- Fix entry date and use two ranges

Reviewed by:    gahr@
Approved by:    jadawin@ (mentor)

- Document CVE-2011-3192 for recent apache DoS vulnerability

Approved by:    jadawin@ (mentor)
Security:      
http://vuxml.org/freebsd/7f6108d2-cea8-11e0-9d58-0800279895ea.html

Upstream indicates that this only affects 4.40 and 4.41 so add a <ge> tag
to indicate that.

Document stunnel heap corruption vulnerability.

Fix discovery date

DOcument phpMyAdmin CVE-2011-3181 (multiple XSS).

Document new Chromium vulnerabilities.

Obtained from:  http://google-chrome-browser.com/releases
Security:       CVE-2011-[2821, 2823-2829, 2839]

Mark PHP5 < 5.3.7_2 as vulnerable to PHP bug #55439: crypt() returns only
the salt for MD5.

Document multiple PHP vulnerabilities.

Document Rails multiple vulnerabilities.

Document dovecot DoS vulnerability.

Document "otrs" - vulnerabilities in OTRS-Core allows read access
to any file on local file system.

document recent mozilla vulnerabilities

Document samba vulnerabilities of SWAT web interface.

Adjust dates in 510b630e-c43b-11e0-916c-00e0815b8da8.

Noticed by:     kwm@

- Document ISC DHCP server DoS.

Document "bugzilla" - multiple vulnerabilities.

Document dtc security issues

PR:             ports/159736
Submitted by:   Ansgar Burchardt <ansgar@debian.org>

Document freetype2 and libXfont vulnabilities.

Update linux-f10-flashplugin to 10.3r183.5 .

Submitted by:   pointyhat via erwin
Security:      
http://www.freebsd.org/ports/portaudit/2c12ae0c-c38d-11e0-8eb7-001b2134ef46.html

Document new vulnerabilities for www/chromium ( < 13.0.782.107)

Obtained from:  http://googlechromereleases.blogspot.com/
Security:       CVE-2011-{2358-2361, 2782-2805, 2818-2819}

Document libsoup security hole.

Fix match of phpmyadmin in recent revisions.

- Add CVE reference for OpenSAML2 issue
- Use official citation

Document phpmyadmin vulnerabilities

Approved by:    wxs (mentor)

Document OpenSAML2 issue

Document rsync DoS issue (CVE-2011-1097).

Document BIND vulnerabilities for ports. This was inspired by the PR,
but re-formatted and edited by me, so responsibility for errors is mine.

PR:             ports/158672
Submitted by:   Ryan Steinmetz <rpsfa@rit.edu>

Document phpMyAdmin multiple vulnerabilities

Reviewed by:    flo
Approved by:    rene (mentor vacation)

document one more vulnerability in the recent asterisk entry

Document new vulnerabilities for www/chromium ( < 12.0.742.112)

Security:       CVE-2011-[2345-2351]

Add modified tag to 8a5770b4-54b5-11db-a5ae-00508d6a62df.

Noticed by:     sahil@

Now that www/mambo is updated, fix the range in
8a5770b4-54b5-11db-a5ae-00508d6a62df.

document recent asterisk vulnerabilities

- Document ejabberd vulnerability fixed in 2.1.8

PR:             ports/158137
Submitted by:   Ruslan Mahamatkhanov <cvs-src@yandex.ru>
Security:      
http://vuxml.org/freebsd/01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6.html

- also mark firefox35 vulnerable

- document recent mozilla vulnerabilities [1]
- while here also document an older samba Denial of service vulnerability [2]

Security:      
http://www.vuxml.org/freebsd/dfe40cff-9c3f-11e0-9bec-6c626dd55a41.html [1]
               
http://www.vuxml.org/freebsd/bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41.html [2]
Requested by:   timur [2]

Document piwik remote command execution vulnerability.

Document dokuwiki XSS vulnerability.

Update linux-f10-flashplugin to 10.3r181.26 .

PR:             ports/157900
Submitted by:   Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:      
http://www.freebsd.org/ports/portaudit/55a528e8-9787-11e0-b24a-001b2134ef46.html

- Document CVE-2011-1408 in www/ikiwiki

- Cleanup

Update to 10.3r181.22 .

PR:             ports/157696
Submitted by:   Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:      
http://www.freebsd.org/ports/portaudit/57573136-920e-11e0-bdc9-001b2134ef46.html

Document www/chromium vulnerabilities fixed in version 12.0.742.91

Security:       CVE-2011-{1808-1819,2332,2342}

- Document CVE-2011-1910

PR:             ports/157548
Submitted by:   Ryan Steinmetz <rpsfa@rit.edu>

Add CVE-2011-1947: fetchmail STARTTLS denial of service.

- Cleanup

- document asterisk remote crash vulnerability

Security:      
http://www.vuxml.org/freebsd/34ce5817-8d56-11e0-b5a2-6c626dd55a41.html

  Document CVE-2011-1752, CVE-2011-1783 and CVE-2011-1921 in devel/subversion

Document drupal6 multiple vulnerabilities.

Submitted by:   Nick Hilliard <nick@foobar.org>

Document Erlang R14B02 ssh library vulnerability (cryptographically
weak RNG).

Security:       CVE-2011-0766

Document latest www/chromium vulnerabilities.

Security:       CVE-2011-1801, -1804, -1806, -1807

- Cleanup Part 1

PS: wonder when pplz start to ask ports-security for review ...

- Document the last unbound vulnerability

 - revert last change of apr-* entry

 Broken build reported by wxs@

- use apr-* and add <gt></gt> entries for all apr0/apr1 issues
  (<gt> .. is needed else the parser cannot make a difference
   between apr0 and apr1)

- lowercase ViewVC -> viewvc

 Thanks Jun Kuriyama ( kuriyama@ ) for the notice and the patch
 for the apr entries.

Update the mod_pubcookie entry with an ap20 prefix.  The port has alwasy
has USE_APACHE=2.0 in it so we can avoid enumarating all values of
APACHE_PKGNAMEPREFIX.

Pointy hat:     brooks

Unbreak VuXML web build by changing "ap*-" to "ap-" in package name for
1ca8228f-858d-11e0-a76c-000743057ca2 / mod_pubcookie -- Empty
Authentication Security Advisory.

While the new one is likely not correct, this fixes the build until
somebody can put in the right thing.

Fix build.

Partially address several years of neglect of pubcookie.  Indicate the
security issues in two two ports.

I've not use pubcookie in several year and given the lack of complaint
about the deprication of mod_pubcookie, I doubt anyone else uses it from
ports.  The mod_pubcookie port has already expired and I've set a two
week expriation for pubcookie-login-server.  If not maintainer
appears I will send both to the Attic on June 6th.

While I'm here, address the use of CONF_FILES and CONF_DIRS in
pubcookie-login-server to avoid getting in the way of progress. [0]

PR:             ports/157164 [0]
Security:       vuxml:115a1389-858e-11e0-a76c-000743057ca2
                vuxml:1ca8228f-858d-11e0-a76c-000743057ca2

- add entry for ViewVC < 1.1.11
- add entry for apr1 (CVE-2011-1928)
- correct version in previous apr1 entry
- run tidy

Update to 10.3r181.14 .

PR:             ports/156996
Submitted by:   Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:      
http://www.freebsd.org/ports/portaudit/d226626c-857f-11e0-95cc-001b2134ef46.html

Document Opera Frameset unload code injection vulnerability.

Document pure-ftpd multiple vulnerabilities prior to 1.0.32.

mail/exim: document CVE-2011-1764 and CVE-2011-1407

Both vulnerabilities are in the DKIM code and were fixed in 4.76.

Approved-by: erwin (mentor)
Feature-safe: yes

- document Apache APR DoS vulnerabilities

- Document www/zend-framework (potential SQL injection when using PDO_MySQL)

Security:       http://framework.zend.com/security/advisory/ZF2011-02

Document mediawiki multiple vulnerabilities.

PR:             ports/156914
Submitted by:   Ryan Steinmetz <rpsfa@rit.edu>

Document CVE-2011-1799 and CVE-2011-1800 for www/chromium

Incorporate changes recommended by the tidy target. While here, properly
label dc9f8335-2b3b-11e0-a91b-00e0815b8da8.

Document CVE-2011-1720: Postfix memory corruption error.

Document www/chromium vulnerabilities fixed in version 11.0.696.57

Security:       CVE-2011-[1303-1305, 1434-1452, 1454-1456]

Document mozilla -- multiple vulnerabilities

- document recent asterisk vulnerabilities
- fix topic in RT entry

Document VideoLAN-SA-1103. Heap corruption in MP4 demultiplexer in VLC.

Update to 10.2r159.1 .

Security:      
http://www.freebsd.org/ports/portaudit/32b05547-6913-11e0-bdc4-001b2134ef46.html

Document multiple vulnerabilities in RT www/rt36 and www/rt38

Document www/chromium vulnerabilities

Security:       CVE-2011-1301, CVE-2011-1302

Unbreak file format:
- Place <vuxml> tag at the start of the file.
- Close topic tags.

Pointy hat to:  cy

Add the following for security/krb5:
        MITKRB5-SA-2011-001 - kpropd denial of service
        MITKRB5-SA-2011-002 - KDC denial of service attacks
        MITKRB5-SA-2011-003 - KDC vulnerable to double-free when PKINIT enabled
        MITKRB5-SA-2011-004 - kadmind invalid pointer free()

Document a root exploit via rogue hostname in xrdb.

Limit affected mupdf version to <0.8

Submitted by:   tobez@ (irc)

Document "otrs" - several XSS attacks possible.

Fix typo

Submitted by:    Dan Langille <dan@langille.org>

Document isc-dhcp41-client and isc-dhcp31-client vulnerabilities.

PR:             ports/156246
Submitted by:   Douglas Thrift <douglas@douglasthrift.net>

Add CVE entry for recent tinyproxy vulnerability.

- tinyproxy

Document two quagga DoS vulnerabilities

Add a missing </p>.

Pointed out by: jadawin@

Document gdm privilege escalation vulnerability

Document vulnerabilities before Chromium 10.0.648.204

Obtained from: 
http://googlechromereleases.blogspot.com/search/label/Stable%20updates

Add entries for php5-exif and php5-zip before 5.3.6 release.

PR:             ports/155922
Submitted by:   Chris Tandiono <christandiono@tbp.berkeley.edu>

Update to 10.2r153.

Security:      
http://www.freebsd.org/ports/portaudit/501ee07a-5640-11e0-985a-001b2134ef46.html
PR:             ports/155874
Submitted by:   Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>

- Document mozilla -- update to HTTPS certificate blacklist

Document CVE-2011-0411: Postfix "STARTTLS" Plaintext
Injection Vulnerability.

Reviewed by:    miwi (secteam)

- Documented integer overflow in hiawatha web server

Submitted by:   C-S <c-s@c-s.li>

Document asterisk multiple vulnerabilities.

Mark chromium-9.0.597.107 and chromium-10.0.648.127 as vulnerable.

- Cleanup a bit

- Add correct infos to the avahi issus
- Add url to original advisory