21:03 kwm 

Document libtool vulnerability.

Reviewed by:    miwi@

14:51 miwi 

- Cleanup (whitespaces/tabs)

21:34 naddy 

document: libvorbis -- multiple vulnerabilities

18:07 skv 

Document "bugzilla" - information leak.

15:47 sem 

- Report a XSS vulnerability in net-mgmt/cacti port

12:41 miwi 

- fix german wordpress name

12:20 miwi 

- Document wordpress -- multiple vulnerabilities

17:14 delphij 

Mark php5-gd 5.2.11_2 as safe.

23:33 wxs 

- Note that CVE-2009-3546 has been fixed in graphics/gd.

Noticed by:     N.J. Mann <njm@njm.me.uk>

09:43 miwi 

- Fix previous commit

08:22 jadawin 

- Document HTML-Parser denial of service

21:40 delphij 

Document remote buffer overflow vulnerability in gd.

21:25 delphij 

Document typo3 multiple vulnerabilities.

Notified by:    Wennrich, Markus <Markus Wennrich f-i-ts de>

21:18 thierry 

Add an entry for VideoLAN-SA-0901, about multimedia/vlc.

20:12 miwi 

- Document KDE -- multiple vulnerabilities

Reported by:    Eygene Ryabinkin <rea-fbsd@codelabs.ru>

12:52 miwi 

- Fix previous entry

12:41 itetcu 

Add two opera vulnerabilities

PR:             140101
Submitted by:   Arjan van Leeuwen

21:59 miwi 

- Fix latest entrys

14:21 flz 

Document vulnerability in net-p2p/ctorrent < 3.3.2_2 (CVE-2009-1759).

PR:             ports/139635
Submitted by:   Eygene Ryabinkin
Security:       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1759

23:04 stas 

- Fix linux-opera vuxml entry (it uses different version numbering scheme) [1]
- Add entry for opera-devel as well.

PR:             ports/140038 [1]
Submitted by:   Sato Kuro <poyopoyo@puripuri.plala.or.jp> [1]

15:22 beat 

- Document mozilla -- multiple vulnerabilities

Approved by:    miwi (secteam)

14:53 gabor 

- Fix discovery date of a recent entry

14:23 stas 

- Document elinks < 0.11.4 buffer overflow vulnerability.

23:04 delphij 

Add CVE reference provided by author via maintainer for the squidguard
issue.

23:01 delphij 

Apply vendor fixes 20091015 and 20091019 to fix multiple vulnerabilities
of squidGuard 1.4.

Requested by:   maintainer
Security:       692ab645-bf5d-11de-849b-00151797c2d4

11:03 araujo 

- Add an entry for Xpdf -- Multiple Vulnerabilities.

17:42 lwhsu 

- Document django -- denial-of-service attack

22:12 miwi 

- Document phpmyadmin -- XSS and SQL injection vulnerabilities

17:22 wxs 

- Document php5 multiple security vulnerabilities.

PR:             ports/139196
Submitted by:   Mark Foster <mark@foster.cc>

10:18 miwi 

- Document virtualbox -- privilege escalation

09:37 remko 

Add FreeBSD-SA-09:14.devfs to the VuXML list.

Hat:    secteam
Facilitated by: Snow B.V.

09:33 remko 

Add FreeBSD-SA-09:13.pipe to the VuXML list.

Hat:    secteam
Facilitated by: Snow B.V.

12:01 stas 

- linux-f10-pango is affected by 4b172278-3f46-11de-becb-001cc0377035 too.

Reported by:    "Edward Sanford Sutton, III" <mirror176@cox.net>

15:32 miwi 

- Document mybb -- multiple vulnerabilities

PR:             based on 139197

23:03 miwi 

- Document drupal -- Multiple Vulnerabilities

Submitted by:   Nick Hillard (based on)
Feature safe:   yes

22:23 miwi 

- Rework latest horde-base entry (ee23aa09-a175-11de-96c0-0011098ad87f)

Feature safe:   yes

14:54 cy 

Fix a formatting issue.

Pointy hat to:          myself
Noticed by:             miwi
Feature safe:           Yes

05:58 delphij 

Fix build.

Feature safe:   yes

05:37 cy 

Document a security problem in fwbuilder/libfwbuilder 3.0.4 - 3.0.6.
Generated iptables scripts when used to generate static routing
configurations have a security issue.

Feature safe:   Yes

13:28 skv 

Document "bugzilla" - two SQL injections, sensitive data exposure.

Feature safe:   yes

21:57 thierry 

Adding an entry for three vulnerabilities fixed in the latest Horde
framework (i.e. the port www/horde-base).

20:06 stas 

- Fix formatting.
- Add link to the debian security advisory.
- Fix the description to be the actual citation from the official sources
  instead of some wild interpretation.  We do not know for sure if remote
  code execution is possible at all and from looking to the source code it
  seems unlikely as the buffer undeflown is allocated on the heap.  Moreover,
  it is not clear if this is exploitable in the default install.

Discussed with: az

19:48 wxs 

Document nginx DoS condition.

Submitted by:   az@ (via IRC)

16:56 ume 

Add cvename and bid for cyrus-imapd potential buffer overflow
in Sieve.

16:06 brix 

Add ikiwiki vulnerability.

11:24 miwi 

- Cleanup previous commit

11:06 brix 

- Add xapian-omega cross-scripting vulnerability

17:28 miwi 

- Document mozilla firefox -- Multiple Vulnerabilities

15:13 ume 

Fix xml broke by my previous commit.

15:08 ume 

Document cyrus-imapd potential buffer overflow vulnerability in Sieve.

23:24 wxs 

- Document silc-toolkit format string vulnerabilities. Unfortunately little
  information is provided publicly.

08:18 miwi 

- Mark seamonkey as safe

08:02 miwi 

- Update latest Opera entry,
        * add missing linux-opera
        * fix topic

07:26 jadawin 

- Fix vuxml build

Pointyhat to:   me

07:12 jadawin 

- Fix vuxml build

Pointyhat to:   itetcu

05:59 itetcu 

Add an atry for opera < 10.00

PR:             138449
Submitted by:   maintainer

12:32 miwi 

- Fix cvenames

11:42 miwi 

- Document dnsmasq -- TFTP server remote code injection vulnerability

PR:             138418 (based on)
Submitted by:   Matthias Andree <matthias.andree@gmx.de>

08:20 kuriyama 

- I cannot confirm these vulns can be affected to 1.3.x and 2.0.x
  lines.  Limit this entry to 2.2.x until confirmed.

06:47 kuriyama 

Add apache-2.2.12 fixes.

11:48 beat 

- Mark thunderbird 2.0.0.23 and higher as safe

Approved by:    secteam (miwi)

19:37 wxs 

- Document pidgin, libpurple, and finch memory corruption.

PR:             ports/137997
Submitted by:   Armin Pirkovitsch <armin@frozen-zone.org>

14:37 wxs 

- Document NUL byte problem in gnutls and gnutls-devel
- Document multiple vulnerabilities in older versions[1]

Note:  These have all been fixed with the exception of the NUL byte problem
in gnutls-devel.

PR:             [1]: ports/134785
Submitted by:   [1]: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Reviewed by:    miwi

13:26 mnag 

- memcached -- memcached stats maps Information Disclosure Weakness

PR:             134206
Submitted by:   Mark Foster <mark___foster.cc>

09:55 miwi 

- Update latest wordpress entry
   * add wordpress-mu which was also affected
- Mark latest fetchmail entry as safe

14:57 skreuzer 

Document remote admin password reset vulnerability in wordpress <= 3.8.3

Reviewed by:    simon

14:54 amdmi3 

- Document fetchmail -- improper SSL certificate subject verification

13:35 skreuzer 

Fix typo in affected version number for vid
739b94a4-838b-11de-938e-003048590f9e

Submitted by:   Roberto Nunnari <robi@nunnisoft.ch> (Private eMail)
Reviewed by:    simon

21:24 skreuzer 

- Fix improper formatting reported by miwi

- Add additioinal reference url for vid 739b94a4-838b-11de-938e-003048590f9e
reported by miwi

Reviewed by:    miwi

20:06 skreuzer 

Document com_mailto Timeout Issue in www/joomla15

16:30 simon 

Cleanup whitespace and XML format using 'make tidy' and a bit manual
editing.

13:18 simon 

Various affects fixes to the last 3 Mozilla/Firefox entries to make then
match correctly against package names.  In particular the port name
instead of package name was used in a couple of places.  For Seamonkey
and Thunderbird where no known fixes exist don't include a fixed
version.

10:48 miwi 

- Update previous subversion entry,
  add missing p5-subversion and py-subversion

09:31 miwi 

- Fix latest firefox entry.

Reported by:    b.f <bf1793@gmail.com>

21:41 simon 

Document subversion -- heap overflow vulnerability.

23:23 simon 

Add a few CVE names to the 'squid -- several remote denial of service
vulnerabilities' entry.

23:19 simon 

Document bugzilla -- product name information leak.

23:15 miwi 

- Mark squid 3.1.0.12 as safe

22:57 miwi 

- Document mozilla -- multiple vulnerabilities

18:20 wxs 

- Add bind9-sdb-ldap and bind9-sdb-postgresql to recent BIND DoS.

Reviewed by:    miwi

18:06 wxs 

- Document silc-client and silc-irssi-plugin format string vulnerability.

Reviewed by:    miwi

14:11 thierry 

Mark mail/squirrelmail-multilogin-plugin as FORBIDDEN and add the
corresponding entry in VuXML.

Security:       VuXML: 0d0237d0-7f68-11de-984d-0011098ad87f

14:25 wxs 

- White space fixes and correct the entry date in
  vid 83725c91-7c7e-11de-9672-00e0815b8da8

14:17 wxs 

s/package/system/ for vid fbc8413f-2f7a-11de-9a3f-001b77d09812.

Reviewed by:    remko
Approved by:    secteam (remko)

14:13 wxs 

- Document BIND DoS in base and ports.

Reviewed by:    remko
Approved by:    secteam (remko)

16:17 miwi 

- Close tag

16:00 miwi 

- Document Mono XML Signature HMAC Truncation Spoofing

19:39 delphij 

Document squid remote denial of service vulnerabilities.

Submitted by:   Thomas-Martin Seck <tmseck@web.de>
PR:             ports/137184

00:11 jpaetzel 

Fix security advsory with patches from Ubuntu project.
http://vuxml.FreeBSD.org/c444c8b7-7169-11de-9ab7-000c29a67389.html

PR:     ports/136891
Submitted by:   wxs@
Reviewed by:    simon@
Approved by:    itetcu@ (mentor)

10:18 miwi 

- Fix a typo

07:58 miwi 

- Document firefox35 -- corrupt JIT state after deep return from native function

18:34 wxs 

- Document isc-dhcp*-client stack overflow.

03:17 wxs 

- Tweak nagios version information a bit for the command injection
  vulnerability. Patches for net-mgmt/nagios and net-mgmt/nagios2 coming
  shortly.

19:01 miwi 

- Document drupal -- multiple vulnerabilities

Submitted by:   Nick Hilliard (based on)

13:51 beat 

- Mark linux-firefox 3.0.11 and higher as safe

Approved by:    secteam (miwi)

01:35 wxs 

- Document remote command execution in net-mgmt/nfsen

PR:             ports/136070
Submitted by:   Bjoern Engels <engels@openit.de>

20:38 wxs 

- Add syslog-ng package to the list of vulnerable versions for the chroot
  vulnerability.

13:01 wxs 

- Add newly created CVE for nagios command injection vulnerability.
- Add the other two nagios packages to the list.
- Add modified entry accordingly.

19:10 delphij 

Document phpMyAdmin XSS vulnerability

14:13 wxs 

- Document nagios command injection vulnerability.