security/vuxml 1.1_6

- Revert previous commit

- Document WordPress XSS vulnerability

- Add url reference to 9065b930-3d8b-11e3-bd1a-e840f2096bd0

With Hat: ports-secteam

- Remove report url as it is a default CVE

Reported by:	ak

- Document gnutls3 denial of service CVE

Document xorg-server use after free CVE.

Reviewed by:	zeising@

Document pycrypto PRNG reseed race condition.

- Add CVE references to WordPress 3.6.1 entry

- Note issues with WordPress before 3.6.1

- node-devel packages is vulnerable too, guessing this is going to be fixed in   0.11.7, but if not, I'll update further.

- Update to 0.10.21 to address a security issue

PR:		ports/183092
Submitted by:	Kenji Rikitake <kenji.rikitake@acm.org>
Security:	206f9826-a06d-4927-9a85-771c37010b32

- update to latest release [1] - use PKGNAMESUFFIX instead LATEST_LINK - whitespace cleanup - svn mv */bugzilla to */bugzilla40 - add vuxml entry

4.4.1, 4.2.7, and 4.0.11 Security Advisory
Wednesday Oct 16th, 2013

Summary
=======

Bugzilla is a Web-based bug-tracking system used by a large number of
software projects. The following security issues have been discovered
in Bugzilla:

* A CSRF vulnerability in process_bug.cgi affecting Bugzilla 4.4 only
  can lead to a bug being edited without the user consent.

* A CSRF vulnerability in attachment.cgi can lead to an attachment
  being edited without the user consent.

* Several unfiltered parameters when editing flagtypes can lead to XSS.

* Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered
  field values in tabular reports can lead to XSS.

All affected installations are encouraged to upgrade as soon as
possible.

[1]  even bugzilla40 gets upstream fixes an upgrade to bugzilla42/44 is recommend

Security:	vid e135f0c9-375f-11e3-80b7-20cf30e32f6d
		CVE-2013-1733
		CVE-2013-1734
		CVE-2013-1742
		CVE-2013-1743

Fix build by commenting out the most recent of the two discovery dates.

- Fix year, move entry up

- Document new vulnerabilities in security/dropbear

Document new vulnerabilities in www/chromium < 30.0.1599.101

Obtained from:	http://googlechromereleases.blogspot.nl/

- update mod_fcgid to version 2.3.9 - add stage support - add vuxml entry

PR:		ports/182878
Submitted by:	Fabiano Sidler <freebsd.ports@webstyle.ch> (maintainer)
Security:	CVE-2013-4365

Add recent gnupg1/gnupg vuln.

Document the last xinetd vulnerability

- Update to 1.2.9 - Add vuxml entry - Prevent install target from copying patch backup files

Changes:	https://raw.github.com/polarssl/polarssl/60ad84f43f46b0d3673eaca8b9847d7e01b83c5e/ChangeLog
Security:	ccefac3e-2aed-11e3-af10-000c29789cb5
Security:	CVE-2013-5915

Document new vulnerabilities for www/chromium < 30.0.1599.66

Obtained from:	http://googlechromereleases.blogspot.nl/

Our "package" can have multiple "name" elements.  Since these packages are from the same origin, they can be collapased into one entry.

- Add a low version to the graphite-web vuln

Approved by:	swills@

- Document graphite issue

- ebd877b9-7ef4-4375-b1fd-c67780581898 also applies to our ruby18

Reviewed by:	swills

Document CVE-2013-1443 for www/py-django{,14,-devel}

- Split names for different packages

Notified by:	remko

Add NO_STAGE all over the place in preparation for the staging support (cat: security)

- add modification date to mozilla entry, that I forgot about

- correct thunderbird version in recent mozilla entry

Add the latest two FreeBSD Security Advisories that have impact on -RELEASE versions. (RC's are not documented).

Hat:	secteam

- update firefox, thunderbird and libxul to 24.0 - update seamonkey to 2.21 - update firefox-esr to 17.0.9 - enable GSTREAMER by default for html5 with h264/aac/mp3 - WEBRTC is now always built - add PROFILE and TESTS options

Security:		7dfed67b-20aa-11e3-b8d8-0025905a4771
In collaboration with:	Jan Beich <jbeich@tormail.org>

Update flash to version 11.2.202.310

PR:		ports/182013
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:	http://www.vuxml.org/freebsd/5bd6811f-1c75-11e3-ba72-98fc11cdc4f5

Document CVE-2013-4315 for www/py-django{,14,-devel}

- update devel/subversion to 1.8.3	[1] - update devel/subversion17 to 1.7.13	[1] - add vuxml entry

Version 1.7.13
(29 Aug 2013, from /branches/1.7.x)
http://svn.apache.org/repos/asf/subversion/tags/1.7.13/CHANGES

User-visible changes:
 - General
   * merge: fix bogus mergeinfo with conflicting file merges (issue #4306)
   * diff: fix duplicated path component in '--summarize' output (issue #4408)
   * ra_serf: ignore case when checking certificate common names (r1514763)

 - Server-side bugfixes:
   * svnserve: fix creation of pid files (r1516556)
   * mod_dav_svn: better status codes for commit failures (r1490684)
   * mod_dav_svn: do not map requests to filesystem (r1512432 et al)

Developer-visible changes:
 - General:
   * support linking against gssapi on Solaris 10 (r1515068)
   * don't use uninitialized variable to produce an error code (r1482282)

 - Bindings:
   * swig-pl: fix SVN::Client not honoring config file settings (r150744)
   * swig-pl & swig-py: disable unusable svn_fs_set_warning_func (r1515119)

Version 1.8.3
(29 August 2013, from /branches/1.8.x)
http://svn.apache.org/repos/asf/subversion/tags/1.8.3/CHANGES

User-visible changes:
 - Client- and server-side bugfixes:
   * translation updates for Swedish
   * enforce strict version equality between tools and libraries (r1502267)
   * consistently output revisions as "r%ld" in error messags (r1499044 et al)

 - Client-side bugfixes:
   * status: always use absolute paths in XML output (issue #4398)
   * ra_serf: 'svn log -v' fails with a 1.2.x server (issue #4044)
   * ra_serf: fix crash when committing cp with deep deletion (issue #4400)
   * diff: issue an error for files that can't fit in memory (r1513119 et al)
   * svnmucc: generate proper error for mismatched URLs (r1511353)
   * update: fix a crash when a temp file doesn't exist (r1513156)
   * commit & update: improve sleep for timestamps performance (r1508438)
   * diff: continue on missing or obstructing files (issue #4396)
   * ra_serf: use runtime serf version for User-Agent (r1514315, r1514628)
   * ra_serf: ignore case when checking certificate common names (r1514763)
   * ra_serf: format distinguished names properly (r1514804)
   * ra_serf: do not retry HTTP requests if we started to parse them (r1503318)
   * ra_serf: output ssl cert verification failure reason (r1514785 et al)
   * ra_serf: allow session reuse after SVN_ERR_CEASE_INVOCATION (r1502901)
   * ra_serf: include library version in '--version' output (r1514295 et al)
   * info: fix spurious error on wc root with child in conflict (r1515366)

 - Server-side bugfixes:
   * svnserve: fix creation of pid files (r1516556)
   * svnadmin: fix output encoding in non-UTF8 environments (r1506966)
   * svnsync: fix high memory usage when running over ra_serf (r1515249 et al)
   * mod_dav_svn: do not map requests to filesystem (r1512432 et al)
   * svnauthz: improve help strings (r1511272)
   * fsfs: fixed manifest file growth with revprop changes (r1513874)
   * fsfs: fix packed revprops causing loss of revprops (r1513879 et al)

 - Other tool improvements and bugfixes:
   * svnwcsub/irkerbridge: fix symlink attack via pid file (r175 from upstream)

Developer-visible changes:
 - General:
   * describe APR unimplemented errors as coming from APR (r1503010 et al)
   * mod_dav_svn: update INSTALL to reflect configure defaults (r1515141)
   * davautocheck: use the correct apxs binary by default (r1507889, r1507891)

 - API changes:
   * svn_config_walk_auth_data() config_dir arg: permit NULL (r1507382 et al)

 - Bindings:
   * swig-pl: fix SVN::Client not honoring config file settings (r150744)
   * swig-pl & swig-py: disable unusable svn_fs_set_warning_func (r1515119)

Approved by:	lev@ (explicit per PM)
Security:	f8a913cc-1322-11e3-8ffa-20cf30e32f6d
		CVE-2013-4277 [1]

- Document the last cacti vulnerabilities

PR:		ports/181606 (based on)
Submitted by:	Rodrigo (ros) OSORIO <rodrigo@bebik.net>

Add CVE entries to latest entry for Asterisk. Add "The" in who reports the issue. Bump modified date

Update net/asterisk to 1.8.23.1 Update net/asterisk10 to 10.12.3 Update net/asterisk11 to 11.5.1

Security:	fd2bf3b5-1001-11e3-ba94-0025905a4771

Document new vulnerabilities in www/chromium < 29.0.1547.57

Obtained from:	http://googlechromereleases.blogspot.nl/

Fix multiple security issues in the bundled libav version by replacing it with a newer version.

Reported by:	Jan Beich <jbeich@tormail.org>

- Correct lcms2 VuXML entry: only versions before 2.5 are vulnerable.

PR:		ports/181384
Reported by:	Derek Schrock <dereks@lifeofadishwasher.com>

- Update modified date of VuXML entry which was missed in r317985

Reported by:	remko

Correct latest entry, properly indent the paragraphs and sort the url list alphabetically.

Amend 689c2bf7-0701-11e3-9a25-002590860428 so that it doesn't overlap with 80771b89-f57b-11e2-bf21-b499baab0cbe, but keep both entries rather than augmenting the old one, because I've cited the new one in a commit message.

Update security/libgcrypt to 1.5.3 [1], and document the latest gnupg and libgcrypt vulnerability

PR:		181231
Submitted by:	Hirohisa Yamaguchi (maintainer) [1]
Security:	http://www.vuxml.org/freebsd/689c2bf7-0701-11e3-9a25-002590860428.html

- Update puppet to 3.2.4 which fixes CVE-2013-4761 and CVE-2013-4956

Approved by:	swills@
Security:	2b2f6092-0694-11e3-9e8e-000c29f6ae42

Correct polarssl entry, the lines were way to long, indentation was incorrect, and the topic description does not need too many details since that is explained in the description itself.

Also correct the url's since c comes before u ;-)

Prodded by:	stas

- Fix ordering of references.

Reported by:	remko

- Add lcms2 DoS vulnerability entry.

Hat: secteam

Add CVE Id, which was not in the advisory, but on <https://polarssl.org/security>.