security/vuxml 1.1_6

Now that www/mambo is updated, fix the range in 8a5770b4-54b5-11db-a5ae-00508d6a62df.

document recent asterisk vulnerabilities

- Document ejabberd vulnerability fixed in 2.1.8

PR:		ports/158137
Submitted by:	Ruslan Mahamatkhanov <cvs-src@yandex.ru>
Security:	http://vuxml.org/freebsd/01d3ab7d-9c43-11e0-bc0f-0014a5e3cda6.html

- also mark firefox35 vulnerable

- document recent mozilla vulnerabilities [1] - while here also document an older samba Denial of service vulnerability [2]

Security:	http://www.vuxml.org/freebsd/dfe40cff-9c3f-11e0-9bec-6c626dd55a41.html [1]
		http://www.vuxml.org/freebsd/bfdbc7ec-9c3f-11e0-9bec-6c626dd55a41.html [2]
Requested by:	timur [2]

Document piwik remote command execution vulnerability.

Document dokuwiki XSS vulnerability.

Update linux-f10-flashplugin to 10.3r181.26 .

PR:		ports/157900
Submitted by:   Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:	http://www.freebsd.org/ports/portaudit/55a528e8-9787-11e0-b24a-001b2134ef46.html

- Document CVE-2011-1408 in www/ikiwiki

- Cleanup

Update to 10.3r181.22 .

PR:		ports/157696
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:	http://www.freebsd.org/ports/portaudit/57573136-920e-11e0-bdc9-001b2134ef46.html

Document www/chromium vulnerabilities fixed in version 12.0.742.91

Security:	CVE-2011-{1808-1819,2332,2342}

- Document CVE-2011-1910

PR:		ports/157548
Submitted by:	Ryan Steinmetz <rpsfa@rit.edu>

Add CVE-2011-1947: fetchmail STARTTLS denial of service.

- Cleanup

- document asterisk remote crash vulnerability

Security:	http://www.vuxml.org/freebsd/34ce5817-8d56-11e0-b5a2-6c626dd55a41.html

Document CVE-2011-1752, CVE-2011-1783 and CVE-2011-1921 in devel/subversion

Document drupal6 multiple vulnerabilities.

Submitted by:	Nick Hilliard <nick@foobar.org>

Document Erlang R14B02 ssh library vulnerability (cryptographically weak RNG).

Security:	CVE-2011-0766

Document latest www/chromium vulnerabilities.

Security:	CVE-2011-1801, -1804, -1806, -1807

- Cleanup Part 1

PS: wonder when pplz start to ask ports-security for review ...

- Document the last unbound vulnerability

- revert last change of apr-* entry

Broken build reported by wxs@

- use apr-* and add <gt></gt> entries for all apr0/apr1 issues   (<gt> .. is needed else the parser cannot make a difference    between apr0 and apr1)

- lowercase ViewVC -> viewvc

 Thanks Jun Kuriyama ( kuriyama@ ) for the notice and the patch
 for the apr entries.

Update the mod_pubcookie entry with an ap20 prefix.  The port has alwasy has USE_APACHE=2.0 in it so we can avoid enumarating all values of APACHE_PKGNAMEPREFIX.

Pointy hat:	brooks

Unbreak VuXML web build by changing "ap*-" to "ap-" in package name for 1ca8228f-858d-11e0-a76c-000743057ca2 / mod_pubcookie -- Empty Authentication Security Advisory.

While the new one is likely not correct, this fixes the build until
somebody can put in the right thing.

Fix build.

Partially address several years of neglect of pubcookie.  Indicate the security issues in two two ports.

I've not use pubcookie in several year and given the lack of complaint
about the deprication of mod_pubcookie, I doubt anyone else uses it from
ports.  The mod_pubcookie port has already expired and I've set a two
week expriation for pubcookie-login-server.  If not maintainer
appears I will send both to the Attic on June 6th.

While I'm here, address the use of CONF_FILES and CONF_DIRS in
pubcookie-login-server to avoid getting in the way of progress. [0]

PR:		ports/157164 [0]
Security:	vuxml:115a1389-858e-11e0-a76c-000743057ca2
		vuxml:1ca8228f-858d-11e0-a76c-000743057ca2

- add entry for ViewVC < 1.1.11 - add entry for apr1 (CVE-2011-1928) - correct version in previous apr1 entry - run tidy

Update to 10.3r181.14 .

PR:		ports/156996
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>
Security:	http://www.freebsd.org/ports/portaudit/d226626c-857f-11e0-95cc-001b2134ef46.html

Document Opera Frameset unload code injection vulnerability.

Document pure-ftpd multiple vulnerabilities prior to 1.0.32.

mail/exim: document CVE-2011-1764 and CVE-2011-1407

Both vulnerabilities are in the DKIM code and were fixed in 4.76.

Approved-by: erwin (mentor)
Feature-safe: yes

- document Apache APR DoS vulnerabilities

- Document www/zend-framework (potential SQL injection when using PDO_MySQL)

Security:	http://framework.zend.com/security/advisory/ZF2011-02

Document mediawiki multiple vulnerabilities.

PR:		ports/156914
Submitted by:	Ryan Steinmetz <rpsfa@rit.edu>

Document CVE-2011-1799 and CVE-2011-1800 for www/chromium

Incorporate changes recommended by the tidy target. While here, properly label dc9f8335-2b3b-11e0-a91b-00e0815b8da8.

Document CVE-2011-1720: Postfix memory corruption error.

Document www/chromium vulnerabilities fixed in version 11.0.696.57

Security:	CVE-2011-[1303-1305, 1434-1452, 1454-1456]

Document mozilla -- multiple vulnerabilities

- document recent asterisk vulnerabilities - fix topic in RT entry

Document VideoLAN-SA-1103. Heap corruption in MP4 demultiplexer in VLC.

Update to 10.2r159.1 .

Security:	http://www.freebsd.org/ports/portaudit/32b05547-6913-11e0-bdc4-001b2134ef46.html

Document multiple vulnerabilities in RT www/rt36 and www/rt38

Document www/chromium vulnerabilities

Security:	CVE-2011-1301, CVE-2011-1302

Unbreak file format: - Place <vuxml> tag at the start of the file. - Close topic tags.

Pointy hat to:	cy

Add the following for security/krb5: 	MITKRB5-SA-2011-001 - kpropd denial of service 	MITKRB5-SA-2011-002 - KDC denial of service attacks 	MITKRB5-SA-2011-003 - KDC vulnerable to double-free when PKINIT enabled 	MITKRB5-SA-2011-004 - kadmind invalid pointer free()

Document a root exploit via rogue hostname in xrdb.

Limit affected mupdf version to <0.8

Submitted by:	tobez@ (irc)