security/vuxml: add qt5-webengine >= 5.15.17.p2_1

security/vuxml: add qt6-webengine < 6.7.2

security/vuxml: document two openvpn < 2.6.11 vulns

Security:	142c538e-b18f-40a1-afac-c479effadd5c
Security:	CVE-2024-5594
Security:	CVE-2024-28882

security/vuxml: add www/*chromium < 126.0.6478.114

Obtained
from:	https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html

security/vuxml: add www/*chromium < 126.0.6478.54

Obtained
from:	https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html

security/vuxml: update nginx 1.26.0 security issues

security/vuxml: Add www/forgejo vulnerability

CVE-2024-24789
NVD assessment not yet provided

PR: 299781

security/vuxml: Document vulnerability in net/traefik

Details:
- Document Unexpected behavior with IPv4-mapped IPv6 addresses in
  net/traefik before 2.11.4, see:
  https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx

security/vuxml: Document go language vulnerabilities

security/vuxml: document gilab vulnerabilities

security/vuxml: Document plasma[56]-plasma-workspace vuln

security/vuxml: Report php composer vulnerabilities.

Obtained
from:	https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c
		https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf

security/vuxml: record kanboard vulnerability

CVE-2024-36399

NVD assessment not yet provided.

security/vuxml: add cyrus-imapd* < 3.8.3

Obtained
from:	https://www.cyrusimap.org/3.8/imap/download/release-notes/3.8/x/3.8.3.html

security/vuxml: add www/*chromium < 125.0.6422.141

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_30.html

security/vuxml: add www/nginx-devel < 1.27.0

Obtained:	https://nginx.org/en/security_advisories.html

security/vuxml: add www/*chromium < 125.0.6422.112

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_23.html

security/vuxml: Document OpenSSL Use-after-free

security/vuxml: Fix typo

security/vuxml: document electron29 use after free in Dawn

Obtained from:	https://github.com/electron/electron/releases/tag/v29.4.1

security/vuxml: document electron28 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v28.3.2

security/vuxml: Document CVE-2024-36048 for qt[56]-networkauth

security/vuxml: documented gitlab vulnerabilities

security/vuxml: add www/*chromium < 125.0.6422.76

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_21.html

security/vuxml: openfire admin console bypass

NVD assessment not yet provided.

PR:		277054

security/vuxml: Document Roundcube XSS

security/vuxml: Fix up 54181a8860c8

Reported by:	dbaio

security/vuxml: Document vulnerabilities in www/qt5-webengine

security/vuxml: Add arti security issues

Security:	CVE-2024-35313 and CVE-2024-35312

security/vuxml: Document OpenSSL 3.x vuln (Low)

security/vuxml: document electron29 setuid vulnerability

Obtained from:	https://github.com/electron/electron/releases/tag/v29.4.0

security/vuxml: Document www/qt6-webengine vulnerabilities

security/vuxml: Document devel/qt6-base vulnerability

dns/dnsdist: update to 1.9.4 (fixes CVE-2024-25581)

PR: 278954
Approved by: submitter is maintainer

security/vuxml: Document Intel CPU vulnerabilities

Security:	CVE-2023-45733
Security:	CVE-2023-45745
Security:	CVE-2023-46103
Sponsored by:	The FreeBSD Foundation

security/vuxml: add www/*chromium < 124.0.6367.207

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html

security/vuxml: Document lang/go vulnerability

security/vuxml: add www/*chromium < 124.0.6367.201

Obtained
from:	https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_9.html

security/vuxml: Document vulnerability in postgresql.

CVE-2024-4317: Restrict visibility of "pg_stats_ext" and "pg_stats_ext_exprs"
entries to the table owner

https://www.postgresql.org/support/security/CVE-2024-4317/

security/vuxml: Document tailscale vulnerability

security/vuxml: document electron29 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v29.3.3

security/vuxml: document gitlab vulnerabilities

security/vuxml: document electron29 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v29.3.2

security/vuxml: add www/*chromium < 124.0.6367.118

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_30.html

security/vuxml: Document ACE vulnerability in math/R

In versions released before 4.4.0, the R statistical program is
vulnerable to CVE-2024-27322, which allows maliciously crafted RDS (R
Data Serialization) files or R packages to run arbitrary code.

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document buffer overflow in korean/hcode

Before ko-hcode-2.1.3_2, the port was affected by CVE-2024-34020, where
a buffer overflow can be exploited to (at least) crash the program.

security/vuxml: CVEs affecting www/glpi < 10.0.15

CVE-2024-31456 and CVE-2024-29889 were fixed in GLPI 10.0.15.

PR:		278641
PR:		278642

security/vuxml: Add powerdns-recursor DOS

* CVE-2024-25583

A crafted response from an upstream server the recursor has been configured to
forward-recurse to can cause a Denial of Service in the Recursor. The default
configuration of the Recursor does not use recursive forwarding and is not
affected.

PR:	278564

security/vuxml: Amend previous commit 3b46eb72e1df

Add a missing paragraph, which was not found by "make validate" before
committing.

Fixes:	3b46eb72e1df security/vuxml: Document www/py-social-auth-app-django
vulnerability

security/vuxml: Document www/py-social-auth-app-django vulnerability

security/vuxml: add www/*chromium < 124.0.6367.78

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html

security/vuxml: correct historical www/glpi entries

Several older entries for www/glpi had incorrect version ranges, causing
pkg audit to complain about false positives.  This corrects the older
entries and adds some missing ones.

PR:	        278549

security/vuxml: Document matrix-synapse vulnerability

security/vuxml: document gitlab vulnerabilities

security/vuxml: add CVEs related to www/glpi

New CVEs for GLPI which were corrected in versions 10.0.11, 10.0.12 and
10.0.13.

PR:		278548
PR:             278090

security/vuxml: Document arbitrary memory address read vulnerability in Ruby

security/vuxml: document sdl2_sound vulns

PR:		278491

security/vuxml: add www/*chromium < 124.0.6367.60

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html

security/vuxml: Document possible DoS attack valnerability in ClamAV

security/vuxml: Document Jenkins Security Advisory 2024-04-17

Sponsored by:	The FreeBSD Foundation

security/vuxml: document electron{27,28,29} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.11,
		https://github.com/electron/electron/releases/tag/v28.3.1,
		https://github.com/electron/electron/releases/tag/v29.3.1

security/vuxml: Add entries for php8*

Approved by:	portmgr (blanket)

security/vuxml: document PuTTY/FileZilla NIST P521 private key recovery

Security:       080936ba-fbb7-11ee-abc8-6960f2492b1d
Security:       CVE-2024-31497

security/vuxml: Document go language vulnerabilities

security/vuxml: add www/*chromium < 123.0.6312.122

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html

security/vuxml: document electron{27,28} out of bounds memory access in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.10,
		https://github.com/electron/electron/releases/tag/v28.3.0

security/vuxml: Document OpenSSL vulnerability

security/vuxml: add www/forgejo HTTP/2 vulnerability

PR:	278119

security/vuxml: add net/jose DoS vulnerability

PR:	278243

security/vuxml: added gitlab 16.10.2, 16.9.4, 16.8.6 updates

security/vuxml: Add wordpress vulnerability

security/vuxml: Document Apache httpd vulnerabilities

security/vuxml: document electron{27,28} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.9,
		https://github.com/electron/electron/releases/tag/v28.2.10

security/vuxml: add www/*chromium < 123.0.6312.105

Obtained
from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html

security/vuxml: close off-by-one gap after 1f3a9629b7a4

xwayland-devel-21.0.99.1.672 *is* vulnerable but wasn't ever in ports/.

security/vuxml: add xwayland-devel to 9661a37b4dff list

security/vuxml: Document recent xorg-server and xwayland vulnerabilities

Sponsored by:	Beckhoff Automation GmbH & Co. KG

security/vuxml: Document Jenkins Security Advisory 2024-03-20

Sponsored by:	The FreeBSD Foundation

security/vuxml: Fix vid d58726ff-ef5e-11ee-8d8e-080027a5b8e9

Temporarily remove cvename tag as it is not a valid CVE name and breaks
vuxml build.

Sponsored by:	The FreeBSD Foundation

security/vuxml: reference FreeBSD SA-24:03.unbound

Add a reference to FreeBSD SA-24:03.unbound (announced 2024-03-28) to
the vuxml entry for Unbound CVE-2023-50387 and CVE-2023-50868.

Unbound was updated to 1.19.1 in FreeBSD 14.0-RELEASE-p6 and in FreeBSD
13.2-RELEASE-p11.  FreeBSD 13.3 was not affected (Unbound 1.19.1 was
included in the release).

security/vuxml: Document mediawiki multiple vulnerabilities

security/vuxml: Register net/quiche vulnerabilities

PR:		277692
Reported by:	Ralf van der Enden <tremere@cainites.net>
Approved by:	junho.choi@gmail.com (maintainer)

security/vuxml: document electron{27,28} object lifecycle issue in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.8,
		https://github.com/electron/electron/releases/tag/v28.2.9

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 123.0.6312.86

Obtained
from:	https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html

security/vuxml: add phpmyfaq < 3.2.6

security/vuxml: Document vulns in Emacs prior to version 29.3

Obtained
from:	https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3
Sponsored by:	The FreeBSD Foundation

security/vuxml: Remove references to non-existent package.

There never was a grafana10 package.  Initially there was www/grafana
providing grafana-8.x.  Then a www/grafana9 port was added providing
grafana-9.x.  The www/grafana port was subsequently obsoleted, and
then revived, now providing grafana-10.x.  I believe the idea is that
going forwards, www/grafana will provide the latest stable release
version and there may be numbered ports for older major versions.

PR:	277631

security/vuxml: Add www/grafana and www/grafana9 data sourceprivilege escalation

PR:	277631

security/vuxml: add www/*chromium < 123.0.6312.58

Obtained
from:	https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html

security/shibboleth-idp: Document CAS SSRF vulnerability

security/vuxml: document mongodb* vuln: CVE-2024-1351

Improper Certificate Validation

Security:	CVE-2024-1351

security/vuxml: Document www/varnish7 vuln: CVE-2023-43622

security/vuxml: remove duplicated entry, see
3bac9fee140f64f562008b81ea2f2391b3fca116

Reported by:	flo@smeets.xyz

security/vuxml: Add amavisd-new vulnerability

security/vuxml: document typo3-{11,12} security issues

PR:		277117
Reported by:	 Helmut Ritter <freebsd-ports@charlieroot.de>

security/vuxml: remove duplicate entry for CVE-2024-1931

PR:		277686

dns/unbound: Update to unbound 1.19.3

This release has a number of bug fixes. The CNAME synthesized for a
DNAME record uses the original TTL, of the DNAME record, and that means
it can be cached for the TTL, instead of 0.

There is a fix that when a message was stored in cache, but one of the
RRsets was not updated due to cache policy, it now restricts the message
TTL if the cache version of the RRset has a shorter TTL. It avoids a
bug where the message is not expired, but its contents is expired.

For dnstap, it logs type DoH and DoT correctly, if that is used for
the message.

The b.root-servers.net address is updated in the default root hints.

security/vuxml: document electron{27,28} out of bounds memory access in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.6,
		https://github.com/electron/electron/releases/tag/v28.2.7

security/vuxml: Document Intel CPU vulnerabilities

Security:	CVE-2023-43490
Security:	CVE-2023-22655
Security:	CVE-2023-28746
Security:	CVE-2023-38575
Security:	CVE-2023-39368
Sponsored by:	The FreeBSD Foundation