VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.
For recent "mozilla -- multiple vulnerabilities" entry:
- Mark Seamonkey 1.1.1 as safe. While mozilla.org does not clearly
state this, it does seem to be the case. [1]
- Add another critical vulnerability which wasn't on the web site when
the vuxml entry was initially added.
Reported by: Volodymyr Kostyrko [1]
Document libarchive -- Infinite loop in corrupt archives handling in
libarchive.
This is also FreeBSD SA-06:24.libarchive, FreeBSD systems are not
affected, only specific STABLE versions which are not released!!
Document mozilla -- multiple vulnerabilities.
Note that Seamonkey 1.1 is marked vulnerable under the "better safe than
sorry" principle, since it's not yet clear if Seamonkey 1.1 is
vulnerable to this batch of vulnerabilities.
Mark 5.2.1_2 as the first safe version for the recent "php -- multiple
vulnerabilities" entry since there was a bug in one of the fixes in
upstream 5.2.1 which port revision 5.2.1_2 fixed.
Upgrade drupal to 4.7.5 fixing a couple security issues.
Upgrade drupal-pubcookie and drupal-textile to the 4.7 versions.
Submitted by: Nick Hilliard <nick at foobar dot org> (upgrade to 4.7.4)
Security: vid:3d8d3548-9d02-11db-a541-000ae42e9b93
- Update the www/zope entry to indicate it is fixed now
PR: ports/106505
Submitted by: HAYASHI Yasushi <yasi@yasi.to>
Reviewed by: simon
Approved by: erwin (mentor)
Update several entries, making them a bit clearer (Were possible),
adjusting some package names, and collapsing some ruby entries that
can be combined. Also properly sort the <bid> and <cvename> tags.
b comes before c.
- Change spaces to tabs in <name> and <range>
- Remove some empty lines
- Respect 2 spaces between <body> and <p>
- Respect empty line between <vuln vid=""> entry.
Rewrite the libxine entry:
o Use the FDP style to fill in the entry.
o Remove the secunia references and use the libxine information.
o Properly sort the references section
o Add the modified tag (since I changed it).
* Fix typo in the latest GnuPG entry, inherited from the original message
* Fix the URL in references, the former one gives 404 Not found.
Kuriyama, where did you get it from?
In latest gnupg entry:
- Use "Werner Koch reports" instead of "Author reports" to follow
normal style in vuln.xml.
- Fix some indentation and markup in body.
Add bugzilla -- multiple vulnerabilities entry.
Update earleir bugzilla entry with better topic, add ja-bugzilla as
also potentially vulnerable (thought the version currently in
ja-bugzilla isn't), and add more references.
Add a <modified> tag with the current date to reflect my previous change.
I knew I should ask someone before committing, however trivial was the change.
Spotted by: remko
Approved by: portmgr (implicit)
Add reference, which I missed the first time around, from Opera
Software to opera -- URL parsing heap overflow vulnerability entry,
Approved by: portmgr (secteam blanket)
Update entry for nvidia-driver -- arbitrary root code execution
vulnerability:
- Add new info about vulnerable versions from NVIDIA.
- Add workaround.
- Add more references.
- Remove suggestion to move to "nv" driver now that we have a simpler
workaround.
Approved by: portmgr (secteam blanket)
Parts submitted by: mnag
Update php -- _ecalloc Integer Overflow Vulnerability entry with
details from Steffan Essers advisory about the implications of this
issue. The advisory was not public when this issue was initially
fixed.
Approved by: portmgr (secteam blanket)
Mark multimedia/win32-codecs as not-vulnerable after the quicktime codecs
were optional. The quicktime codecs are still vulnerable though, but we
rely on the conditional FORBIDDEN statement in the ports Makefile for this.
Approved by: portmgr (self), secteam (simon)
Document "nvidia-driver -- arbitrary root code execution vulnerability".
Note that I haven't actually had time to make a test system to reproduce
this on FreeBSD, but due to the nature of this issue and that there is a
PoC exploit in the advisory, I'm adding this entry due to "better safe
than sorry"...
Approved by: portmgr (secteam blanket)
