VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.
Correct several instances where the "msgid" attribute content had an
extraneous trailing greater-than character ">", e.g.
<mlist msgid="some-message@id>">some-url</mlist>
These were probably the result of off-by-one errors during
cut-and-paste.
Eliminate character entity references. They are technically fine of
course, but I prefer to use the UTF-8 character directly: it makes
grep'ing and the like easier.
squid -- no sanity check of usernames in squid_ldap_auth
(My first attempt to update this thing. Hope all goes fine!)
PR: ports/76364
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de>
During last year's bumpercrop of vulnerabilities in libtiff, a 2004 CVE
name was assigned to what was actually a much older (circa March 2002)
denial-of-service issue. Document it, since occassionally the CVE name
crops up and then I wonder why we missed it.
Regarding CUPS lppasswd entry: Add the CVE names for each issue inline
with the excerpt from Bernstein's message. Note that the third issue
does not effect users of FreeBSD 4.6 or later.
For mod_access_referer issue:
- Correct spelling.
- `null' in `null pointer' should not be all caps
- Correct the secunia.com URL (it did not identify this particular bug)
Update phpBB command execution entry references:
- Convert some <url>s into the appropriate <certvu> and <uscertta>
elements.
- Add CVE name
- Add a couple of mailing list posts
For mpg123 playlist issue, add CVE name, Bugtraq ID, and X-Force
references. Correct a double slash (`//') in a URL. Re-ident the
<references> children.
Cancel VID 14e8f315-600e-11d9-a9e7-0001020eed82 "tiff -- stripoffsets
integer overflow vulnerability", as it was a subset of VID
3897a2f8-1d57-11d9-bc4a-000c41e2cdad "tiff -- multiple integer
overflows". This is another case of iDEFENSE ``discovering'' a
vulnerability months after it had already been made public and
corrected. I've preserved the iDEFENSE advisory reference by moving it
to the older entry, so that someone won't get misled by it again later.
For recent squid WCCP DoS issue, correct the URL used in <blockquote>
"cite" attribute and <url> content. It referenced the wrong squid
patch description.
- Document a vulnerability in mpg123.
- Add mpg123-nas to an earlier mpg123 entry.
- Make title for exim entry more accurate.
- Fix invalid modification date in latest xpdf entry.
- Integrate vendor patches as published on
<http://www.squid-cache.org/Versions/v2/2.5/bugs/> for the following
issues:
+ Prevent a possible denial of service attack via WCCP messages (squid bug
#1190), classified as security issue by the vendor
+ Fix a buffer overflow in the Gopher to HTML conversion routine (squid bug
#1189), classified as security issue by the vendor
+ Fix a null pointer access and plug memory leaks in the fake_auth NTLM
helper (squid bug #1183) (this helper app is not installed by default by
the port)
+ Stop closing open filedescriptors beyond stdin, stdout and stderr on
startup (squid bug #1177)
- Unbreak the port on NO_NIS systems (thanks to "Alexander <freebsd AT
nagilum.de>" for reporting this)
- Document the two security issues in VuXML.
PR: ports/76173
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de> (maintainer)
Approved by: erwin (mentor)
- Document some older security issues in libxine.
- Cancel VID bef4515b-eaa9-11d8-9440-000347a4fa7d in favor of a more
complete, new entry. (A xine security announcement covered the same
issue and others.)
- Add references to xine security announcements and iDEFENSE
Security Advisories.
Change the behavior of `make newentry' so that it invokes ${EDITOR}
after adding the template, since this is certainly the next required
action. [1]
Fix the error checking: a pipeline was masking some errors, and `set
errexit' was not effective in some other places.
Suggested by: delphij [1]
Add a target, `newentry', that will insert a VuXML <vuln> template
(including generated VID) to the top of the `vuln.xml' file. This will
save a little time when adding new entries.
Inspired by: a patch from simon
- Document that two older tiff vulnerabilities also affects
linux-tiff. [1]
- Add an extra reference to each of the two entries while I'm here
anyway.
- In one of the tiff title elements do s/---/--/ for consistency.
Discussed with: nectar [1]
Approved by: portmgr (implicit, VuXML)
Fix up last commit (tnftp entry):
- Malformed XML
- mismatched tags (<packages></package>)
- invalid entity reference &content-type= (ampersand should have
been replaced with &)
- Replace <range> so that it matches all possible versions for now,
until a fixed version is available in the ports tree
- <entry> date was in the past
Approved by: portmgr (implicit, VuXML)
Pointy hat to: ahze (hint: make validate)
Add a CERT VU reference for the latest Acrobat Reader vulnerability.
Add old package names (acroread4, acroread5) for an older Acrobat Reader
vulnerability.
Approved by: portmgr (implicit, VuXML)
For the "kdelibs3 -- konqueror FTP command injection vulnerability"
entry: replace references to Debian and KDE bugtracking systems with a
KDE advisory which basically contains the same information but is more
readable.
Approved by: portmgr (implicit, VuXML)
- Note that the port update to up-imapproxy 1.2.2 included a patch to
fix the security vulnerability.
- Mark pop3proxy as vulnerable to the up-imapproxy vulnerability,
since pop3proxy is derived from up-imapproxy.
Reported by: mbr
Approved by: portmgr (implicit, VuXML)
- Update the corrected version number for recent phpMyAdmin entry to match
the actual ports version number for phpMyAdmin 2.6.1-rc1.
- Bump modification date for the updated entries.
Updates for the latest PHP entry:
- Correctly match the www/mod_php4 port (it was missing PORTEPOCH).
- Add a few more references.
- Bump modified date.
