security/vuxml 1.1_6

- Update to 2.7.1 - Convert to new options framework - Document US-CERT VU#268267 - Trim Makefile headers

PR:		ports/173226
Submitted by:	Hirohisa Yamaguchi <umq@ueo.co.jp> (maintainer)
Feature safe:	yes

- Improve latest ruby entry slightly

Feature safe:	yes

- Modify recent e02c572f-2af0-11e2-bb44-003067b2972c entry

- Add constraints to vulnerable versions
- Add additional references
- Improve topic
- Correct description

Feature safe:	yes

Apply an upstream patch that fixes a security hole when receiving a special colored message.

The maintainer was contacted but due to the nature of
the issue apply the patch ASAP.

Approved by:	secteam-ports (swills)
Security:	e02c572f-2af0-11e2-bb44-003067b2972c
Feature safe:	yes

- Update lang/ruby19 to 1.9.3p327 - Document security issue in earlier versions

Security:	5e647ca3-2aea-11e2-b745-001fd0af1a4c
Feature safe:	yes

- clarification that ASF reported issue for:  - 152e4c7e-2a2e-11e2-99c7-00a0d181e71d  - 4ca26574-2a2c-11e2-99c7-00a0d181e71d

Feature safe:	yes

- document tomcat vulnerabilities

Feature safe:	yes

Update latest version and document security issues

PR:	ports/173487
Submitted by:	 Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:	4b8b748e-2a24-11e2-bb44-003067b2972c
Feature safe:	yes

Document new vulnerabilities in www/chromium < 23.0.1271.64

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
Feature safe:	yes

Document opera vulnerabilities

Feature safe:	yes

Fix minor typo

Feature safe:	yes

Update latest version and document security issues

PR:	ports/172619
Submitted by:	tijl
Security:	36533a59-2770-11e2-bb44-003067b2972c
Feature safe:	yes

Correct plural of "vulnerability"

Feature safe:	yes

- update apache22 to version 2.22.23 - trim vuxml/Makefile header

with hat apache@

Feature safe: yes

Security:       CVE-2012-2687

Add entry for webmin < 1.600_1 (potential XSS attack).

Feature safe:	yes

- Document ruby vulnerabilities:  * CVE-2012-4464 + CVE-2012-4466    $SAFE escaping vulnerability about Exception#to_s / NameError#to_s  * CVE-2012-4522    Unintentional file creation caused by inserting an illegal NUL character

Reviewed by:	eadler
Feature safe:	yes

Update to 3.8.15

Security:	4b738d54-2427-11e2-9817-c8600054b392
Feature safe:	yes

- update to 7.16 [1]

while here:
- trim Makefile header
- remove indefinite article in COMMENT
- remove IGNORE_WITH_PHP and IGNORE_WITH_PGSQL since
  we have not this versions in the tree anymore
- fix pkg-plist
- add vuxml entry

PR:		173211
Submitted by:	Rick van der Zwet <info at rickvanderzwet dot nl> [1]
Approved by:	Nick Hilliard <nick at foobar dot org> (maintainer)
Security:	2adc3e78-22d1-11e2-b9f0-d0df9acfd7e5
Feature safe:   yes

- Update www/firefox{,-i18n} to 16.0.2 - Update seamonkey to 2.13.2 - Update ESR ports and libxul to 10.0.10 - Update nspr to 4.9.3 - Update nss to 3.14 - with GNOMEVFS2 option build its extension, too [1] - make heap-committed and heap-dirty reporters work in about:memory - properly mark QT4 as experimental (needs love upstream) - *miscellaneous cleanups and fixups*

mail/thunderbird will be updated once the tarballs are available.

PR:		ports/173052 [1]
Security:	6b3b1b97-207c-11e2-a03f-c8600054b392
Feature safe:	yes
In collaboration with:	Jan Beich <jbeich@tormail.org>

mail/exim: upgrade to 4.80.1

This is bugfix-only release, it eliminates remote code execution
in the DKIM code.

Security: http://www.vuxml.org/freebsd/b0f3ab1f-1f3b-11e2-8fe9-0022156e8794.html
QA page: http://codelabs.ru/fbsd/ports/qa/mail/exim/4.80.1
Feature safe: yes

- add CVE reference (still in reserved state) for recent django vulnerabilty

Feature safe:	yes

- update django ports to 1.3.4 and 1.4.2, that fixing couple of security issues.   All users are encouraged to upgrade immediately. - add vuxml entry

changes common for both ports:
- trim Makefile header
- strict python version to 2.x only
- utilize options framework multiple choice feature to let user to choose
  database backends needed. Make SQLITE option default
- shorten description of HTMLDOCS_DESC to make it fit into dialog screen
- SITELIBDIR -> PKGNAMEPREFIX change in dependencies
- convert NOPORTDOCS condition to optionsng
- tab -> space change in pkg-descr

PR:		173017
Submitted by:	rm (myself)
Approved by:	lwhsu (maintainer, by mail)
Security:	5f326d75-1db9-11e2-bc8f-d0df9acfd7e5
Feature safe:   yes

Document multiple wireshark vulnerabilities.

Feature safe:	yes

- clarify end-user impact for 57652765-18aa-11e2-8382-00a0d181e71d Suggested by:	simon@ Feature safe:	yes

- document xlockmore issue, 57652765-18aa-11e2-8382-00a0d181e71d, CVE-2012-4524 Feature safe:	yes

- xinetd vulnerability

Feature safe:	yes

- Updated ZF advisory to include similar XEE vulnerability

Feature safe:	yes

- Document Zend Framework XXE injection vulnerability

Feature safe:	yes

Update the distinfo as upstream has changed.

I verfied this to be same content as the old version modulo the copyright.

Approved by:	secteam (implicit)
Feature safe:	yes

Add the CVE for the gitolite vuln.

Feature safe:	yes

- Actually commit the VuXML entry

PR:		ports/172565
Feature safe:	yes
Pointyhat to:	swills

Document the latest security vulnerabilities for phpMyAdmin. Fix was already committed to the port 6 days ago.

Feature safe:	yes

- Add in additional package names for recent bind vulnerability

Feature safe:	yes

- update to 16.0.1 - update vuln.xml entry

Feature safe:   yes

Document a new vulnerability in www/chromium < 22.0.1229.94

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
Feature safe:	yes

- Update firefox-esr, thunderbird-esr, linux-firefox and linux-thunderbird to 10.0.8 - Update firefox and thunderbird to 16.0 - Update seamonkey to 2.13 - Update all -i18n ports respectively - switch firefox 16.0 and seamonkey 2.13 to ALSA by default for better   latency during pause and seeking with HTML5 video - remove fedisableexcept() hacks, obsolete since FreeBSD 4.0 - support system hunspell

PR:		ports/171534 [1]
PR:		ports/171566 [2]
PR:		ports/172164 [3]
PR:		ports/172201 [4]
Discussed with:	ale, beat, Jan Beich [5]
Approved by:	ale [6]
In collaboration with:	Jan Beich <jbeich@tormail.org>
Security:	6e5a9afd-12d3-11e2-b47d-c8600054b392
Feature safe:	yes
Approved by:	portmgr (beat)

Upgrade to the latest BIND patch level:

A deliberately constructed combination of records could cause named
to hang while populating the additional section of a response.

Security:	  http://www.vuxml.org/freebsd/57a700f9-12c0-11e2-9f86-001d923933b6.html

Document new vulnerabilities in www/chromium < 22.0.1229.92

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- correct the range in last entry (le/lt typo)

- update to 2.8.10 - add vuxml entry

This release fixes SQL injection vulnerability.

PR:		172114
Submitted by:	rm (myself)
Approved by:	ports-secteam (eadler)
Security:	dee44ba9-08ab-11e2-a044-d0df9acfd7e5

Mark nvidia-driver-173.14.35_1 as not vulnerable.

Document vulnerabilities in www/chromium < 22.0.1229.79

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- Document remote code execution in ePerl (all versions) - Deprecate and schedule removal in month - no upstream fix available and   no active development since 1998

Security:	73efb1b7-07ec-11e2-a391-000c29033c32
Security:	CVE-2001-0733
Security:	http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml

- Documented PNG file DoS vulnerability in ImageMagick and GraphicsMagick - Added -nox11 suffixes to various ImageMagick entries

Update vuxml to indicate which versions are vulnerable.

- Update php52 backports patch to 20120911 - Add and update relevant vuxml entries

Changes:
  - CVE-2011-1398 - The sapi_header_op function in main/SAPI.c in PHP
    before 5.3.11 does not properly handle %0D sequences
  - CVE-2012-0789 - Memory leak in the timezone functionality in PHP
    before 5.3.9 allows remote attackers to cause a denial of service
    (memory consumption) by triggering many strtotime function calls,
    which are not properly handled by the php_date_parse_tzfile cache.
  - CVE-2012-3365 - The SQLite functionality in PHP before 5.3.15 allows
    remote attackers to bypass the open_basedir protection mechanism via
     unspecified vectors
  - Timezone database updated to version 2012.5 (2012e) (from 2011.13 (2011m))
  - Minor improvements (CVE-2012-2688, compilation issues with old GCC)

PR:		ports/171583
Submitted by:	Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Approved by:	Alex Keda <admin@lissyara.su> (maintainer)

- CVE-2012-2688 was addressed by php52-5.2.17_10

PR:		ports/170063
PR:		ports/171583
Reported by:	Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Security:	bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89

Upgrade to the latest BIND patch level:

Prevents a crash when queried for a record whose RDATA exceeds
65535 bytes.

Prevents a crash when validating caused by using "Bad cache" data
before it has been initialized.

ISC_QUEUE handling for recursive clients was updated to address
a race condition that could cause a memory leak. This rarely
occurred with UDP clients, but could be a significant problem
for a server handling a steady rate of TCP queries.

A condition has been corrected where improper handling of
zero-length RDATA could cause undesirable behavior, including
termination of the named process.

For more information: https://kb.isc.org/article/AA-00788

Document Jenkins Security Advisory 2012-09-17

include newly 'awarded' CVE