20:33 feld 

Document FreeBSD-SA-19:05.pf

 

20:32 feld 

Add freebsdsa metadata for FreeBSD-SA-19:04.ntp

 

20:30 feld 

Add freebsdsa metadata to the entry detailing FreeBSD-SA-19:03.wpa

 

15:11 mfechner 

Document www/gitlab-ce vulnerabilities.

 

21:41 amdmi3 

Add more CVE references to sdl2_image entry

 

17:51 kai 

security/vuxml: Document net-im/py-matrix-synapse issues

PR:		239013
Submitted by:	Sascha Biberhofer <ports@skyforge.at> (maintainer)

 

11:04 tobik 

Fix version range of exim entry

It currently does not account for PORTREVISION, i.e., it excludes
4.92_1, 4.92_2, 4.92_3, 4.92_4 which are affected by CVE-2019-13917
too.

 

08:52 vsevolod 

Document exim vulnerability CVE-2019-13917

 

01:54 jbeich 

security/vuxml: mark seamonkey 2.49.5 as vulnerable

 

14:33 brnrd 

security/vuxml: Add vulns from Oracle 2019-07 Critical Patch Update

 

03:55 acm 

- Add drupal8 vulnerability entry
- Modify 9b8a52fc-89c1-11e9-9ba0-4c72b94353b5 entry. Drupal8 was affected too

 

16:13 mandree 

Document PuTTY < 0.72 vulnerabilities.

 

14:54 lwhsu 

Document Jenkins Security Advisory 2019-07-17

Sponsored by:	The FreeBSD Foundation

 

16:12 swills 

document libxslt issue

PR:		238049
Submitted by:	egypcio

 

06:43 madpilot 

Document asterisk vulnerabilities.

 

00:36 wen 

- Document python37 multiple vulnerabilities

 

01:16 jbeich 

security/vuxml: mark firefox < 68 as vulnerable

 

15:55 adamw 

Add vuxml entry for gnupg < 2.2.17

 

23:54 wen 

- Document python 3.6 multiple vulnerabilities

PR:		238952
Submitted by:	wenheping2000@hotmail.com(myself)
Reviewed by:	koobs@

 

17:05 tijl 

Add Linux packages to the latest libssh2 entry.  Also link to all CVEs.

 

06:05 tobik 

Document webkit2-gtk3 vulnerabilities

PR:		239003

 

00:44 wen 

- Document mediawiki multiple vulnerabilities

 

18:52 sunpoet 

Document ettercap vulnerability

 

16:01 mfechner 

Documented several gitlab security vulnerabilities.

 

15:20 amdmi3 

Document SDL2_image vulnerabilities

 

20:11 kai 

security/vuxml: Document irc/irssi issue

PR:		238892
Security:	CVE-2019-13045

 

14:39 wen 

- Document Django vulnerabilities.

PR:		238911, 238910
Submitted by:	koobs@

 

21:47 swills 

Document minor bzip2 issues

PR:		238854

 

20:39 swills 

Document powerdns issue

PR:		239705
Submitted by:	Ralf van der Enden <tremere@cainites.net>

 

21:17 sunpoet 

Document typo3 vulnerability

PR:		238862, 238863

 

21:05 girgen 

Add vuxml entry for postgresql lt 10.9 and lt 11.4

 

12:47 dbaio 

security/vuxml: Document irc/znc issue

Security:	CVE-2019-12816

 

11:30 cmt 

document recent Mozilla advisories

MFSA2019-17, MFSA2019-19, MFSA2019-20

 

15:54 riggs 

Document two vulnerabilities in vlc < 3.0.7.1, potential remote exploit

 

09:11 jbeich 

security/vuxml: mark waterfox < 56.2.11 as vulnerable

https://github.com/MrAlex94/Waterfox/commit/27ce846f9d46

 

05:32 jbeich 

security/vuxml: mark firefox < 67.0.3 as vulnerable

 

05:24 tobik 

Fix version range of recent ImageMagick6 entry

graphics/ImageMagick6 has PORTEPOCH=1 (ImageMagick7 does not) but
it is not included in vuln.xml.  The recent vulnerabilities are
never raised by pkg audit as a result and users are left uninformed
about them.

 

17:07 marcus 

Add an entry for netatalk3.

Document the netatalk3 remote code execution vulnerability fixed in 3.1.12.

PR:		238573

 

10:38 sunpoet 

Document GraphicsMagick vulnerability

 

14:06 rene 

security/vuxml: add entry for www/chromium < 75.0.3770.90

 

06:48 matthew 

Document PMASA-2019-4; CSRF vulnerability in login form

 

18:41 adamw 

Add entry for Vim/NeoVim arbitrary code execution

 

17:17 joneum 

Add entry for www/mybb

Sponsored by:	Netzkommune GmbH

 

21:11 jkim 

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb19-30.html

 

18:52 joneum 

Set correct Port Name for last drupal7 entry

Sponsored by:	Netzkommune GmbG

 

14:24 gjb 

Fix vuxml build.

Sponsored by:	The FreeBSD Foundation

 

08:23 joneum 

Add entry for drupal7

- Set correct modified Date for 183d700e-ec70-487e-a9c4-632324afa934

Sponsored by:	Netzkommune GmbH

 

12:26 vsevolod 

Document Exim RCE CVE-2019-10149

 

02:30 wen 

- Document Django vulnerabilities.

 

15:08 kwm 

Fix modification date, the future isn't quite here yet.

Reported by:	Daniel Ebdrup

 

04:51 kwm 

Fix Imagemagick 6 package name.

 

14:44 mfechner 

Document gitlab vulnerabilities.

 

13:48 koobs 

security/vuxml: Add buildbot -- OAuth Authentication Vulnerability

 

19:17 leres 

security/vuxml: Mark bro < 2.6.2 as vulnerable as per:

   
https://raw.githubusercontent.com/zeek/zeek/bb979702cf9a2fa67b8d1a1c7f88d0b56c6af104/NEWS

The issue is unsafe integer conversions that can cause unintentional
code paths to be executed.

Reviewed by:	ler (mentor)
Approved by:	ler (mentor)
Security:	CVE-2019-12175
Differential Revision:	https://reviews.freebsd.org/D20481

 

10:58 kwm 

Document ImageMagick issues.

PR:		238199
Reported by:	Tommy P <tommyhp2@gmail.com>
Security:	CVE-2019-7175, CVE-2019-7395, CVE-2019-7396, CVE-2019-7397,
		CVE-2019-7398, CVE-2019-9956, CVE-2019-10131, CVE-2019-10649,
		CVE-2019-10650, CVE-2019-10714, CVE-2019-11470, CVE-2019-11472,
		CVE-2019-11597, CVE-2019-11598

 

16:20 ume 

fix package name of cyrus-imapd.

 

14:26 ume 

Document cyrus-imapd buffer overrun in httpd.

Security:	CVE-2019-11356

 

18:02 sunpoet 

Remove superfluous dot

 

14:52 cs 

Clarify CVE-2019-10691

 

13:55 cs 

Serendipity -- XSS

Security:	CVE-2019-11870

 

13:45 cs 

Add missing quote link

 

13:43 cs 

SQLite use after free
Security:	CVE-2019-5018

 

13:21 cs 

Add proper cvename reference to recent OCaml entry

 

13:17 cs 

suricata vulnerability

Security:	CVE-2019-10053

 

22:05 sunpoet 

Document curl vulnerability

 

19:43 cs 

Multiple vulnerabilities in OCaml

PR:		223039
Submitted by:	Phil Pennock <freebsd@phil.spodhuis.org>
Security:	CVE-2015-8869

 

11:00 jbeich 

security/vuxml: mark firefox < 67 as vulnerable

 

01:23 timur 

Add entry about Samba4* vulnerabilities.

Security:	CVE-2018-16860
		CVE-2019-3880

 

03:08 tobik 

Add recent lang/rust security advisory

 

21:19 jkim 

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb19-26.html

 

09:14 brnrd 

security/vuxml: Document PHP-exif vulnerabilities

 

12:41 girgen 

Add security issues from latest postgresql release

 

08:47 joneum 

Add entry for www/gitea

PR:		237734
Sponsored by:	Netzkommune GmbH

 

02:34 koobs 

security/vuxml: Add comms/hylafax -- Malformed fax sender remote code execution
in JPEG support

 

07:16 mfechner 

Documented vulnerability for gitlab.

 

23:35 ler 

security/vuxml: correct dovecot entry.

Reported by:	leres

 

21:02 ler 

security/vuxml: document dovecot vulnerabilities

 

20:33 mfechner 

Document gitlab vulnerabilities.

 

11:29 koobs 

security/vuxml: Add buildbot CRLF injection vulnerability

 

02:05 acm 

- Add drupal7 and drupal8 entries

 

16:55 swills 

add missed PORTEPOCH to libssh2 version

 

15:30 jpaetzel 

Document py-yaml vulnerability

PR:	237501
Submitted by:	sergey@akhmatov.ru
Security:	CVE-2017-18342

 

03:03 cy 

Document wpa_supplicant/hostapd EAP-pwd message reassembly issue with
unexpected fragment.

Security:	no CVE documented,
	https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-\
	with-unexpected-fragment.txt

 

03:03 cy 

Document wpa_supplicant/hostapd EAP-pwd missing commit validation.
CVE-2019-9497 (EAP-pwd server not checking for reflection attack)
CVE-2019-9498 (EAP-pwd server missing commit validation for
scalar/element)
CVE-2019-9499 (EAP-pwd peer missing commit validation for
scalar/element)

Security:	CVE-2019-9497, CVE-2019-9498, CVE-2019-9499,
	https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt

 

03:03 cy 

Document hostapd SAE confirm missing state validation.
CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP)

Security:	CVE-2019-9496,
    https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt

 

03:03 cy 

Document wpa_supplicant/hostapd EAP-pwd side-channel attack.
CVE-2019-9495 (cache attack against EAP-pwd)

Security:	CVE-2019-9495,
	https://w1.fi/security/2019-2/eap-pwd-side-channel-attack.txt

 

03:03 cy 

Document wpa_supplicant/hostapd SAE side-channel attacks.
CVE-2019-9494 (cache attack against SAE)

Security:	CVE-2019-9494, VU#871675,
	https://w1.fi/security/2019-1/sae-side-channel-attacks.txt

 

20:30 danilo 

- Document istio vulnerabilities.

 

17:35 tijl 

Document Ghostscript CVE-2019-3835 and CVE-2019-3838.

PR:		237390
Security:	CVE-2019-3835, CVE-2019-3838

 

14:42 tijl 

Document GNUTLS-SA-2019-03-27.

Security:	https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27

 

15:21 ler 

security/vuxml: Document dovecot json encoder issue

 

10:36 swills 

Document libssh2 issue

 

06:35 joneum 

Add entry for gitea

PR:		237303
Sponsored by:	Netzkommune GmbH

 

13:53 brnrd 

security/vuxml: Document vulnerabilities for MySQL

 - Pre-notification by Oracle, final to be published in 3 days

 

08:43 vd 

Document ftp/wget's metadata in extended attributes vulnerability

Security:	CVE-2018-20483

 

05:47 mfechner 

Document gitlab vulnerability.

 

15:30 lwhsu 

Document Jenkins Security Advisory 2019-04-10

Sponsored by:	The FreeBSD Foundation

 

07:52 jkim 

Document the latest Flash Player vulnerabilities.

https://helpx.adobe.com/security/products/flash-player/apsb19-19.html

 

14:46 sunpoet 

Update py-notebook status

 

06:22 mfechner 

Documented vulnerabilities for clamav.