Document cups-base remote buffer overflow vulnerability.

Approved by:    portmgr (ports-security blanket)

Make perl entry to cover perl-threaded as well.

Reported by:    Andy Greenwood <greenwood.andy gmail com>
Approved by:    portmgr (ports-security blanket)

- Document perl --  regular expressions unicode data buffer overflow

Reviewed by:    simon/tobez
Approved by:    portmgr (blanket) (ports-security blanket)

Document pcre arbitrary code execution vulnerability.

Approved by:    portmgr (ports-security blanket)

- perdition entry - correct range

Approved by:    portmgr (pav) linimon (mentor)

- Add entry for mail/perdition

PR:             ports/117796
Approved by:    portmgr (pav), linimon (mentor)

- gftp -- multiple vulnerabilities

Reviewed by:    simom
Approved by:    portmgr (blanket) (ports-security blanket)

- Update dirproxy -- remote denial of service
         * Add net/dirproxy with the same affect
         * Update net/dirproxy-devel as safe

Reviewed by:    simon
Approved by:    portmgr (blanket) (ports-security blanket)

- dirproxy -- remote denial of service

Reviewed by:    remko
Approved by:    portmgr (blanket) (ports-security blanket)

- Fix discovery date on my previous commit

Approved by:    portmgr (ports-security blanket)

- document wordpress -- cross-site scripting

Reviewed by:    simon
Approved by:    portmgr (ports-security blanket)

Extend coverage to OpenLDAP 2.4.x series which is affected according
to CVS history.

Approved by:    portmgr (ports-security blanket)

Document openldap multiple vulnerabilities.

Approved by:    portmgr (ports-security blanket)

Bump modified date for entry updated in last commit.

Approved by:    portmgr (secteam blanket)

Update vuxml to reflect that mod_jk and mod_jk-ap2 have
different portepochs.

Approved by:    portmgr (pav)

- Update mozilla -- code execution via Quicktime media-link files

PR:             117704
Submitted by:   John Hein <jhein@timing.com>
Reviewed by:    simon
Approved by:    portmgr (blanket) secteam (blanket via simon)

Document django DoS issue.

- Fix day entry for 498a8731-7cfc-11dc-96e6-0012f06707f0

Reviewed by:    simon

- Document opera -- multiple vulnerabilities

Reviewed by:    remko

- Document drupal --- multiple vulnerabilities

Reviewed by:    simon

- Document ldapscripts -- Command Line User Credentials Disclosure

PR:             117152
Submitted by:   Ganael Laplanche <ganael.laplanche at martymac.com>
(maintainer/author)
                rafan@
Reviewed by:    simon@

Modify firefox entry to cover linux-* variants.

Document firefox JavaScript Entrapment vulnerabilities.

- Fix year entry in 498a8731-7cfc-11dc-96e6-0012f06707f0

Submitted by:   freshports
Thanks to:      Dan Langille

- Add new line between entries.

- Add entry about recent phpMyAdmin XSS server_status.php vulnerability
- Fix URL in my previous entry while I'm here.

- Fix package name in 51b51d4a-7c0f-11dc-9e47-0011d861d5e2 and
  229577a8-0936-11db-bf72-00046151137e entries (phpmyadmin->phpMyAdmin).

- Add entry about phpMyAdmin XSS vulnerability.

nagios-plugins -- Long Location Header Buffer Overflow Vulnerability

Reviewed by:    simon

Document png -- multiple vulnerabilities

Reviewed by:    simon

Document ImageMagick - Multiple vulnerabilities

Submitted by:           Nick Barkas

Correct mediawiki package names.

Spotted by:     Nick Barkas

- Dokument jdk/jre -- Applet Caching May Allow Network Access Restrictions to be
Circumvented

Reviewed by:    remko

Document xfs -- multiple vulnerabilities.

- Document tcl/tk -- buffer overflow in ReadImage function

PR:             116881
Submitted by:   Nick Barkas <snb@threerings.net>
Reviewed by:    simon

Document firebird multiple remote buffer overflow vulnerabilities

Update the bugzilla and mediawiki entries to properly match their corrected
versions.

Prodded by:     Nick Barkas (and a few others)

Update to reflect the fixed version of id3lib.

Document id3lib insecure temporary file creation vulnerability

- modify mediawiki entry (add missing mediawiki18)

Reviewed by:    remko

Some PHP 5.x vulnerabilities is also found in PHP 4.x series,
unfortunately it seems that there is no newer PHP release to
fix these issue for 4.x series, so mark it as so.

While I'm there add a new CVE that was not mentioned in
previous revision of entry.

Document mediawiki -- cross site scripting vulnerability, our port versions
had not been updated yet, 1.8.x is not vulnerable by default unless you are
using the $wgEnableAPI = true; statement, in that case please set it to
$wgEnableAPI = false; (where possible ofcourse, else upgrade to 1.8.5).

Document wordpress -- remote sql injection vulnerability, our versions are
already up to date for this vulnerability.

samba -- nss_info plugin privilege escalation vulnerability, the FreeBSD
port had already been fixed for this.

Document bugzilla -- multiple vulnerabilities

PR:             ports/116060
Submitted by:   Nick Barkas <snb at threerings dot net>, minor nits from me

Document clamav CVE-2007-4510 issue (Remote DoS).

Document coppermine -- multiple vulnerabilities, the FreeBSD
port is already up to date.

Document openoffice -- arbitrary command execution vulnerability,
all current versions marked vulnerable, everything as of 2.3 is
believed to be fixed, but we do not have that yet ( I am also not
sure whether the -devel version has the correct fix or not ) so
lets be on the safe side till we know what version will be fixed
in our repro.

Document bugzilla -- "createmailregexp" security bypass vulnerability,
marking all versions as vulnerable till we know what version is the
one fixed in our CVS repository.

Spell Ulf Harnhammar (ASCII version of name) using UTF-8 instead of HTML
entities which can't be assumed is available to a paser by default.

This fixes a warning from packaudit.

Document kdm -- passwordless login vulnerability
Document konquerer -- address bar spoofing

Inspired by:    lofi's cvs commits

Document flyspray -- authentication bypass

Submitted by:   Nick Hilliard <nick at foobar dot org>

Document mozilla -- code execution via Quicktime media-link files,
The Mozilla advisory talks somewhat about Windows for this matter,
but better be safe then sorry (An updated firefox is available already).

Update the PHP vulnerability entry:

 - Use php5 to cover php 5.x as the port did.
 - Add more information about the vulnerability.

Submitted by:   Nick Barkas <snb threerings net>
PR:             ports/116182

Correct a style nit and bump modification date.
Bump modification date for "xpdf -- stack based buffer overflow"
which was forgotten by Jeremy (mezz) :-)

Document Apache 2.0.x, 2.2.x series' vulnerabilities as well
as security related improvements in php 5.2.4.

There is no code of CVE-2007-3387 vulnerability in evince, therefore remove
it from the database. It only merely depends on poppler and poppler has been
patched (marked as safe in database).

- lighttpd -- FastCGI header overrun in mod_fastcgi

Fix mod_jk's version since PORTEPOCH came into play.

PR:             116115
Reported by:    Klavs Klavsen <klavs at EnableIT dot dk>

rkhunter -- insecure temporary file creation

Reviewed by:    remko

lsh -- multiple vulnerabilities

Reviewed by:    remko

Document fetchmail -- denial of service on reject of local
warning message.

Submitted by:   Matthias Andree <matthias.andree@gmx.de>
PR:             ports/??? (Not received by GNATS yet)

Document gtar directory traversal vulnerability.

PR:             115914
Submitted by:   Nick Barkas <snb@threerings.net>

- Marked sylpheed2 as safe.

Reviewed by:    remko

- Fix a typo.

- Document Sylpheed / Sylpheed-Claws POP3 Format String Vulnerability

Reviewed by:    simon

From latest Opera entry:
- Remove redundant information.
- Bump modified date for recent changes to the entry.

linux-opera and (for the moment defunct) opera-devel are also affected by
df4a7d21-4b17-11dc-9fc2-001372ae3ab9 - Vulnerability in javascript handling so
addd them to the entry.

Submitted by:   sat@

Update vuln.xml for rsync 2.6.9_1 which fixed CVE-2007-4091

Document rsync off-by-one stack overflow vulnerability.

- Update the wordpress -- unmoderated comments disclosure entry. Is safe with
the 2.2.2 Release.

Approved by:    simon

Add info about www/opera's JavaScript vulnerability

PR:             ports/115543
Submitted by:   Arjan van Leeuwen (maintainer)
Reviewed by:    simon@

Fix the flac entry by specificing the correct fixed version.
Bump modification date to reflect the above change.

Submitted by:   Stefan Ehmann

- Document fsplib -- multiple vulnerabilities

Reviewed by:    remko

Document joomla -- multiple vulnerabilities

Approved by:    simon/remko

Use the superseded attribute in the cancelled tcpdump entry.

Requested by:   simon

Document FreeBSD -- Buffer overflow in tcpdump(1).

See: FreeBSD-SA-07:06.tcpdump

This commit also takes over the older tcpdump entry that was specific
to ports, I merged that into this entry and I retired the old one.

Bump modification date for: SA-07:04.file
Which I just touched.

Correct the fixed version for the jail advisory which was revised yesterday.

Also correct the <freebsdsa>FreeBSD-SA* tags which should not have FreeBSD
in between.

Document FreeBSD -- Predictable query ids in named(8)

See: FreeBSD-SA-07:07.bind

- Marked phpSysInfo as safe

Reviewed by:    remko

Update phpSysInfo entry: the current version (2.5.3) is affected.

Update mozilla entry
- Marked seamonkey as safe

Submitted by:   John E. Hein <jhein@timing.com>
Reviewed by:    simon

Update the xpdf entry
- Marked poppler as save

Update xpdf entry
- Marked cups-base as safe
- Add poppler as affected port

Reviewed by:    simon

- Fix tcpdump entry

Document xpdf -- stack based buffer overflow

Reviewed by:    simon/remko

- Fix a typo

Submitted by:   shaun

- Document tcpdump -- remote integer underflow vulnerability

Reviewed by:    remko

- Document mutt -- buffer overflow vulnerability

Reviewed by:    remko

- Document p5-Net-DNS -- multiple Vulnerabilities

Reviewed by:    remko

- Document phpsysinfo -- url Cross-Site Scripting

- Document drupal -- Cross site request forgeries
- Document drupal -- Multiple cross-site scripting vulnerabilities

Submitted by:   nick@foobar.org
Reviewed by:    simon

- Document vim -- Command Format String Vulnerability

Approved by:    simon

- Document libvorbis - Multiple memory corruption flaws

Submitted by:   lx@
Reviewed by:    simon

Document XSS vulnerabilities in several tomcat versions;
update affected tomcat versions for CVE-2005-2090.

The previous vuxml entry applies to jakarta-tomcat 4.0.x as well, so mark
it as affected as well.  Since there is no newer release I have used 4.1.0
as the "fixed" version.

Document multiple vulnerabilities found in www/tomcat41

Document dokuwiki spellchecker XSS vulnerabilities

Fix last commit: the name tag was empty.

Reported by:    FreshPorts via Dan Langille
Pointyhat to:   delphij