Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1 nectar Forced commit to note that the content of the previous revision was
Reported by: Ion-Mihai Tetcu <itetcu@apropo.ro> 1.1 nectar Add URI handling issue that affects Opera and KDE, at least. 1.1 ale Note that the mysqlbug has been fixed. 1.1 nectar Update version number for fspd, now that it has been corrected.
Reported by: Radim Kolar <hsn@netmag.cz> 1.1 eik &, not | 1.1 eik ProFTPD vulnerability is fixed in
<http://www.proftpd.org/docs/NEWS-1.2.10rc1>
Submitted by: Koop Mast <kwm@rainbow-runner.nl> 1.1 nectar Add Cyrus IMSPd security release.
Reported by: eik 1.1 nectar Add old Cyrus IMAP server heap buffer overflow.
Reported by: eik 1.1 nobutaka The security issue of multimedia/xine (insecure temporary file creation in
xine-check, xine-bugreport) has been fixed in 0.9.23_3. 1.1 nectar Only one <modified> is allowed per entry. 1.1 des Correct the discovery date for the proftpd issue. 1.1 nectar Oops. s/2005-05-05/2004-05-05/ :-) 1.1 nectar Second-guess Oliver and correct the affected entry for exim
in order to unbreak this file. 1.1 eik exim buffer overflow when verify = header_syntax is used 1.1 nectar Add phpBB session table exhaustion issue.
Submitted by: Xin LI <delphij@frontfree.net> 1.1 nectar Add the issues covered in FreeBSD-SA-04:08.heimdal and
FreeBSD-SA-04:09.kadmind. 1.1 nectar make tidy 1.1 nectar Use PORTVERSION conventions for FreeBSD version numbers, so that
5.2.1-RELEASE-p5 becomes 5.2.1_5 (not 5.2.1p5, as it would have been
previously).
This is necessary because e.g. 5.2p1 > 5.2.1p5 using existing version
comparison tools. 1.1 nectar Correct package name for xchat Socks5 vulnerability (xchat -> xchat2).
Note that the issue is fixed in version 2.0.8_2 (thanks marcus!). 1.1 nectar Correct the fixed version for lha. 1.1 nectar png issue was fixed in png-1.2.5_4 1.1 nectar Add a vulnerability in www/pound.
Submitted by: clement
Add a security-related regression in ftp/proftpd.
Add several security issues in misc/mc.
Add a DoS issue in graphics/png.
Add a security issues in archivers/lha.
Add recent advisories for xine.
Add rsync path traversal issue. 1.1 nectar tla is also affected by libneon issue.
PR: ports/65754
Submitted by: Frank Ruell <stoerte@dreamwarrior.net>
Additional reference for mysql issue.
Submitted by: Daniel Harris <dannyboy@FreeBSD.org> 1.1 nectar Added CVE name for ident2 issue.
Added the ``new'' TCP DoS issue.
Added phpBB issue. (1)
Added XChat Socks5 issue.
Submitted by: (1) Frankye - ML <listsucker@ipv5.net> 1.1 nectar Add mysqlbug temporary file handling vulnerability.
Add ident2 vulnerability.
make tidy (sorry, I meant to do this in a separate commit) 1.1 nectar Additional CVE name for recent CVS vulnerability. 1.1 nectar Add kdepim vulnerability 1.1 nectar Add neon vulnerability
Correct the version range for openh323 1.1 nectar Add CVS vulnerabilities. 1.1 nectar Document another racoon DoS vulnerability.
Note that racoon was also affected by the tcpdump ISAKMP vulnerability. 1.1 nectar make tidy 1.1 nectar Add CVE name for racoon DoS vulnerability. 1.1 nectar Correct modified date in previous commit: format is YYYY-MM-DD and
timezone is UTC. 1.1 fjoe Midnight Commander vulnerability CAN-2003-1023 was fixed in version 4.6.0_9. 1.1 nectar make tidy 1.1 nectar Add new affected version of gaim.
Add year 2004 FreeBSD security advisories. 1.1 nectar Add two racoon issues, one particularly serious. 1.1 nectar Add CVE name for oftpd issue. 1.1 nectar Add Midnight Commander buffer overflow. 1.1 nectar Oops, tidy.xsl should now produce VuXML 1.1 documents on output. 1.1 nectar Add VuXML 1.1 DTD
Update document type declaration to VuXML 1.1 1.0 nectar make tidy 1.0 nectar Add Heimdal cross-realm validation issue. 1.0 nectar Correct usage message for tidy.sh.
Submitted by: Frankye Fattarelli <frankye@ipv5.net> 1.0 nectar Add security issue affecting the Courier mail services. 1.0 nectar Add isakmpd denial-of-service vulnerability. 1.0 nectar Add apache 2 DoS vulnerability that doesn't affect us. I keep coming
across the CVE name (CAN-2004-0174) and re-researching it. 1.0 nectar Add mplayer and tcpdump issues.
Submitted by: Frankye Fattarelli <frankye@ipv5.net>
Reported by: Many 1.0 nectar Correct a mispelled CVE name. 1.0 nectar make tidy 1.0 nectar Add a `make tidy' target that will clean up and sort a VuXML
document. Requires xsltproc. 1.0 nectar Fix dates for SA-04:06.ipv6 and phpbb issues (typos).
Add Bugtraq ID and other references for many entries.
Delete duplicate copula.
Submitted by: Frankye Fattarelli <frankye@ipv5.net> 1.0 nectar Add zebra/quagga denial of service vulnerability.
Submitted by: sumikawa 1.0 nectar Correct advisory name for old bind issue. 1.0 nectar Add old ecartis issue.
Add FreeBSD-SA-04:06.ipv6.
Correct advisory name for old pine issue. 1.0 nectar Add Emil issue. 1.0 nectar Fix a botched version number (the package name was erroneously included).
Add another phpbb vulnerability. [1]
Add oftpd denial-of-services. [2]
Submitted by: Frankye Fattarelli <frankye@ipv5.net> [1]
Reported by: Shane Kerr <shane@time-travellers.org> (oftpd author) [2] 1.0 nectar Add ethereal vulnerabilities.
PR: ports/64777 1.0 nectar Oops, empty <topic> tag. Fill in for squid ACL bypass issue. 1.0 nectar Add squid ACL bypass.
Add xine temporary file handling issue. [1]
Submitted by: Frankye Fattarelli <frankye@ipv5.net> [1] 1.0 eik Add ezbounce (old) and phpBB (new) 1.0 nectar Add xdeview to existing UUDecode issue
Add racoon SA deletion issue. 1.0 nectar Add uulib, uudeview issue. 1.0 nectar Add SIZE.
Submitted by: trevor 1.0 nectar Add OpenSSL denial-of-service vulnerability. 1.0 eik ModSecurity < 1.7.5 1.0 nectar Remove linux-XFree86-libs.
Reminded by: eik 1.0 eik add russian/apache13* 1.0 eik - restore the healthy mix of marc and securityfocus
- unicodeify Ulf again
Requested by: nectar 1.0 eik remove vid 3ca8dd7a-6fb3-11d8-873f-0020ed76ef5a, since the unsafe call
to sprintf is made in preparation for outputting a debug message using
OutputDebugString, which is a function from a different operating system.
While I'm here, transform U+C3A4 into ä (or 쎤), since CVS is
bad in handling binary data. 1.0 eik add a modified tag to vid 09d418db-70fd-11d8-873f-0020ed76ef5a 1.0 eik The apache ports have fixes from CVS 1.0 eik canonicalize list urls (mostly bugtraq) 1.0 eik correct typo
correct entry/modification date 1.0 nectar Delete duplicated mod_python entry, merging additional information into
previous entry. 1.0 eik le -> lt 1.0 eik add mod_python 1.0 nectar The previous commit was in error. Re-add wu-ftpd+ipv6.
The actual port which was corrected due to IPv6 modifications is
apache+ipv6: remove it.
Reported by: ache
Doofus: nectar 1.0 nectar Remove wu-ftpd+ipv6. Due to IPv6 modifications, the bug had been
already corrected.
Submitted by: sumikawa 1.0 nectar Add wu-ftpd `restricted-[ug]id' issue. 1.0 nectar Add recent Apache 1.3 and 2.0 issues. 1.0 nectar Add mpg123. 1.0 nectar Add Adobe Acrobat Reader and GNU Anubis issues. 1.0 nectar chronological sort 1.0 nectar Add linux-XFree86-libs 1.0 nectar Expand tabs.
Add xboing issue. 1.0 nectar Christian Weisgerber <naddy@FreeBSD.org> fixed the metamail fix.
Add mod_python DoS issue. 1.0 nectar Allow validation without the need to specify which processor to use.
Now just invoke `make validate', and a shell script will be run and try
to use xmllint or nsgmls.
Requested by: des 1.0 nectar Add entries for: hsftp, DarwinStreamingServer, libxml2, lbreakout2,
phpnuke, mailman, and fetchmail. 1.0 nectar Note vulnerabilities in phpmyadmin, pwlib, openh323, asterisk. 1.0 nectar Add a <modified> tag to the XFree86 issue, and move it up to
it's chronological spot within the file. 1.0 nectar I forgot the topic for the metamail issue. 1.0 eik XFree86-Server-4.3.0_14 is the fixed version 1.0 nectar Note metamail vulnerabilities. 1.0 nectar Correct version for previous entry (mnoGoSearch >= 3.2). 1.0 nectar Normalize dates: YYYY-MM-DD, not YYYY/MM/DD. 1.0 nectar Note buffer overflow in mnoGoSearch. 1.0 nectar Note insecure temporary file/directory handling in libtool.
Reported by: eik 1.0 nectar Update with information garnered from FORBIDDEN tags used in ports
in the accessibility, arabic, archives, astro, audio, benchmarks,
biology, cad, and chinese categories. 1.0 nectar Note rsync buffer overflow from December.
