VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.
Document four vulnerabilities in openvpn:
* openvpn -- multiple TCP clients connecting with the same certificate at the
same time can crash the server
* openvpn -- denial of service: malicious authenticated "tap" client
can deplete server virtual memory
* openvpn -- denial of service: undecryptable packet from authorized client can
disconnect unrelated clients
* openvpn -- denial of service: client certificate validation can disconnect
unrelated clients
Approved by: portsmgr (blanket VuXML)
Submitted by: Matthias Andree <matthias dot andree at gmx dot de>
Add the fixed version so that people do not get a stale portaudit when the
update is there.
Also fix some indentation that i overlooked.
Noticed by: simon (both of the items)
Approved by: portsmgr (blanket VuXML)
Add phpmyfaq and drupal to the "pear-XML_RPC -- remote PHP code
injection vulnerability" entry since they contain an embedded version of
pear-XML_RPC.
Fix typo in body of the latest xpdf entry (note: no modified date bump
as this is a minor typo fix which does change <affects>).
Approved by: portmgr (blanket, VuXML)
After further examination it turns out that gnugadu does not include
libgadu, at least not any in any current version, and from looking at
the gnugadu code there is no direct indication that this code should
actually be vulnerable to the other libgadu vulnerabilities. [1]
The gaim part of libgadu -- multiple vulnerabilities was fixed in
1.4.0_1. [2]
Polish translation clue: pjd [1]
General clue by: markus [2]
Not enough checking: simon
Approved by: portmgr (blanket, VuXML)
Remove pl-gnugadu2 and kadu from being affected by libgadu -- multiple
vulnerabilities, since it turns out that they use libgadu from the ekg
port.
Approved by: portmgr (blanket, VuXML)
Remove pdftohtml from the list of packages affected by xpdf -- disk
fill DoS vulnerability, since it includes xpdf 2, which should not be
affected.
Approved by: portmgr (blanket, VuXML)
Correct the ranges for the IPSec advisory and the devfs advisory.
Also correct proper ranges for the zlib advisory.
Approved by: portsmgr (blanket VuXML)
Add some more entries to the apache -- http smuggling vulnerability.
PR: ports/84312
Submitted by: Dmitry A Grigorovich <odip at bionet dot nsc dot ru>
Approved by: portsmgr (blanket VuXML)
Note that the fix for gnupg -- OpenPGP symmetric encryption
vulnerability in gnupg is not complete (see entry for details).
Discussed with: nectar
Approved by: portmgr (blanket, VuXML)
Add pdflib-perl, fractorama, gdal, iv, ivtools, ja-iv, ja-libimg,
paraview to recent libtiff vulnerabilities since they contain (and
compile) an embedded version of libtiff...
Change MAINTAINER address for ports maintained by the Security Team to
secteam@ instead of security@ to make it more clear that the ports are
not maintained by the freebsd-security@ mailing list. Both addresses
go to the same people.
- Misc. markup/whitespace fixes.
- Collapse a few package entries from the latest apache entry (still
matches same package names, is just shorter markup-wise).
- Use standard topic style for jaberd entry.
- Fix entry date for jaberd entry.
Update my latest Apache entry to make clear that this only affects certain
installations (when Apache is used as a HTTP proxy in combination with some
web servers). I didn't make that clear in the first commit.
Requested by: nectar
Discussed with: clement
- Document isc-dhcpd -- format string vulnerabilities (older
vulnerabilty). [1]
- Use standard title format for latest egroupware entry.
Reminded by: Panagiotis Christias [1]
- Document firefox & mozilla -- multiple vulnerabilities.
- Minor style nit in drupal entry: Use port name (i.e. lower case) as
first part of the title.
- Add another reference to bzip2 -- denial of service and permission
race vulnerabilities.
- Document two cases of wordpress -- multiple vulnerabilities.
- Add entry for trac -- file upload/download vulnerability.
- Improve the last couple of entries a bit:
- Whilespace cleanup.
- Use standard topic format (port name first, then description
starting with lower case).
- Make sure SpamAssasin entry also match other 3.0.3 port revisions.
