Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1_1 simon Document libexif -- buffer overflow vulnerability. 1.1_1 nectar Fix invalid date.
Noticed by: Kang Liu <liukang@bjut.edu.cn> 1.1_1 nectar Add <modified> date for recent commit to phpbb vulnerability.
Forgotten by: delphij
While here, add msgids for recent phpbb addition. 1.1_1 delphij Document a low risk HTML injection (configuration bypass)
vulnerability [1] of phpBB.
(maintainer contacted and is preparing a fix)
[1] http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274 1.1_1 delphij Add bugtraq bug ID for phpbb vulnerability.
Submitted by: Kang LIU <liukang bjut edu cn> 1.1_1 nectar Document two phpnuke vulnerabilities, and a Linux RealPlayer
vulnerability.
Based on entries that were
Submitted by: Devon H. O'Dell <dodell@sitetronics.com> 1.1_1 simon - Document ImageMagick -- format string vulnerability.
- Fix typo on older tiff entry. 1.1_1 nobutaka Document the privilege escalation vulnerability in uim. 1.1_1 nectar Fix typo in linux-tiff version number for
http://vuxml.freebsd.org/8f86d8b5-6025-11d9-a9e7-0001020eed82.html
Reported by: Ian Moore <no-spam@swiftdsl.com.au> 1.1_1 nectar Document lighttpd information disclosure bug.
This entry is based on one that was
Submitted by: Devon H. O'Dell <dodell@offmyserver.com> 1.1_1 nectar Fix typo in linux-tiff version number for
http://vuxml..freebsd.org/fc7e6a42-6012-11d9-a9e7-0001020eed82.html
Reported by: Ian Moore <no-spam@swiftdsl.com.au> 1.1_1 delphij Document latest phpBB critical security vulnerabilities.
Submitted by: Kang LIU <liukang bjut edu cn> 1.1_1 nectar Correct the linux-tiff version number for several entries.
Reported by: netchild 1.1_1 simon Document curl -- authentication buffer overflow vulnerability. 1.1_1 simon - Document cyrus-imapd -- multiple buffer overflow vulnerabilities. [1]
- Use bid tag for a reference in sup entry.
Advice from: ume [1] 1.1_1 hrs Document format string vulnerabilities in net/sup. 1.1_1 simon - Just use mozilla in title for last entry for consistency.
- Document mozilla -- insecure temporary directory vulnerability. 1.1_1 simon Update list of affected mozilla/firefox ports by the web browsers --
window injection vulnerabilities entry. 1.1_1 simon Document mozilla & firefox -- arbitrary code execution vulnerability.
Submitted by: Devon H. O'Dell <dodell@sitetronics.com> (original version) 1.1_1 nectar Improve the description of the latest phpBB information disclosure
bugs.
Submitted by: delphij (in part) 1.1_1 hrs Document a format string vulnerability in mkbold-mkitalic.
Reviewed by: simon 1.1_1 nectar Add CVE names for wget. 1.1_1 nectar De-confuse latest AWStats entry: rewrite description, and add relevant
references. There were so many bugs, it was hard to keep them straight
(^_^). 1.1_1 nectar Format the <topic> of the most recent entry so that it is more
consistent with other entries. 1.1_1 delphij Document latest phpbb vulnerabilities.
Discussed with: phpbb maintainer 1.1_1 simon Add more references to recent putty vulnerability. 1.1_1 nectar The mod_dosevasive port was upgraded. 1.1_1 nectar Nit:
- In most recent `unace' entry, replace HTML entity with the Unicode
character. We do not use HTML entities so that a VuXML document may
be processed without using the DTD. (We also avoid character entity
references for more natural grep'ing, sed'ing, and editor searching.)
Corrections:
- An invalid UUID was assigned to a FreeRADIUS vulnerability, and went
undetected since last October. (>_<) Correct it.
- A bnc vulnerability was duplicated. Cancel the older, less informative
entry and update the newer entry. 1.1_1 naddy Document unace-1.2b vulnerabilities: buffer overflows, directory traversal. 1.1_1 simon For the the recent kdelibs entry; note that dcopidlng is only used at
build time.
Reported by: lofi 1.1_1 simon Document heap corruption vulnerabilities in putty. 1.1_1 simon Update affected versions of latest postgresql entry now that the ports
have been fixed. 1.1_1 simon Document insecure temporary file creation in kdelibs. 1.1_1 simon Document format string vulnerability in bidwatcher. 1.1_1 simon Document a directory traversal vulnerability in gftp. 1.1_1 simon - Document two Opera vulnerabilities.
- Update information about fixed version for Opera with regard to
"Window Injection" issues (based on release notes for Opera 7.54u2). 1.1_1 simon Document multiple buffer overflows in postgresql. 1.1_1 simon Fix entry date for last commit. 1.1_1 simon Document vulnerabilities in awstats. Note that this entry will most
likely be updated soon when more information becomes available. 1.1_1 simon Add a few more references to the awstats entry. 1.1_1 nobutaka Change affected packages version for the emacs movemail format string
vulnerability since I fixed editors/emacs port by adding a patch
instead of upgrading it to 21.4. 1.1_1 simon Document DoS in powerdns. 1.1_1 simon Document format string vulnerability in the Emacs movemail utility. 1.1_1 danfe - Reflect fixing vulnerability in `net/opendchub'
- Print project's name correctly 1.1_1 simon - Fix a cvename that should have been a certvu.
- Delete trailing white space.
- Fix some nearby formatting while I'm here anyway. 1.1_1 simon Document two vulnerabilities in ngircd. 1.1_1 simon Document mod_python information leakage vulnerability. 1.1_1 simon Document mailman directory traversal vulnerability. 1.1_1 nectar Expand HTML entity reference in latest VuXML entry. 1.1_1 naddy Document enscript-{a4,letter,letterdj} vulnerabilities. 1.1_1 danfe Vulnerability in unrtf is fixed now. 1.1_1 simon Document privilege escalation vulnerability in postgresql. 1.1_1 simon Document multiple protocol dissectors vulnerabilities in ethereal. 1.1_1 nectar Add another squid issue.
PR: ports/76967
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de> 1.1_1 nectar Add CERT Vulnerability Note reference for one squid issue,
and correct the reference for another one [1].
Reported by: Thomas-Martin Seck <tmseck@netcologne.de> [1] 1.1_1 nectar Add CVE name for squid confusing empty ACL issue. 1.1_1 nectar Add US-CERT Vulnerability Note references for recent squid issues. 1.1_1 perky Add missing <code> markups in a citation from PSF-2005-001. 1.1_1 perky Add an entry for PSF-2005-001,
"SimpleXMLRPCServer.py allows unrestricted traversal" 1.1_1 marcus Update the entry for CAN-2005-0064 to indicate that gpdf 2.8.3 has a fix
for this vulnerability. 1.1_1 nectar Note that perl does not have a suidperl by default. 1.1_1 nectar Note vulnerabilities in perl. 1.1_1 nectar Add Bugtraq ID for evolution issue. 1.1_1 nectar Add CVE name for squid WCCP issue. 1.1_1 nectar Add a <modified> tag to the perl File::Path issue since the affected
versions were changed.
Forgotten by: tobez 1.1_1 tobez Narrow perl File::Path vulnerability version range a bit. 1.1_1 niels Documented vulnerabilities found in the newspost, newsfetch and newsgrab ports.
http://people.freebsd.org/~niels/issues/newspost-20050114.txt
http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt
http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt
Approved by: nectar (mentor) 1.1_1 nectar The latest xpdf buffer overflow has been repaired in an update
to pdftohtml.
Submitted by: erwin 1.1_1 nectar Add CVE names for recent squid vulnerabilities. 1.1_1 sem squid -- buffer overflow in WCCP recvfrom() call
PR: ports/76827
Submitted by: squid maintainer 1.1_1 simon Mark cups-base as fixed wrt. to "makeFileKey2() buffer overflow
vulnerability". 1.1_1 simon Document "makeFileKey2()" buffer overflow vulnerability in xpdf (and
programs embedding xpdf). 1.1_1 nectar pdflib has been corrected.
Noticed by: Hilko Meyer <Hilko.Meyer@gmx.de> 1.1_1 nectar Document a vulnerability in zhcon. 1.1_1 simon Fix last YAMT entry update to actually make sense... Greater than and
less than are not the same...
Pointy hat to: simon 1.1_1 simon Mark latest YAMT port version as fixed. 1.1_1 simon Document arbitrary code execution vulnerability in evolution. 1.1_1 nectar The previous commit was
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de> 1.1_1 nectar Correct the entry date for 4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3
``squid -- HTTP response splitting cache pollution attack''. 1.1_1 nectar Document a local vulnerability in mod_dosevasive. 1.1_1 nectar Document a possible cache-poisoning issue affecting squid.
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de> 1.1_1 nectar Document Bugzilla XSS issue. 1.1_1 nectar Oops, forgot to set <discovery> date. 1.1_1 nectar Document window injection vulnerabilities affecting several web browsers. 1.1_1 nectar Cancel duplicate phpbb entry e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae. It
was already documented as e3cf89f0-53da-11d9-92b7-ceadd4ac2edd.
Useful references and descriptions were merged.
Noticed by: simon 1.1_1 simon Document a vulnerability in YAMT. 1.1_1 simon Add squid security advisories for two recent squid entries.
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de> 1.1_1 edwin squid bug #1200:
squid -- HTTP response splitting cache pollution attack
PR: ports/76550
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de> 1.1_1 simon Fix typo in last commit. 1.1_1 simon Document XSS in Horde. 1.1_1 nectar Oops, I accidently changed an <entry> date when I should have
added a <modified> date. 1.1_1 nectar Document vulnerabilities in older versions of Midnight Commander. 1.1_1 nectar Document a race condition in Perl's File::Path module. 1.1_1 nectar Document phpBB vulnerabilities. 1.1_1 nectar Document vulnerabilities in the Opera web browser's Java implementation. 1.1_1 nectar Document that older versions of sudo lack CDPATH environmental variable
handling. 1.1_1 nectar Document vulnerabilities in fcron. 1.1_1 nectar Document vulnerabilities in RealPlayer. 1.1_1 nectar Add CVE name and iDEFENSE advisory references to xzgv issue. 1.1_1 nectar Grr, get the imlib version number right!
