Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1_1 simon - Document remote DoS and loss of anonymity in Tor.
- Update a Samba entry with new information about vulnerable versions.
Approved by: nectar 1.1_1 nectar lesstif has been upgraded to a version that is not affected by the
libXpm vulnerability. 1.1_1 simon Recommit my changes from 1.298 which was accidently removed in 1.299.
Pointy hat to: josef (who also noticed the problem) 1.1_1 josef Document two seperate security vulnerabilities in
icecast1 and icecast2.
Approved by: nectar 1.1_1 simon Change the Xerces-C++ entry to match the xerces-c2 port.
Noticed by: nectar 1.1_1 josef Document vulnerability in freeradius.
Approved by: nectar 1.1_1 simon - Document DoS in Xerces-C++.
- Fix typo in a mozilla entry.
Approved by: nectar 1.1_1 nectar It turns out that lesstif has libXpm sneakily embedded. There are at
least three files with this comment at the top:
* This file contains most of the source files of Xpm, concatenated and with
* the public names changed (to have an _LtXpm prefix). 1.1_1 simon Document XSS in wordpress.
Approved by: nectar 1.1_1 nectar Document integer overflows in libtiff. 1.1_1 simon - Document a CUPS local information disclosure.
- Note the impact of the sharutils buffer overflows.
Approved by: nectar 1.1_1 josef Document a vulnerability in Zinf (freeamp).
Approved by: nectar 1.1_1 nectar Document libtiff RLE decoder issues. 1.1_1 simon The sharutils buffer overflows has been fixed in sharutils 4.2.1_2. 1.1_1 simon Document a vulnerability in sharutils.
Approved by: nectar 1.1_1 josef Document 2 DoS attacks possible against
older versions of mail-notifier.
Based on the security advisories
mentioned in the reference links.
Approved by: nectar 1.1_1 nectar ale@ reports that the only ports affected are php[45], php[45]-cgi,
and mod_php[45]. 1.1_1 nectar Note squid SNMP DoS. Based on an entry that was
Submitted by: Thomas-Martin Seck <tmseck@netcologne.de> 1.1_1 nectar The documented xv vulnerabilities were fixed by dinoex@
Approved by: portmgr 1.1_1 nectar Note that the image decoding vulnerabilities in gdk-pixbuf have been
fixed.
Reported by: marcus
Approved by: portmgr 1.1_1 nectar Document older cyrus-sasl bug affecting DIGEST-MD5.
Submitted by: simon
Approved by: portmgr 1.1_1 nectar Update the description of and list of packages affected by the PHP file
upload processing bug.
Submitted by: Jon Passki <cykyc@yahoo.com>
Approved by: portmgr 1.1_1 nectar Document unsafe use of environmental variable SASL_PATH in cyrus-sasl.
Approved by: portmgr 1.1_1 trhodes Add some more apache ports.
Fix two errors found by nectar.
Approved by: portmgr 1.1_1 trhodes Add imp3 issue, add apache13-ssl issue, correct a tag.
Approved by: portmgr 1.1_1 nectar Note that older packages of bmon were dangerously installed set-user-ID.
Approved by: portmgr 1.1_1 nectar Document GnuTLS denial-of-service (already mentioned in portaudit's
database).
Approved by: portmgr 1.1_1 nectar Record another PHP vulnerability.
Approved by: portmgr 1.1_1 nectar Record another PHP security issue.
Approved by: portmgr 1.1_1 nectar Note that xv should not be used.
Approved by: portmgr 1.1_1 nectar Note a symlink vulnerability in getmail.
Submitted by: Shane Kinney <mod6@freebsdhackers.net>
Approved by: portmgr 1.1_1 nectar Fill in empty topic from previous commit.
Noticed by: Shane Kinney <mod6@freebsdhackers.net>
Approved by: portmgr 1.1_1 nectar Record FreeBSD-SA-04:15.syscons.
Approved by: portmgr 1.1_1 nectar Add missing PORTEPOCH for samba.
Noticed by: dinoex
Approved by: portmgr 1.1_1 nectar Note racoon certificate verification bug.
Submitted by: Jon Passki <cykyc@yahoo.com>
Approved by: portmgr 1.1_1 nectar Note distcc IP address ACL bug.
Submitted by: Jon Passi <cykyc@yahoo.com>
Approved by: portmgr 1.1_1 nectar Remove a duplicate entry.
Submitted by: Jon Passki <cykyc@yahoo.com>
Approved by: portmgr 1.1_1 nectar Correct the version number for latest Mozilla entry.
(cut-n-paste damage)
Approved by: portmgr 1.1_1 nectar Document the last few of the relatively recent Mozilla vulnerabilities.
Approved by: portmgr 1.1_1 nectar Correct mangled CVE name: s/8983/0903/
Approved by: portmgr 1.1_1 nectar Add another two older vulnerabilities affecting Mozilla & co.
Continue to try hard to cover past package names:
- I missed el-linux-mozillafirebird previously.
- Move all the `obsolete' package names into one place
for clarity.
Approved by: portmgr 1.1_1 nectar Don't forget `ja-samba' also.
Approved by: portmgr 1.1_1 nectar Note samba file disclosure vulnerability.
Approved by: portmgr 1.1_1 trhodes Fix apache version number entry, bump modified date for apache as well.
Approved by: portmgr 1.1_1 nectar Make an initial attempt at covering all Mozilla/Firefox/Thunderbird
package names that we've had. Similar changes need to be made to many
other entries, but let's use this one as a test subject first.
Approved by: portmgr 1.1_1 nectar Correct spelling of phpnuke package name.
Reported by: Dan Langille
Approved by: portmgr 1.1_1 nectar Note BMP decoder flaws in Mozilla/Firefox/Thunderbird.
Approved by: portmgr 1.1_1 nectar Note stack buffer overflow in Mozilla mail.
Approved by: portmgr 1.1_1 nectar Document Mozilla/Firefox/Thunderbird heap buffer overflows.
Approved by: portmgr 1.1_1 nectar Correct the package name for phpMyAdmin.
Reported by: Matthew Seaman <m.seaman@infracaninophile.co.uk>
Approved by: portmgr 1.1_1 nectar Add CERT Vulnerability Note references to xpm entry.
Approved by: portmgr 1.1_1 nectar Note two older vulnerabilities in PHP.
Submitted by: Jon Passki <cykyc@yahoo.com>
Approved by: portmgr 1.1_1 nectar Note subversion information disclosure vulnerability.
Submitted by: lev
Approved by: portmgr 1.1_1 nectar Add missing PORTEPOCH in a mozilla entry.
Correct package name in an apache entry.
Reported by: Dan Langille <dan@langille.org>
Approved by: portmgr 1.1_1 nectar Forgot to add <modified> element for last commit.
Approved by: portmgr 1.1_1 nectar Add missing PORTEPOCH on one of the mozilla entries.
Noticed by: Dan Langille <dan@langille.org>
Approved by: portmgr 1.1_1 nectar Document vulnerabilities in lha.
Reviewed by: dinoex
Approved by: portmgr 1.1_1 nectar Lately it seems I like to use dashes in topics... but I should at
least be consistent with how many. s/---/--/
Approved by: portmgr 1.1_1 nectar Document mysql buffer overflow.
Reported by: ale
Approved by: portmgr 1.1_1 nectar Document Mozilla security icon spoofing vulnerability.
Approved by: portmgr 1.1_1 nectar Document Mozilla vulnerability involving NULL bytes in FTP URLs.
Also, correct s/firebird/firefox/ in a previously documented issue.
Approved by: portmgr 1.1_1 nectar Document Mozilla automatic file upload vulnerability.
Approved by: portmgr 1.1_1 nectar Document mozilla certificate import denial-of-service vulnerability.
Approved by: portmgr 1.1_1 nectar Note a file name disclosure issue in rssh.
Reported by: leeym
Approved by: portmgr 1.1_1 nectar Add entry describe GNU Radius denial-of-service vulnerability.
Approved by: portmgr 1.1_1 nectar Add sudoedit vulnerability.
Approved by: portmgr 1.1_1 nectar In latest CVS entry, remove the reference to the exploit. It does
not apply to any of these vulnerabilities, but to the previous CVS
vulnerability (CAN-2004-0396).
Approved by: portmgr 1.1_1 nectar Oh yeah, add affected FreeBSD versions for CVS issues.
Approved by: portmgr 1.1_1 nectar Update CVS entry with some details.
Approved by: portmgr 1.1_1 trhodes Add an entry for the mod_proxy buffer overflow existant in apache13.
Approved by: portmgr 1.1_1 nectar Note some fixes for XPM image decoding vulnerabilities.
Submitted by: lesi
Add references to Chris Evans's advisories while I'm at it.
Approved by: portmgr 1.1_1 marcus Update to gdk-pixbuf vulnerability to reflect the fixed version of gtk20.
Approved by: portmgr( implicit) 1.1_1 nectar Note that a patched version of webmin 1.150 is now available, thanks
to olengi@.
Submitted by: olengi
Add a paragraph introducing the Webmin blockquote while I'm here.
Approved by: portmgr 1.1_1 nectar Note gdk-pixbuf image decoding issues.
Approved by: portmgr 1.1_1 nectar clement@ has patched Apache 2.
Approved by: portmgr 1.1_1 nectar Note CUPS printer queue browser denial-of-service.
Approved by: portmgr 1.1_1 nectar Note Apache 2 IPv6 address parsing bug.
Approved by: portmgr 1.1_1 nectar Note new libXpm vulnerabilities.
Approved by: portmgr 1.1_1 nectar I appear to have deleted a line at the last minute. Restore it.
Approved by: portmgr 1.1_1 nectar Add mod_dav denial-of-service issue.
Approved by: portmgr 1.1_1 nectar Oops, forgot to note that the previous issue affects only the Apache 2.x
series.
Approved by: portmgr 1.1_1 nectar Add Apache 2 vulnerability concerning environmental variables in
configuration files.
Approved by: portmgr 1.1_1 nectar Repair three <freebsdpr> elements. The content of these elements
must be e.g. "ports/46613", not just "46613".
Reported by: Matthew Seaman <m.seaman@infracaninophile.co.uk>
Approved by: portmgr 1.1_1 nectar Note that some versions of OpenOffice have been corrected.
Approved by: portmgr 1.1_1 trhodes Fix botched date entry and correct iDefense URL.
Approved by: portmgr 1.1_1 trhodes Really add Samba 3 vulnerability.
Remove incorrect URL in mpg123 entry.
Approved by: portmgr
URL noticed: nectar 1.1_1 trhodes Correct version. Note my last commit here was for mpg123 instead of
samba3.
Noticed by: nectar
Approved by: portmgr 1.1_1 nectar - There is a WITHOUT_X11 version of ImageMagick that needs to be
taken into account.
- Fix transposed characters in `isakmpd'.
Noticed by: Dan Langille <dan@langille.org>
- Add CVE name reference for ImageMagick.
- Add webmin temporary file handling issue.
- Add OpenOffice temporary file handling issue.
- Widen the `KDE frame injection' issue to cover Mozilla, Firebird,
Netscape, and Opera as well
- Add Mozilla/Firebird/Netscape SOAPParameter vulnerability
- Add Mozilla/Thunderbird/Netscape POP client vulnerability
Approved by: portmgr 1.1_1 trhodes Update for recent Samba3 vulnerabilities.
Approved by: portmgr 1.1_1 nectar Adjust the affected version for imlib now that the 2nd instance of BMP
loader has been corrected. 1.1_1 nectar The recent commit to the krb5 port brought the version to 1.3.4_1 but
did not correct one of the existing vulnerabilities. Update the
affected range to compensate. 1.1_1 nectar Note recent MIT Kerberos 5 vulnerabilities. 1.1_1 nectar Document imlib2 BMP decoder bug. 1.1_1 nectar Document BMP decoder bugs in imlib1 and ImageMagick. 1.1_1 nectar Correct bogus date in mysql entry. (It should be YYYY-MM-DD, not
DD-MM-YYYY.)
Reported by: robert@openbsd.org 1.1_1 nectar Add more references (particularly CVE names) for issues affecting
SpamAssassin, tnftpd, ruby, mysql.
Place text taken from another source inside <blockquote cite="...">
for ruby issue. 1.1_1 eik correct/add some references 1.1_1 nectar Document NSS SSLv2 server buffer overflow (already referenced in
portaudit.txt). 1.1_1 nectar Document ripMIME decoding bug (already referenced in portaudit.txt). 1.1_1 marcus Remove <modified/> from the gnomevfs vulnerability since it was the same
as <entry/> and it needed to be last anyway.
Suggested by: nectar
