security/vuxml: Fix range for thunderbird vulnerability

PR:		283357
Reported by:	John Hein <jcfyecrayz@liamekaens.com>

security/vuxml: Mark zeek < 7.0.5 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.5

This release fixes the following potential DoS vulnerability:

 - Large QUIC packets can cause Zeek to overflow memory and potentially
   crash. Due to the possibility of receiving these packets from
   remote hosts, this is a DoS risk.

Reported by:	Tim Wojtulewicz

textproc/halibut: update 1.2 → 1.3

PR:	282213

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 131.0.6778.139

Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html
Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html

security/vuxml: Add mozilla vulnerabilities

 * CVE-2024-11692
 * CVE-2024-11696
 * CVE-2024-11697
 * CVE-2024-11699

security/vuxml: Add www/qt6-webengine < 6.7.3_3

security/vuxml: Document gstreamer1-plugins* < 1.24.10

security/vuxml: Add zabbix-frontend vulnerability

 * Base Score:  9.9 CRITICAL
 * Vector:  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

security/vuxml: document electron33 inappropriate implementation in extensions

Obtained from:	https://github.com/electron/electron/releases/tag/v33.2.1

security/vuxml: security/vuxml: Document Jenkins Security Advisory 2024-11-27

Sponsored by:	The FreeBSD Foundation

net/keycloak: document multiple vulnerabilities

Security:	CVE-2024-9666 CVE-2024-10039 CVE-2024-10270
Security:	CVE-2024-10451 CVE-2024-10492
PR:		282983

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 131.0.6778.85

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html

security/vuxml: Add www/qt6-webengine < 6.7.3_2

security/vuxml: Add www/qt5-webengine < 5.15.18p5

security/vuxml: Add x11-servers/xorg-server, x11-servers/xwayland

PR:		282415

security/vuxml: Add vaultwarden

Vaultwarden -- Multiple vulnerabilities

PR:		282795
Reported by:	Bernard Spil

security/vuxml: Add mongodb vulnerability

Buffer over-read.

security/vuxml: Document vaultwarden vulnerabilities

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.5

security/vuxml: add www/*chromium < 131.0.6778.69

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.5

security/vuxml: Add CVEs for PostreSQL

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.4

security/vuxml: document gitlab vulnerabilities

security/vuxml: add FreeBSD SAs issued on 2024-10-29

FreeBSD-SA-24:17.bhyve affects all supported versions of FreeBSD
FreeBSD-SA-24:18.ctl affects all supported versions of FreeBSD
FreeBSD-SA-24:19.fetch affects all supported versions of FreeBSD

security/vuxml: Document element-web vulnerabilities

Security:	CVE-2024-51749
Security:	CVE-2024-51750

security/vuxml: Document matrix-js-sdk vulnerability

Security:	CVE-2024-50336

security/vuxml: Document icinga2 vulnerability

security/vuxml: Document new Intel CPU vulnerabilities

Intel has disclosed new CPU vulnerabilities in the release notes for
microcode-20241112.  This release also includes updates to previous
microcode updates for CVE-2024-24968 and CVE-2024-23984.

Reference:	https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20241112
Security:	CVE-2024-21820
Security:	CVE-2024-21853
Security:	CVE-2024-23918
Security:	CVE-2024-23984 (updated microcode)
Security:	CVE-2024-24968 (updated microcode)
Sponsored by:	The FreeBSD Foundation

security/vuxml: add CVE-2018-10195, CVE-2020-29074

security/vuxml: Document tnef vulnerabilities

PR:		282228

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.3

security/vuxml: Document gstreamer1-rtsp-server

Only affected if assertions are enabled, which we don't do by default.

security/vuxml: add www/*chromium < 130.0.6723.116

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html

security/vuxml: Add record for devel/libqb < 2.0.8 CVE-2023-39976

log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long
log messages because the header size is not considered.
https://nvd.nist.gov/vuln/detail/CVE-2023-39976

PR:	282536

security/vuxml: add www/*chromium < 130.0.6723.91

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html

security/vuxml: Add www/qt5-webengine < 5.15.18p2

Fix indentation issues caught by `make validate` for previous entry.

security/vuxml: Add record for net/keycloak < 26.0.4 CVE-2021-44549

PR:	282419

security/vuxml: www/librewolf < 131.0.3 CVE-2024-9936

PR:	282423

security/vuxml: Add record for devel/hwloc2 < 2.9.2 CVE-2022-47022

PR:	282215

security/vuxml: add record for www/forgejo < 9.0.1 and www/forgejo7 < 7.0.10

https://codeberg.org/forgejo/forgejo/milestone/8544
https://codeberg.org/forgejo/forgejo/pulls/5719
https://codeberg.org/forgejo/forgejo/pulls/5718

PR:	282387

security/vuxml: add www/*chromium < 130.0.6723.{58,69}

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html
Obtained from: 
https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.2

security/vuxml: document gitlab vulnerabilities

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.2

security/vuxml: document www/oauth2-proxy vulnerabilities

Reported by:	Matthias Wolf <freebsd@rheinwolf.de>
PR:		282004

security/vuxml: OpenSSL 3.4 not affected by CVE-2024-9143

security/vuxml: Fix and add OpenSSL versions

security/vuxml: Document OpenSSL low vulnerability

security/vuxml: document electron{31,32} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.1,
	 	https://github.com/electron/electron/releases/tag/v32.2.1

security/vuxml: Document element-web vulnerability

security/vuxml: document VSCode remote code execution vulnerability

Obtained from:	https://github.com/microsoft/vscode/issues/230824

security/vuxml: Fix typo in firefox entry

Reported by:	jbeich@

security/vuxml: Add firefox{-esr} use-after-free code execution

CVE-2024-9680

security/vuxml: document gitlab vulnerabilities

security/vuxml: Add record for www/gitea: Fix bug when a token is given public
only

PR:	281949

security/vuxml: Add record about CVE-2024-25590 in dns/powerdns-recursor

PowerDNS Recursor Security Advisory 2024-04:
https://blog.powerdns.com/2024/10/03/powerdns-recursor-4-9-9-5-0-9-5-1-2-released

PR:	281914

security/vuxml: add www/*chromium < 129.0.6668.{89,100}

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html
Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html

security/vuxml: Fix Thunderbird version

PR:		281960
Reported by:	John Hein <jcfyecrayz@liamekaens.com>
Fixes:		86d1aa3caa24c97cdc63962d13fef16be12c84b7

security/vuxml: document unbound vulnerability

PR:		281894
Security:	CVE-2024-8508
Security:	2368755b-83f6-11ef-8d2e-a04a5edf46d9

security/vuxml: Mark zeek < 7.0.3 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.3

This release fixes the following potential DoS vulnerability:

 - Adding to the POP3 hardening in 7.0.2, the parser now simply
   discards too many pending commands, rather than any attempting
   to process them. Further, invalid server responses do not result
   in command completion anymore. Processing out-of-order commands
   or finishing commands based on invalid server responses could
   result in inconsistent analyzer state, potentially triggering
   null pointer references for crafted traffic.

Reported by:	Tim Wojtulewicz

security/vuxml: Fix name tag for textproc/expat2

Reported by:	Adam McDougall <mcdouga9@egr.msu.edu>
Fixes:		47955717fc53

security/vuxml: Add firefox{-esr}, thunderbird vulnerabilities

CVE-2024-9392
CVE-2024-9396
CVE-2024-9400
CVE-2024-9401
CVE-2024-9402
CVE-2024-9403

security/vuxml: Update range of redis in 8b20f21a-8113-11ef-b988-08002784c58d

In 2024Q3 branch databases/redis still stays in 7.2.x.

Fixes:		e44e4021e418

security/vuxml: Document Jenkins Security Advisory 2024-10-02

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document multiple valnerabilities in Redis and Valkey

security/vuxml: Document PHP vulnerabilities

  There were 4 vulnerabilities found and fixed in PHP.

PR:		281770
Reported by:	FiLis <freebsdbugs@filis.org>

security/vuxml: Update cups-filters entry

security/vuxml: Add CVE-2022-45197

security/vuxml: add www/*chromium < 129.0.6668.70

Obtained
from:	https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html

security/vuxml: Fix typos

Add linux-*-sqlite3 to last entry.
s/mozilla/firefox in an older entry

Reported by:	Edward Sanford Sutton, III (mirror176@hotmail.com)

security/vuxml: Add sqlite use after free vulnerability

CVE-2024-0232
  * Base Score:	5.5 MEDIUM
  * Vector:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

security/vuxml: Add cups-browsed RCE

security/vuxml: Add textproc/expat2 vulnerabilities

CVE-2024-45490
CVE-2024-45491
CVE-2024-45492

PR:		281738
Reported by:	FiLiS <freebsdbugs@filis.org>

security/vuxml: document gitlab vulnerabilities

security/vuxml: document frr vulnerabilities

security/vuxml: Update zeek range for 6.X

Really, it was silly of me to add the <ge> range since there were
no commited 6.X versions that were not vulnerable to the new issue.

security/vuxml: Mark zeek < 7.0.2 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.2

This release fixes the following potential DoS vulnerability:

 - The POP3 parser has been hardened to avoid unbounded state growth
   in the face of one-sided traffic capture or when enabled for
   non-POP3 traffic.

Reported by:	Tim Wojtulewicz

security/vuxml: belatedly add FreeBSD SAs issued on 2024-08-07

FreeBSD-SA-24:05.pf affects all supported versions of FreeBSD
FreeBSD-SA-24:06.ktrace affects all supported versions of FreeBSD
FreeBSD-SA-24:07.nfsclient affects all supported versions of FreeBSD

security/vuxml: complete FreeBSD reference for CVE-2024-7589

FreeBSD-SA-24:08.openssh was issued on 2024-08-07 to address
CVE-2024-7589.  All supported versions of FreeBSD were affected.

While here, correct minor markup nits in the vuxml entry.

security/vuxml: reference FreeBSD-SA-24:04.openssh in CVE-2024-6387

All supported versions of FreeBSD were affected by CVE-2024-6387,
announced on 2024-07-01.  Reference FreeBSD-SA-24:04.openssh in the
vuxml entry.

security/vuxml: add FreeBSD SAs issued on 2024-09-19

FreeBSD-SA-24:15.bhyve affects all supported versions of FreeBSD
FreeBSD-SA-24:16.libnv affects all supported versions of FreeBSD

security/vuxml: document gitlab vulnerability

security/vuxml: correct vulnerable package range for nginx

14dc2636e72c396459a6559868033910ee8a4532 added a new vuxml entry, but
forgot to account for PORTEPOCH.

PR:		281250
Approved by:	maintainer timeout
Security:	CVE-2024-7347

security/vuxml: Document OpenSSH's CVE-2024-7589

Sponsored by:	Klara, Inc.

security/vuxml: Document multiple mXSS vulnerabilities in SnappyMail

security/vuxml: Fix entry

Correct number of recorded CVEs.

Fixes:	019e45d60224

security/vuxml: add www/*chromium < 128.0.6613.137

Obtained
from:	https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_10.html

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document Intel CPU vulnerabilities

Security:	CVE-2024-23984
Security:	CVE-2024-24968
Sponsored by:	The FreeBSD Foundation

security/vuxml: Document multiple vulnerabilities in ClamAV

security/vuxml: Document recent netatalk3 CVEs

security/vuxml: add minio vulnerabilities

PR:		281362
Reported by:	tom@eborcom.com

security/vuxml: Fix firefox version

Reported by:	bapt@

security/vuxml: Record firefox vulnerability

CVE-2024-7652

security/vuxml: Fix topic

Reported by:	jhaley@
Fixes:		05d4a95e7f58

security/vuxml: really fix versionning for firefox

in 8a5936ed301ec363fd7e80762e74bacf0d69fd05 I added the missing
portepoch except I added the wrong one, portepoch is at 2, not at 1

Reported by:	Piotr Smyrak <piotr@smyrak.com>

security/vuxml: Add exiv2 >= 0.28.0 and < 0.28.3