Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1_1 miwi - Update the wordpress -- unmoderated comments disclosure entry. Is safe with
the 2.2.2 Release.
Approved by: simon 1.1_1 itetcu Add info about www/opera's JavaScript vulnerability
PR: ports/115543
Submitted by: Arjan van Leeuwen (maintainer)
Reviewed by: simon@ 1.1_1 remko Fix the flac entry by specificing the correct fixed version.
Bump modification date to reflect the above change.
Submitted by: Stefan Ehmann 1.1_1 miwi - Document fsplib -- multiple vulnerabilities
Reviewed by: remko 1.1_1 miwi Document joomla -- multiple vulnerabilities
Approved by: simon/remko 1.1_1 remko Use the superseded attribute in the cancelled tcpdump entry.
Requested by: simon 1.1_1 remko Document FreeBSD -- Buffer overflow in tcpdump(1).
See: FreeBSD-SA-07:06.tcpdump
This commit also takes over the older tcpdump entry that was specific
to ports, I merged that into this entry and I retired the old one. 1.1_1 remko Bump modification date for: SA-07:04.file
Which I just touched. 1.1_1 remko Correct the fixed version for the jail advisory which was revised yesterday.
Also correct the <freebsdsa>FreeBSD-SA* tags which should not have FreeBSD
in between. 1.1_1 remko Document FreeBSD -- Predictable query ids in named(8)
See: FreeBSD-SA-07:07.bind 1.1_1 miwi - Marked phpSysInfo as safe
Reviewed by: remko 1.1_1 shaun Update phpSysInfo entry: the current version (2.5.3) is affected. 1.1_1 miwi Update mozilla entry
- Marked seamonkey as safe
Submitted by: John E. Hein <jhein@timing.com>
Reviewed by: simon 1.1_1 miwi Update the xpdf entry
- Marked poppler as save 1.1_1 miwi Update xpdf entry
- Marked cups-base as safe
- Add poppler as affected port
Reviewed by: simon 1.1_1 miwi - Fix tcpdump entry 1.1_1 miwi Document xpdf -- stack based buffer overflow
Reviewed by: simon/remko 1.1_1 miwi - Fix a typo
Submitted by: shaun 1.1_1 miwi - Document tcpdump -- remote integer underflow vulnerability
Reviewed by: remko 1.1_1 miwi - Document mutt -- buffer overflow vulnerability
Reviewed by: remko 1.1_1 miwi - Document p5-Net-DNS -- multiple Vulnerabilities
Reviewed by: remko 1.1_1 miwi - Document phpsysinfo -- url Cross-Site Scripting 1.1_1 miwi - Document drupal -- Cross site request forgeries
- Document drupal -- Multiple cross-site scripting vulnerabilities
Submitted by: nick@foobar.org
Reviewed by: simon 1.1_1 miwi - Document vim -- Command Format String Vulnerability
Approved by: simon 1.1_1 miwi - Document libvorbis - Multiple memory corruption flaws
Submitted by: lx@
Reviewed by: simon 1.1_1 delphij Document XSS vulnerabilities in several tomcat versions;
update affected tomcat versions for CVE-2005-2090. 1.1_1 delphij The previous vuxml entry applies to jakarta-tomcat 4.0.x as well, so mark
it as affected as well. Since there is no newer release I have used 4.1.0
as the "fixed" version. 1.1_1 delphij Document multiple vulnerabilities found in www/tomcat41 1.1_1 delphij Document dokuwiki spellchecker XSS vulnerabilities 1.1_1 simon Fix last commit: the name tag was empty.
Reported by: FreshPorts via Dan Langille
Pointyhat to: delphij 1.1_1 delphij Document lighttpd multiple vulnerabilities 1.1_1 simon Add another reference to mozilla -- multiple vulnerabilities. 1.1_1 simon - Document opera -- multiple vulnerabilities.
- Correct and sort a few links in the latest mozilla entry. 1.1_1 simon Document mozilla -- multiple vulnerabilities. 1.1_1 delphij Document linuxflashplugin critical vulnerabilities.
Reported by: jamie at bishopston net 1.1_1 miwi - Fix the versions number of typespeed from 4.1.0 to 0.4.1
PR: 114441
Submitted by: Tor Halvard Furulund <squat@squat.no> 1.1_1 sat - Fix the latest wireshark entries by correcting a typo and adding
more package names 1.1_1 miwi - Document wireshark - Multiple problems
Reviewed by: simon@ 1.1_1 gabor - Document typespeed arbitrary code execution
Reviewed by: remko 1.1_1 miwi - Fix a typo vcl -> vlc
Noticed by: lx@ 1.1_1 miwi - Document vlc - format string vulnerability and integer overflow 1.1_1 miwi - Document flac123 - stack overflow in comment parsing
Reviewed by: simon@ 1.1_1 remko Document gd -- multiple vulnerabilities
PR: ports/114115
Submitted by: Nick Barkas <snb at threerings dot net> (minor modifications by
me). 1.1_1 delphij Document that CVE-2007-3257 was fixed with evolution-data-server
1.10.2_1. 1.1_1 sat - Fix modified date in mod_perl entry 1.1_1 erwin Mark www/mod_perl2 fixed in version 2.0.3_2,3 1.1_1 delphij Document evolution-data-server remote arbitrary code execution
vulnerability.
Fix at: Evolution SVN changeset 7817 (#447414) 1.1_1 erwin The XMLRPC SQL Injection issue with wordpress was addressed in the
latest release. 1.1_1 gabor Document xpcd buffer overflow vulnerability.
Revieved by: remko 1.1_1 remko Document clamav -- multiple vulnerabilities. 1.1_1 delphij Document SpamAssassin vulnerability CVE-2007-2873, a local
DoS issue. 1.1_1 miwi - Document cups -- Incomplete SSL Negotiation Denial of Service.
Reviewed by: simon@ 1.1_1 miwi - Fix other duplicate entry.
Reviewed by: simon 1.1_1 miwi - Document c-ares -- DNS Cache Poisoning Vulnerability
Reviewed by: simon@ 1.1_1 miwi - Fix duplicate entry de-wordpress -> zh-wordpress. 1.1_1 gabor Add zh-wordpress as affected by the last two wordpress entries. 1.1_1 gabor wordpress -- XMLRPC SQL Injection
wordpress -- unmoderated comments disclosure
Reviewed by: simon 1.1_1 miwi - Document webmin -- cross site scripting
Reviewed by: simon@ 1.1_1 simon - The fixed mplayer version number is 0.99.10_10, mark it as such. [1]
- Add older mplayer package names.
- Break long lines.
Noticed by: Henrik Brix Andersen <henrik@brixandersen.dk> 1.1_1 miwi - Fix mplayer portversion. 1.1_1 miwi - Document mplayer -- cddb stack overflow.
Reviewed by: simon@ 1.1_1 gabor - Note that plone is also affected by 34414a1e-e377-11db-b8ab-000c76189c4c
prior to version 2.5.3
Reviewed by: simon 1.1_1 gabor - gzip 1.3.12 has been patched and is not affected by
11a84092-8f9f-11db-ab33-000e0c2e438a any more
Reviewed by: simon 1.1_1 erwin Document an information disclosure vulnerability in mod_jk < 1.2.23.
Reviewed by: simon 1.1_1 erwin Add an entry for an email header injection vulnerability in
www/typo3 from February.
Reviewed by: remko
Persuaded by: cperciva and simon by setting up the
ports-security team 1.1_1 miwi - Document phppgadmin - Cross Site Scripting Vulnerability.
Reviewed by: mnag@
Reported by: dinoex@ 1.1_1 trasz - Add entry for findutils -- GNU locate heap buffer overrun.
Revieved by: simon (secteam)
Approved by: miwi (mentor) 1.1_1 delphij Mark file < 4.21 as vulnerable to the heap overflow. 1.1_1 marcus Add an entry for the recent Freetype heap overflow vulnerability.
Submitted by: Nick Barkas <snb@threerings.net> 1.1_1 remko Document FreeBSD-SA-07:04.file (heap overflow in file(1))
Approved by: portmgr (secteam implicit) 1.1_1 miwi - Document squirrelmail -- Cross site scripting in HTML filter
Approved by: portmgr (marcus) 1.1_1 simon Document png -- DoS crash vulnerability. 1.1_1 simon Document samba -- multiple vulnerabilities.
Brought to you from Heathrow Airport and BSDCan 2007 Devsummit. 1.1_1 simon Backout last change.
Blackboard:
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
x1000
Pointy hat to: simon 1.1_1 simon Update PHP entry to include the vulnerable version so the entry is
correct for when PHP is updated in ports (yes it's being worked on),
or for people who upgrade "manually".
With hat: secteam
Requested by: several 1.1_1 remko Document a lot of PHP vulnerabilities, mark all php4 and php5 (+cli,cgi)
ports as vulnerable till the ports had been upgraded. 1.1_1 remko Bump modification date for the latest mod_perl entry, this was forgotten
by erwin, but there were "massive" changes that warrant a date bump. 1.1_1 remko Standarize the latest entry (qemu) a bit more and add a forgotten 'a'
in the p5-Imager text. 1.1_1 nox Document multiple qemu vulnerabilities
Obtained from: debian-security-announce@lists.debian.org mailing list
Security: multiple qemu vulnerabilities 1.1_1 lbr Update to 0.57 - fixes possible overflow vulnerability regarding malformed
BMPs, see vuln.xml for details.
Security: VuXML ID: 632c98be-aad2-4af2-849f-41a6862afd6a 1.1_1 remko Document FreeBSD -- IPv6 Routing Header 0 is dangerous 1.1_1 erwin Rework the mod_perl entry to note that Mandriva originally released
an advisory. Also add mod_perl2 to the vulnerable versions. 1.1_1 erwin Minor wordsmithing in the last mod_perl entry.
Submitted by: simon 1.1_1 erwin Add entry for mod_perl -- remote DOS in PATH_INFO parsing
PR: 111844
Submitted by: "Philip M. Gollucci" <pgollucci@p6m7g8.com> 1.1_1 tobez p5-Crypt-OpenPGP 1.03_1 should not be vulnerable to CVE-2005-0366. 1.1_1 sat - Mark latest firefox and seamonkey snapshots as safe 1.1_1 miwi - Add entry for claws-mail - APOP vulnerability 1.1_1 mnag lighttpd -- DOS when access files with mtime 0
lighttpd -- Remote DOS in CRLF parsing 1.1_1 stas - Add freeradius-mysql to the list of affected packages of the recent
freeradius entry.
Submitted by: David Wood <david@wood2.org.uk> 1.1_1 flz Mark Google Earth >= 4.0.2414 as safe. 1.1_1 stas - Document recent remote dos vulnerability in freeradius. 1.1_1 simon Add an extra reference to the old "gnupg -- OpenPGP symmetric
encryption vulnerability" entry which explains the problem in a more
easy to read way.
Submitted by: tobez (sort of) 1.1_1 barner Document fetchmail's "insecure APOP authentication" issue (fixed in 6.3.8). 1.1_1 remko Stylify the latest zope entry:
o Use consistent title description
o Use tabs when 8 spaces are hit
o Sort the references list (the alphabet goes from a to z)
o Bump modification date (note: please check the entry date
so that it matches the correct data of insertion).
Also stylify the latest mcweject entry. 1.1_1 stefan Add entry for exploitable buffer overflow in mcweject.
PR: 111365
Submitted by: Jeff Forsythe<tornandfilthy2006@yahoo.com> 1.1_1 stefan Add entry for webcalendar "noSet" variable overwrite vulnerability.
PR: 110585
Submitted by: Greg Larkin <glarkin@sourcehosting.net> 1.1_1 stefan Add entry for Zope2 cross-site scripting vulnerability.
Inspired by: Yasushi Hayashi<yasi@yasi.to> (in PR 111119 ) 1.1_1 sem Remove f951cf4a-a1fe-11db-98f9-0004aca3703d entry. It's duplicate to
41da2ba4-a24e-11db-bd24-000f3dcc6a5d. 1.1_1 sat - Fix versions and dates in latest squid entry
Pointy hat to: miwi 1.1_1 remko Standarise the latest Squid entry.
