security/vuxml 1.1_6

- Fix discovery date on nagios vulnerability  	(CVE-2012-6096)

www/squid3x: upgrade to 3.1.23 and 3.2.6

Squid 3.1.23 is effectively Squid 3.1.22_2 with the final fix for
CVE-2012-5643 applied.

Squid 3.2.6 also received that abovementioned fix, but in comparison
with 3.2.5 from ports it has another change that fixes handling the
"tcp_outgoing_tos" directive for BSD-like systems, including FreeBSD,
  http://bugs.squid-cache.org/show_bug.cgi?id=3731

VuXML entry for SQUID:2012-1 (aka CVE-2012-5643) was also updated to
reflect the proper version specifications from the updated advisory,
  http://www.squid-cache.org/Advisories/SQUID-2012_1.txt

Approved by:	Thomas-Martin Seck <tmseck@web.de>
Security:	http://portaudit.freebsd.org/c37de843-488e-11e2-a5c9-0019996bc1f7.html
QA page:	http://codelabs.ru/fbsd/ports/qa/www/squid31/3.1.23
QA page:	http://codelabs.ru/fbsd/ports/qa/www/squid32/3.2.6

- Document vulnerability in net-mgmt/nagios (CVE-2012-6096)

Document vulnerabilities in www/chromium < 24.0.1312.52

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- update firefox, thunderbird, linux-firefox and linux-thunderbird to 17.0.2 - update firefox-esr, thunderbird-esr and libxul to 10.0.12 - update linux-seamonkey to 2.15

Security:	http://www.vuxml.org/freebsd/a4ed6632-5aa9-11e2-8fcb-c8600054b392.html

Fix <topic> style: common dash style, remove softvare versions

- Update rubygem-rails to 3.2.11 - Update ports require by rubygem-rails - Add vuxml entry for rails security issues

Security:	ca5d3272-59e3-11e2-853b-00262d5ed8ee
Security:	b4051b52-58fa-11e2-853b-00262d5ed8ee

- Properly copy namespace attributes/resolve make validate issues

Reviewed by:	simon@, eadler@
Approved by:	zi (with ports-secteam hat)

Document Jenkins 2013-01-04 Security Advisory

VuXML: extend entry for MoinMoin vulnerabilities fixed in 1.9.6

Use more verbose descriptions from CVE entries and trim citation
from CHANGES to the relevant parts.

Document Django 2012-12-10 vulnerabilty

VuXML: fix r309982

Use proper tags for CVE identifiers.  I should run 'make validate'
_every_ time before committing.
Pointyhat to:	rea

VuXML for MoinMoin issues: add CVE references

Freetype 2.4.8 vulnerabilities were already documented.

While here, correct pkgname

Noticed by:	kwm

Mark moinmoin vulnerable

Security:	http://www.debian.org/security/2012/dsa-2593

document freetype vulnerabilities

Security:	CVE-2012-(1126-1144)

Bump copyright to 2013.

Add correct version numbers to the recent asterisk entry

Pointy hat to:	flo

- update net/asterisk to 1.8.19.1 - update net/asterisk10 to 10.11.1 - update net/asterisk11 to 10.1.2 - add vuln.xml entry

Security:	f7c87a8a-55d5-11e2-a255-c8600054b392

Note charybdis and ircd-ratbox vulnerabilities

PR:		ports/174878
Security:	http://www.ratbox.org/ASA-2012-12-31.txt

Separate entries for Puppet 2.6 and 2.7.

Add OTRS vulnerabilities

VuXML entries for Tomcat: split into three distinct ones

They affect different Tomcat versions from 7.x branch, so don't let
users of VuXML be fooled on the affected software for each vulnerability.

Feature safe:	yes

VuXML: add entry for DoS in Squid's cachemgr.cgi

Feature safe:	yes
Submitted by:	Thomas-Martin Seck <tmseck@web.de>

Remove invalid entry

- add entry for opera 12.11

Fix typo.

Noticed by:	mandree

- add url block in references for 1657a3e6-4585-11e2-a396-10bf48230856

Update linux-f10-flashpulgin11 to 11.2r202.258 to address multiple vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

Submitted by:	Tsurutani Naoki <turutani scphys kyoto-u ac jp>

Document vulnerabilities in www/chromium < 23.0.1271.97

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- Fix recent vulnerability entry for www/tomcat[67]

Reported by:	Victor Balada Diaz <victor@bsdes.net>
Feature safe:	yes

- Document recent vulnerabilities in www/tomcat6 and www/tomcat7

Requested by:	Victor Balada Diaz <victor@bsdes.net>
Feature safe:	yes

Update to the latest patch level from ISC:

BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
  vulnerable to a software defect that allows a crafted query to
  crash the server with a REQUIRE assertion failure.  Remote
  exploitation of this defect can be achieved without extensive
  effort, resulting in a denial-of-service (DoS) vector against
  affected servers.

Security:	2892a8e2-3d68-11e2-8e01-0800273fe665
		CVE-2012-5688
Feature safe:	yes

Add URL for recent bogofilter heap vuln', CVE-2012-5468, aka. vuln vid= f524d8e0-3d83-11e2-807a-080027ef73ec

Feature safe: yes

Update bogofilter to new upstream release 1.2.3. Security update to fix a heap corruption bug with invalid base64 input, reported and fixed by Julius Plenz, FU Berlin, Germany.

Feature safe:   yes
Security:       CVE-2012-5468
Security:       f524d8e0-3d83-11e2-807a-080027ef73ec

Document vulnerabilities in www/chromium < 23.0.1271.95

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
Feature safe:	yes

www/yahoo-ui  - fix CVE-2012-5881

security/vuxml
 - adjust version (we have only 2.8.2 in the tree)

Feature safe: yes

Approved by:	glarkin (maintainer) explicit

Fix date in yahoo-ui entry.

Noticed by:	dvl@
Feature safe:	yes

- document www/yahoo-ui security issue and mark port forbidden [1]   pet portlint (maintainer is already notified)

- adjust CVE entries for bugzilla (CVE-2012-5475 was rejected) [2]

Feature safe: yes

Security:	CVE-2012-5881 [1][2]
		CVE-2012-5882 [1][2]
		CVE-2012-5883 [2]

Approved by:	glarkin (implicit) [1]

Describe new vulnerabilities in www/chromium < 23.0.1271.91

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
Feature safe:	yes

- Update backports patch to 20121114 - Bump PORTREVISION

Changes:
- CVE-2006-7243
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow
context-dependent attackers to bypass intended access restrictions by placing a
safe file extension after this character, as demonstrated by .php\0.jpg at the
end of the argument to the file_exists function

Secuity 3761df02-0f9c-11e0-becc-0022156e8794 fixed by check in fopen functions
for strlen(filename) != filename_len

- CVE-2012-4388
The sapi_header_op function in main/SAPI.c does not properly determine a pointer
during checks for %0D sequences (aka carriage return characters), which allows
remote attackers to bypass an HTTP response-splitting protection mechanism via a
crafted URL, this vulnerability exists because of an incorrect fix for
CVE-2011-1398.

- Timezone database updated to version 2012.9 (2012i)

PR:		ports/173685
Submitted by:	Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Approved by:	maintainer
Feature safe:	yes

Add entries for the following advisories:

FreeBSD-SA-12:08.linux
FreeBSD-SA-12:07.hostapd
FreeBSD-SA-12:06.bind

Feature safe:	yes

- opera -- execution of arbitrary code Feature safe: yes

Document new vulnerability in www/lighttpd 1.4.31

Feature safe:	yes

- Update firefox and thunderbird to 17.0 - Update seamonkey to 2.14 - Update ESR ports and libxul to 10.0.11 - support more h264 codecs when using GSTREAMER with YouTube - Unbreak firefox-esr, thunderbird-esr and libxul on head >= 1000024 [1] - Buildsystem is not python 3 aware, use python up to 2.7 [2]

PR:		ports/173679 [1]
Submitted by:	swills [1], demon [2]
In collaboration with:	Jan Beich <jbeich@tormail.org>
Security:	d23119df-335d-11e2-b64c-c8600054b392
Approved by:	portmgr (beat)
Feature safe:	yes

- Fix copy and paste error in latest weechat entry   (81826d12-317a-11e2-9186-406186f3d89d)

Feature safe:	yes

- Document new vulnerability in irc/weechat and irc/weechat-devel

Feature safe:	yes

- bugzilla security updates to version(s)   3.6.11, 4.0.8, 4.2.4

Summary
=======

The following security issues have been discovered in Bugzilla:

* Confidential product and component names can be disclosed to
  unauthorized users if they are used to control the visibility of
  a custom field.

* When calling the 'User.get' WebService method with a 'groups'
  argument, it is possible to check if the given group names exist
  or not.

* Due to incorrectly filtered field values in tabular reports, it is
  possible to inject code which can lead to XSS.

* When trying to mark an attachment in a bug you cannot see as
  obsolete, the description of the attachment is disclosed in the
  error message.

* A vulnerability in swfstore.swf from YUI2 can lead to XSS.

Feature safe: yes

Security:	CVE-2012-4199
		https://bugzilla.mozilla.org/show_bug.cgi?id=731178

		CVE-2012-4198
		https://bugzilla.mozilla.org/show_bug.cgi?id=781850

		CVE-2012-4189
		https://bugzilla.mozilla.org/show_bug.cgi?id=790296

		CVE-2012-4197
		https://bugzilla.mozilla.org/show_bug.cgi?id=802204

		CVE-2012-5475
		https://bugzilla.mozilla.org/show_bug.cgi?id=808845
		http://yuilibrary.com/support/20121030-vulnerability/

- Update recent weechat entry (e02c572f-2af0-11e2-bb44-003067b2972c)

- Document assigned CVE Identifier
- Document workaround for vulnerable versions

Feature safe:	yes

Document vulnerabilities in two typo3 components.

Obtained from:	http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/
Feature safe:	yes

Fix typo.

Feature safe:	yes