/rsyslog vulnerabilities CVE-2014-3634

Reviewed by:	bdrewery@

Document shells/fish vulnerabilities

Add linux-c6-nss-3.15.1 package to the NSS vulnerability report.

Approved by:	swills (mentor)

Add linux_base-c6-6.5 package to the bash vulnerability report.

Approved by:	swills (mentor)

The 2nd bash issue was reassigned to CVE-2014-7169:
  http://seclists.org/oss-sec/2014/q3/685

Reported by:	jkim

Update bash entry for CVE-2014-3659

Security:	CVE-2014-3659
Security:	ca44b64c-4453-11e4-9ea1-c485083ca99c

VuXML entry 48108fb0-751c-4cbb-8f33-09239ead4b55: expanded details
Reviewed by:	des@