- Document CVE-2013-0131 for nvidia-driver

Submitted by:	danfe
Approved by:	portmgr (implicit)

Typo fix for the typo fix. Validated with make validate this time.

Reported by:	bz
Approved by:	portmgr (implicit)

Fix a typo in the recent mozilla entry

Reported by:	pluknet
Approved by:	portmgr (tabthorpe)

- Security udpate to 12.15
Security: http://www.opera.com/docs/changelogs/unified/1215/
Security: http://www.opera.com/security/advisory/1046
Security: http://www.opera.com/security/advisory/1047
PR:		177654
Approved by:	portmgr

- fix subversion range

Approved by:	portmgr (implizit)

- Subversion 1.7.9 security update [1]
- Subversion 1.6.21 security update [2]

This release addesses the following issues security issues:
[1][2]  CVE-2013-1845: mod_dav_svn excessive memory usage from property changes
[1][2]  CVE-2013-1846: mod_dav_svn crashes on LOCK requests against activity
URLs
[1][2]  CVE-2013-1847: mod_dav_svn crashes on LOCK requests against non-existant
URLs
[1][2]  CVE-2013-1849: mod_dav_svn crashes on PROPFIND requests against activity
URLs
[1]     CVE-2013-1884: mod_dav_svn crashes on out of range limit in log REPORT
request

More information on these vulnerabilities, including the relevent advisories
and potential attack vectors and workarounds, can be found on the Subversion
security website:
    http://subversion.apache.org/security/

PR:		177646
Submitted by:	ohauer
Approved by:	portmgr (tabthorpe, erwin), lev
Security:	b6beb137-9dc0-11e2-882f-20cf30e32f6d

Vulnerability in OTRS

Approved by:	portmgr
Security:	eae8e3cf-9dfe-11e2-ac7f-001fd056c417

The PostgreSQL Global Development Group has released a security
update to all current versions of the PostgreSQL database system,
including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update
fixes a high-exposure security vulnerability in versions 9.0 and
later. All users of the affected versions are strongly urged to apply
the update *immediately*.

A major security issue (for versions 9.x only) fixed in this release,
[CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899),
makes it possible for a connection request containing a database name
that begins with "-" to be crafted that can damage or destroy files
within a server's data directory. Anyone with access to the port the
PostgreSQL server listens on can initiate this request. This issue was
discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source
Software Center.

- update thunderbird, firefox-esr, linux-thunderbird and linux-firefox to
  17.0.5
- update firefox to 20.0
- update seamonkey and linux-seamonkey to 2.17
- update nspr to 4.9.6
- remove mail/thunderbird-esr, Mozilla stopped providing 2 versions of
  thunderbird
- prune support for old FreeBSD versions; users of 8.2, 7.4 or earlier
  are advised to upgrade - http://www.freebsd.org/security/
- add vuln.xml entry

Security:	94976433-9c74-11e2-a9fc-d43d7e0c7c02
Approved by:	portmgr (miwi)
In collaboration with:	Jan Beich <jbeich@tormail.org>

Document two latest FreeBSD security advisories.

Approved by:	portmgr (bdrewery)

- update japanes/bugzilla templates
- update vuxml to reflect bugzilla templates
- fix typo in vuxml

Approved by:	portmgr (miwi)
Sponsored by:

security upgrade to OpenVPN 2.3.1; upstream release notes are

  "This release adds supports for PolarSSL 1.2. It also adds a fix to
  prevent potential side-channel attacks by switching to a constant-time
  memcmp when comparing HMACs in the openvpn_decrypt function. In
  addition, it contains several bugfixes and documentation updates, as
  well as some minor enhancements."

Full ChangeLog:
<https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23>

The port upgrade also offers an option to use the GPLv2+-licensed
PolarSSL instead of OpenSSL (which brings in a license mix).

PR:		ports/177517
Reviewed by:	miwi
Approved by:	portmgr (miwi)
Security:	92f30415-9935-11e2-ad4c-080027ef73ec

Update to 2.8.0. [1]
Add patch to fix CVE-2013-0338 and CVE-2013-0339. [2]
Convert to OptionsNG, rename patches to standard form. [1]

Notified by:	swills@ [2]
Obtained from:	gnome team repo [1]
Security:	843a4641-9816-11e2-9c51-080027019be0

Update asterisk ports to:

net/asterisk 1.8.20.2
net/asterisk10 10.12.2
net/asterisk11 11.2.2

Security:	daf0a339-9850-11e2-879e-d43d7e0c7c02

Explicitly use -E for sed(1).

Submitted by:	des
Reviewed by:	eadler

Add entry for latest Bind advisory CVE-2013-2266

In validate target, use unexpand and sed to make sure that we are using
consistent space style.

Reviewed by:	stas, simon

Document vulnerabilities in www/chromium < 26.0.1410.43

Obtained from:	http://googlechromereleases.blogspot.nl/search/Stable%20Updates

Remove trailing space, no content change.

unexpand vuln.xml.

firebird vulnerability entry (CVE-2013-2492)

Security:	6adca5e9-95d2-11e2-8549-68b599b52a02

- Document vulnerability in graphics/optipng (CVE-2012-4432)

PR:		ports/177206
Submitted by:	Alexander Milanov <a@amilanov.com>
Security:	8818f7f-9182-11e2-9bdf-d48564727302

Update to 5.3.23

Security:	1d23109a-9005-11e2-9602-d43d7e0c7c02

- Document recent vulnerabilities in www/piwigo: CVE-2013-1468, CVE-2013-1469
Reported by:	Ruslan Makhmatkhanov <cvs-src@yandex.ru>
Security:	edd201a5-8fc3-11e2-b131-000c299b62e1

Fix typo in the libpurple entry.

Submitted by:	Derek Schrock <dereks@lifeofadishwasher.com>

- Perl vulnerability (CVE-2013-1667) also applies to perl-threaded

Reported by:	Alexandre Krasnov <freebsd@tern.ru>
Security:	68c1f75b-8824-11e2-9996-c4850808617

- graphics/libexif:
  * Update to 0.6.21
  * Add LICENSE
  * Switch to OptionsNG and PORTDOCS
- Document libexif 2012-07-12 vulnerabilty
- Bump PORTREVISION for libexif related ports
- Trim headers while here

PR:		ports/175910
Approved by:	swills (mentor)
Security:	d881d254-70c6-11e2-862d-080027a5ec9a

Update flash the latest (hopefully) secure version.

PR:		ports/176904
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:	http://www.vuxml.org/freebsd/5ff40cb4-8b92-11e2-bdb6-001060e06fd4.html

- Update puppet to 3.1.1 resolving multiple security issues
- Update puppet27 to 2.7.21 resolving multiple security issues
- Document multiple puppet security issues

Security:	cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c

Perl 5.x: fix CVE-2013-1667

Feature safe:	wholeheartedly hope so

- Fix previous entry

Belatedly add an entry for libpurple's recent vulnerabilities.

- update thunderbird, firefox-esr, linux-thunderbird and linux-firefox to
  17.0.4
- update firefox to 19.0.2
- add vuln.xml entry

Security:	630c8c08-880f-11e2-807f-d43d7e0c7c02

Document a vulnerability in chromium < 25.0.1364.160

Obtained from:	http://googlechromereleases.blogspot.nl/search/Stable%20Updates

- Document vulnerabilities in typo3.

Security:       b9a347ac-8671-11e2-b73c-0019d18c446a
Obtained from: 
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/

Document vulnerabilities in www/chromium < 25.0.1364.152

Obtained from:	http://googlechromereleases.blogspot.nl/search/Stable%20Updates

- Document recent vulerability in security/stunnel (CVE-2013-1762)
Security:	c97219b6-843d-11e2-b131-000c299b62e1

- document apache22 issues
- tim trailing tabs

Document two sudo problems.

- Update to 0.9.14 to fix CVE-2013-1756

Security:	aa7764af-0b5e-4ddc-bc65-38ad697a484f

Update to 11.2r202.273

Security:	http://www.vuxml.org/freebsd/dbdac023-80e1-11e2-9a29-001060e06fd4.html

- Update affected ettercap versions: CVE-2012-0722 was fixed in
0.7.5.2-Assimilation

- Document 3 OTRS vulnerabilities from 2012
 - CVE-2012-4751
 - CVE-2012-4600
 - CVE-2012-2582

- Document Ruby REXML DoS

- Document rubygem-ruby_parser issue

- Document Django 2013-02-21 vulnerabilty

Approved by:	araujo (mentor)

Document vulnerabilities in www/chromium < 25.0.1364.97

Obtained from:	http://googlechromereleases.blogspot.nl/search/Stable%20Updates

Document security/krb5 1.11 and prior null pointer dereference in the
KDC PKINIT code [CVE-2013-1415].

Security:	CVE-2013-1415

Convert the ! back into a 1.

Noticed by:	crees

Add the latest two FreeBSD Security Advisories.

Document drupal7 Denial of service

- add an entry for net/nss-pam-ldapd stack-based buffer overflow

According to advisory, vulnerability exists in nss-pam-ldapd < 0.8.11,
but since we never had this version in the ports tree, mark everything
< 0.8.12 as vulnerable.

PR:		176293
Submitted by:	pluknet

Fix up the latest gecko update by:
- reapplying the workaround for svn:eol-style and svn:keywords
- fixing version matching in vuln.xml, 17.0.3 is NOT vulnerable

- update bugzilla ports to latest version

  Bugzilla 4.0.10 and 3.6.13 are security updates for the 4.0
  branch and the 3.6 branch, respectively. 4.0.10 contains several
  useful bug fixes and 3.6.13 contains only security fixes.

Security:	CVE-2013-0785
		CVE-2013-0786

- update firefox to 19.0
- update firefox-esr, thunderbird, linux-firefox, linux-thunderbird to 17.0.3
- update linux-seamonkey to 2.16
- update nspr to 4.9.5
- update nss to 3.14.3
- add DuckDuckGo search plugin to firefox [1]
- mark kompozer deprecated
- clang fixes for www/libxul19 [2]

Security:	http://www.vuxml.org/freebsd/e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02.html
Submitted by:	DuckDuckGo [1], dim [2]
In collaboration with:	Jan Beich <jbeich@tormail.org>

- Fix version range for recent ruby vulnerabilities
(d3e96508-056b-4259-88ad-50dc8d1978a6 and c79eb109-a754-45d7-b552-a42099eb2265)
due to missing port epoch in package range

Submitted by:	Matthias Andree <mandree@FreeBSD.org>

Combine ranges into one entry to prevent false positives

- Document rubygem-rack issue

- Document activemodel issue

Document Jenkins Security Advisory 2013-02-16

- add entry for dns/poweradmin

PR:		175704
Submitted by:	Edmondas Girkantas <eg@fbsd.lt> (maintainer of dns/poweradmin)

- Document ruby json issue

- Document vulnerability in rdoc

Update flash to the latest version

PR:		ports/175159
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>

- Fix whitespaces

Fix vuxml build

- report openssl vulnerabilities

- update databases/mariadb-server to 5.3.12 [1]
- update databases/mariadb55-server 5.5.29 [2]

PR:		ports/175764 [1]
PR:		ports/175767 [2]
Submitted by:	Geoffroy Desvernay <dgeo@centrale-marseille.fr> (maintainer) [1]
Submitted by:	Alexandr Kovalenko <never@nevermind.kiev.ua> (maintainer) [2]
Security:	8c773d7f-6cbb-11e2-b242-c8600054b392

- report opera 12.12 vulnerabilities

Document devel/upnp vulnerabilities

Document wordpress multiple vulnerabilities.

Fix last entry: version 2.3.4 is also affected

Fix whitespace in previous commit.

XSS vulnerability in py-django-cms

Document vulnerabilities in www/chromium < 24.0.1312.56

Obtained
from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- update www/drupal6 to 6.28
- update www/drupal7 to 7.19

Security:	http://www.vuxml.org/freebsd/1827f213-633e-11e2-8d93-c8600054b392.html
Approved by:	portmgr (beat)

VuXML: add newly-allocated CVE for SQUID-2012:1

New CVE was allocated for the underfixed DoS and added possible
infinite loop in Squid 3.2 and 3.1.

VuXML: document buffer overflow in ettercap (CVE-2013-0722)
Reviewed by:	simon@

VuXML: document recent security manager bypass in Java 7.x
Reviewed by:	glewis@, simon@

Properly limit the match for PHP 5.3.x and 5.2.x versions.

Noticed by:	remko

Apply version ranges of php53 and php52 to php5 as well.

- Fix discovery date on nagios vulnerability  	(CVE-2012-6096)

www/squid3x: upgrade to 3.1.23 and 3.2.6

Squid 3.1.23 is effectively Squid 3.1.22_2 with the final fix for
CVE-2012-5643 applied.

Squid 3.2.6 also received that abovementioned fix, but in comparison
with 3.2.5 from ports it has another change that fixes handling the
"tcp_outgoing_tos" directive for BSD-like systems, including FreeBSD,
  http://bugs.squid-cache.org/show_bug.cgi?id=3731

VuXML entry for SQUID:2012-1 (aka CVE-2012-5643) was also updated to
reflect the proper version specifications from the updated advisory,
  http://www.squid-cache.org/Advisories/SQUID-2012_1.txt

Approved by:	Thomas-Martin Seck <tmseck@web.de>
Security:	http://portaudit.freebsd.org/c37de843-488e-11e2-a5c9-0019996bc1f7.html
QA page:	http://codelabs.ru/fbsd/ports/qa/www/squid31/3.1.23
QA page:	http://codelabs.ru/fbsd/ports/qa/www/squid32/3.2.6

- Document vulnerability in net-mgmt/nagios (CVE-2012-6096)

Document vulnerabilities in www/chromium < 24.0.1312.52

Obtained
from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- update firefox, thunderbird, linux-firefox and linux-thunderbird to 17.0.2
- update firefox-esr, thunderbird-esr and libxul to 10.0.12
- update linux-seamonkey to 2.15

Security:	http://www.vuxml.org/freebsd/a4ed6632-5aa9-11e2-8fcb-c8600054b392.html

Fix <topic> style: common dash style, remove softvare versions

- Update rubygem-rails to 3.2.11
- Update ports require by rubygem-rails
- Add vuxml entry for rails security issues

Security:	ca5d3272-59e3-11e2-853b-00262d5ed8ee
Security:	b4051b52-58fa-11e2-853b-00262d5ed8ee

- Properly copy namespace attributes/resolve make validate issues

Reviewed by:	simon@, eadler@
Approved by:	zi (with ports-secteam hat)

Document Jenkins 2013-01-04 Security Advisory

VuXML: extend entry for MoinMoin vulnerabilities fixed in 1.9.6

Use more verbose descriptions from CVE entries and trim citation
from CHANGES to the relevant parts.

Document Django 2012-12-10 vulnerabilty

VuXML: fix r309982

Use proper tags for CVE identifiers.  I should run 'make validate'
_every_ time before committing.
Pointyhat to:	rea

VuXML for MoinMoin issues: add CVE references

Freetype 2.4.8 vulnerabilities were already documented.

While here, correct pkgname

Noticed by:	kwm

Mark moinmoin vulnerable

Security:	http://www.debian.org/security/2012/dsa-2593

document freetype vulnerabilities

Security:	CVE-2012-(1126-1144)

Bump copyright to 2013.

Add correct version numbers to the recent asterisk entry

Pointy hat to:	flo

- update net/asterisk to 1.8.19.1
- update net/asterisk10 to 10.11.1
- update net/asterisk11 to 10.1.2
- add vuln.xml entry

Security:	f7c87a8a-55d5-11e2-a255-c8600054b392

Note charybdis and ircd-ratbox vulnerabilities

PR:		ports/174878
Security:	http://www.ratbox.org/ASA-2012-12-31.txt