security/vuxml 1.1_6

The PostgreSQL Global Development Group today released security updates for all active branches of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and libxslt, similar to those affecting other open source projects. All users are urged to update their installations at the first available opportunity.

This security release fixes a vulnerability in the built-in XML functionality, and a vulnerability
in the XSLT functionality supplied by the optional XML2 extension. Both vulnerabilities allow
reading of arbitrary files by any authenticated database user, and the XSLT vulnerability
allows writing files as well. The fixes cause limited backwards compatibility issues.
These issues correspond to the following two vulnerabilities:

CVE-2012-3488: PostgreSQL insecure use of libxslt
CVE-2012-3489: PostgreSQL insecure use of libxml2
This release also contains several fixes to version 9.1, and a smaller number of fixes to older versions, including:

Updates and corrections to time zone data
Multiple documentation updates and corrections
Add limit on max_wal_senders
Fix dependencies generated during ALTER TABLE ADD CONSTRAINT USING INDEX.
Correct behavior of unicode conversions for PL/Python
Fix WITH attached to a nested set operation (UNION/INTERSECT/EXCEPT).
Fix syslogger so that log_truncate_on_rotation works in the first rotation.
Only allow autovacuum to be auto-canceled by a directly blocked process.
Improve fsync request queue operation
Prevent corner-case core dump in rfree().
Fix Walsender so that it responds correctly to timeouts and deadlocks
Several PL/Perl fixes for encoding-related issues
Make selectivity operators use the correct collation
Prevent unsuitable slaves from being selected for synchronous replication
Make REASSIGN OWNED work on extensions as well
Fix race condition with ENUM comparisons
Make NOTIFY cope with out-of-disk-space
Fix memory leak in ARRAY subselect queries
Reduce data loss at replication failover
Fix behavior of subtransactions with Hot Standby

Document the latest phpMyAdmin vulnerability PMSA-2012-4

- Update www/typo3 to 4.7.4 [1] - Convert to new options framework [1] - Update www/typo345 to 4.5.19 [2] - Update www/typo346 to 4.6.12 [3] - Changes: https://typo3.org/news/article/typo3-4519-4612-and-474-released/ - Document security vulnerabilities [4]   https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/

PR:		ports/170650 [1]
PR:		ports/170647 [2]
PR:		ports/170649 [3]
Submitted by:	Helmut Schneider <jumper99@gmx.de> (maintainer)
Security:	48bcb4b2-e708-11e1-a59d-000d601460a4 [4]
Approved by:	eadler (mentor)

Document CVE-2012-3482 for fetchmail, one DoS and one information disclosure vulnerability in non-default NTLM code.

Also see ports/170613 which is pending maintainer feedback.

Belatedly add an entry for the recent IcedTea-Web updates.

Document libcloud MITM vuln.

Security:	CVE-2012-3446

Document the latest phpmyadmin security problem.

- Document vulnerabilities in www/chromium 20.0.1132.57 and 21.0.1180.60. - Keep the latest chromium vulnerabilies on top.

Document two vulnerabilities in www/chromium < 21.0.1180.75 related to the builtin PDF viewer.

Obtained from:	http://googlechromereleases.blogspot.com/search/label/Stable%20updates

- Update rails and friends to 3.2.8 - Document security issue in 3.2.7 [1]

Submitted by:	bdrewery [1]
Reviewed by:	swills [1]
Security:	31db9a18-e289-11e1-a57d-080027a27dbf

Document old sudosh buffer overflow.

Noticed by:	Diego Linke

Fix up whitespace in 10f38033-e006-11e1-9304-000000000000. Replace broken vid in 10f38033-e006-11e1-9304-000000000000 with one that is correct.

- Document FreeBSD-SA-12:05.bind

Document CVE-2012-3386 for devel/automake

Approved by:	eadler (mentor)

Belatedly add an entry for the recent Mozilla updates

Security:	http://www.freebsd.org/ports/portaudit/dbf338d0-dce5-11e1-b655-14dae9ebcf89.html

- Cleanup whitespace

Whitespace fixes.

Add modified for django entry.

Noticed by:	remko@

Add CVE entries for f01292a0-db3c-11e1-a84b-00e0814cab4e.

Document Apache 2.2.x insecure handling of LD_LIBRARY_PATH. Add patch[1] to address problem to apache port.

[1]: http://svn.apache.org/viewvc/httpd/httpd/trunk/support/envvars-std.in?view=log&pathrev=1296428

Approved by:	apache@ (pgollucci@)
Obtained from:	Apache SVN

- Document django -- multiple vulnerabilities

- Update net/isc-dhcp41-server to 4.1-ESV-R6 [1] - Document vulnerabilities in net/isc-dhcp41-server - Cleanup formatting in vuxml

PR:		ports/170245 [1]
Submitted by:	Douglas Thrift <douglas@douglasthrift.net> (maintainer) [1]
Security:	c7fa3618-d5ff-11e1-90a2-000c299b62e1

Fix build.

- security update bugzilla   new Versions: 3.6.10, 4.0.7, 4.2.2

4.2.2

  This release fixes two security issues. See the Security Advisory for details.

  In addition, the following important fixes/changes have been made in this release:

  o A regression introduced in Bugzilla 4.0 caused some login names to be ignored
    when entered in the CC list of bugs. (Bug 756314)
  o Some queries could trigger an invalid SQL query if strings entered by the user
    contained leading or trailing whitespaces. (Bug 760075)
  o The auto-completion form for keywords no longer automatically selects the
    first keyword in the list when the field is empty. (Bug 764517)
  o A regression in Bugzilla 4.2 prevented classifications from being used in
    graphical and tabular reports in the "Multiple Tables" field. (Bug 753688)
  o Attachments created by the email_in.pl script were associated to the wrong
    comment. (Bug 762785)
  o Very long dependency lists can now be viewed correctly. (Bug 762783)
  o Keywords are now correctly escaped in the auto-completion form to prevent any
    XSS abuse. (Bug 754561)
  o A regression introduced in Bugzilla 4.0rc2 when fixing CVE-2011-0046 caused
    the "Un-forget the search" link to not work correctly anymore when restoring a
    deleted saved search, because this link was lacking a valid token. (Bug 768870)
  o Two minor CSRF vulnerabilities have been fixed which could let an attacker
    alter your default search criteria in the Advanced Search page. (Bugs 754672
    and 754673)

  4.0.7

  This release fixes one security issue. See the Security Advisory for details.

  In addition, the following bugs have been fixed in this release:

  o A regression introduced in Bugzilla 4.0 caused some login names to be ignored
    when entered in the CC list of bugs. (Bug 756314)
  o Keywords are now correctly escaped in the auto-complete form to prevent any
    XSS abuse. (Bug 754561)
  o A regression introduced in Bugzilla 4.0rc2 when fixing CVE-2011-0046 caused
    the "Un-forget the search" link to not work correctly anymore when restoring a
    deleted saved search, because this link was lacking a valid token. (Bug 768870)

  3.6.10

  This release fixes one security issue. See the Security Advisory for details.
  http://www.bugzilla.org/security/3.6.9/

Approved by:	implicit skv@ (bugzilla / bugzilla3)
Security:	CVE-2012-1968
		CVE-2012-1969
		https://bugzilla.mozilla.org/show_bug.cgi?id=777398
		https://bugzilla.mozilla.org/show_bug.cgi?id=777586
		vid=58253655-d82c-11e1-907c-20cf30e32f6d

- Whitespace only fixes.

Please care more about formating.

- Update to 3.2.13 - Cleanup whitespace - Document vulnerability in dns/nsd (CVE-2012-29789)

PR:		ports/170208
Submitted by:	Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Security:	17f369dc-d7e7-11e1-90a2-000c299b62e1

- Update Rails and friends to 3.2.7 - Add vuxml entry for Rails 3.2.6 [1]

Reviewed by:	zi [1]

Security update to 0.11

ChangeLog:

0.11    2012-07-03  Alex Vandiver
	* Obfuscate passwords in RT's System Configuration page
	* Set an empty CurrentUser on failure, instead of removing it entirely

0.10_01 2012-02-23  Thomas Sibley
	* Escape usernames in filter values so special characters don't die

0.10 2012-02-17  Thomas Sibley
     * Silence confusing log messages when $ExternalInfoPriority is empty

0.09_03 2012-01-27	 Thomas Sibley
	* Fetch the necessary attributes when group_attr_value is used
	* Test escaping of commas during the group check

0.09_02 2012-01-26	Thomas Sibley
	* Improved logging inside the LDAP group membership check

0.09_01 2012-01-23 Thomas Sibley
	* Improved logic when dealing with Disabled/disabling users
	* Configurable group membership attribute values
	* Group membership tests

Security Advisory:

    http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html

Approved by:	shaun (mentor)
Security:	cdc4ff0e-d736-11e1-8221-e0cb4e266481

- Document vulnerabilities in net/isc-dhcp42-server

Heavy DNSSEC Validation Load Can Cause a "Bad Cache" Assertion Failure in BIND9

High numbers of queries with DNSSEC validation enabled can cause an
assertion failure in named, caused by using a "bad cache" data structure
before it has been initialized.

CVE: CVE-2012-3817
Posting date: 24 July, 2012

/ is not allowed in package name, fix the entry by removing the databases/ prefix.

- Document activerecord security issues

- update to 5.3.15 - document php vulnerabilities

Security:	http://www.vuxml.org/freebsd/bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89.html

Fix nit: 	blockquote citations should be listed as a reference as citation isn't user visible.

Document nsd vulnerability

The referenced PR contains a fix that bumps PORTREVISION, so the entry will
not match fixed versions.

PR:		ports/170024
Obtained from:	http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt
Security:	CVE-2012-2978

The changelog indicates the bug can be found in versions prior to 1.2.1

Fix nit: references section should include urls used in citation.

Document buffer overflow in jpeg-turbo

PR:		ports/169963
Submitted by:	Denis E Podolskiy <bytestore@yandex.ru>
Security:	CVE-2012-2806

Document dokuwiki XSS vulnerability.

- Document puppet security issue

Obtained from: http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18

openx reported a new security issue but does not provide any details: inform users of this.

Document asterisk vulnerabilities.

- Document typo3 4.5.x, 4.6.x and 4.7.x XSS vulnerability

Security:	https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/

Document phplist SQL injection and XSS.

Submitted by:	Krzysztof Stryjek <wtp@bsdserwis.com>

Document vulnerabilities for www/chromium < 20.0.1132.43

Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- Document recent FreeBSD SA's for 2012: SA-12:04.sysret, SA-12:03.bind, SA-12:02.crypt, SA-12:01.openssl

Reviewed by:	wxs

- update to 2.6

PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal
scheme to generate a key, which reduces the signature space or public key space and
makes it easier for attackers to conduct brute force attacks to obtain the private key.

PR:	ports/169146
Approved by:	portmgr

- Remove PORTEPOCH for de-wordpress and zh-wordpress

- fix range for f5f00804-a03b-11e1-a284-0023ae8e59f0 - add url - adjust modified accordingly

PR:	ports/169152
Submitted by:	Trond.Endrestol@ximalas.info

- fix spelling of `php-fpm' in entry description

- fix package name

Submitted by:	scheidell@ (me)