security/vuxml 1.1_6

- Add Piwik CVE-2010-2786 entry

Previous vuln affects only apache-2.2.x

- Document libmspack and cabextract vulnerability

Add entry for apache.

Document buffer overflow when parsing gitdir. While here, tidy up a whitespace problem.

- Document www/codeigniter file upload class vulnerability

Approved by:	secteam (timeout - 1 week)
Security:	http://codeigniter.com/news/codeigniter_1.7.2_security_patch/

- Document mozilla -- multiple vulnerabilities

Approved by:	remko

Add vte as package name, instead of empty.

Document vte title set+query attack vulnerability.

While here add the CVE numbers to the webkit-gtk2 entry I forgot in the
previous commit.

PR:		ports/148678
Submitted by:	Janne Snabb <snabb@epipe.com>

Document webkit-gtk2 vulnerabilities.

Security:	http://blog.kov.eti.br/?p=116

- Document redmine vulnerabilities

Approved by:	miwi (secteam)
Security:	http://www.redmine.org/news/41

- Update to 3.1.1 - VuXML entry for PNG decoder security vulnerability - License information

PR:	ports/147871
Approved by:	Pavel Pankov <pankov_p@mail.ru> (maintainer)
Feature safe:	yes

Add bogofilter heap underrun on malformed base64 input.

Submitted by:	mandree
PR:		ports/148408
Feature safe:	yes

- Cleanup a bit

Feature safe:	yes

Document "bugzilla" - information disclosure.

Feature safe:	yes

Document multiple vulnerabilities in irc/kvirc*

Approved by:	remko@
Feature safe:	yes

Add bid reference for libpng entry.

Feature safe:	yes

- graphics/png CVE-2010-1205 Feature safe:	yes

- Document moodle -- multiple vulnerabilities

Reviewed by:	delphij@, miwi@
Feature safe:	yes

Document mDNSResponder -- corrupted stack crash when parsing bad resolv.conf

This only happens on a system where one has a system where
resolv.conf is writable by an untrusted user or where mdnsd is setuid
and can be tricked into opening an alternate resolv.conf.
PR:		ports/147007
Submitted by:	jmallett@
Approved by:	tabthorpe (mentor)
Feature safe:	yes

Document opera -- Data URIs can be used to allow cross-site scripting.

Assume opera-devel is vulnerable too, although snapshots aren't
mentioned in the advisory, and it's months out of date.

Feature safe:	yes

- Cancelled movemail symlink vulnerability (doesnt affect our ports) - Added entry for multiple vulnerabilities in cacti 0.8.7f - Updated ziproxy entry to satisfy "make tidy"

Approved by:	itetcu (mentor, implicit)
Feature safe:	yes

- Document mozilla -- multiple vulnerabilities

Feature safe:	yes
Approved by:	delphij

vuln 4e8344a3-ca52-11de-8ee8-00215c6a37bb has been fixed with php4-gd-4.4.9_4.

Requested by:	Michael Gmelin <mg bindone de>

Fix typo in previous revision.

- Cleanup, Formating

add CVE-2009-2347 tiff

Document linux-flashplugin -- multiple vulnerabilities.

Reviewed by:	tmclaugh

- Cleanup / Whitespace fixes

Remove empty package in previous revision.

- report FAX3 decoder buffer overrun

Document sudo secure path vulnerability. We are not vulnerable to this by default but a user could build sudo with SUDO_SECURE_PATH defined or turn it on in sudoers.

- Update to 3.0.1

PR:		ports/147195
Submitted by:	Pavel Pankov <pankov_p@mail.ru> (maintainer)

- Document two mediawiki security vulnerabilities

Approved by:	delphij@(ports-security override)

- Document multiple redmine vulnerabilities

Approved by:	miwi (secteam), beat (co-mentor)
Security:	http://www.redmine.org/news/39

Updated tomcat entry (CVE-2010-1157) with fixed version information. This makes sure that the correct older versions are marked vulnerable

Approved by:	itetcu (mentor, implicit)
Security:	http://www.vuxml.org/freebsd/3383e706-4fc3-11df-83fb-0015587e2cc1.html

- Added 109 missing CVE names to 60 VuXML entries - Fixed Tomcat55 entry to mark current PORTREVISION vulnerable

PR:		ports/146418
Approved by:	itetcu (mentor, implicit)
Security:	http://people.freebsd.org/~niels/vuxml/

Added wireshark (DoS) and piwik (XSS) issues

Approved by:	itetcu (mentor, implicit)
Security:	http://www.wireshark.org/security/wnpa-sec-2010-03.html
Security:	http://www.wireshark.org/security/wnpa-sec-2010-04.html
Security:	http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/

Added spamass-milter remote command execution vulnerability

Approved by:	itetcu (mentor, implicit)
Security:	CVE-2010-1132
Security:	http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html

- Added mediawiki and lxr vulnerabilities - Fixed vlc topic format (lower case, portname first)

PR:		ports/146337
Approved by:	itetcu (mentor, implicit)
Security:	http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
Security:	http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com

Added 38 missing CVE names to 24 VuXML entries (256 CVE names to go)

Approved by:	itetcu (mentor, implicit)
Security:	http://people.freebsd.org/~niels/vuxml/

Added 34 missing CVE names to 24 VuXML entries (294 CVE names to go)

Approved by:	miwi (secteam)
Security:	http://people.freebsd.org/~niels/vuxml/

- VideoLAN has released 1.0.6 to address serveral vulnerabilities they discoverd while working towards the 1.1.0 release. These vulnerabilities could potentially allow for a specially crafted file to execute code.

PR:		ports/146099
Submitted by:	Joseph S. Atkinson <jsa@wickedmachine.net> (maintainer)

- fix version for apache+mod_ssl

- fix info for apache+mod_ssl

Mark kdebase3 as safe now.

- Documented multiple Joomla! vulnerabilities - Added new reference to the recent cacti issue

Approved by:	remko (secteam)
Security:	http://developer.joomla.org/security/

Documented vulnerabilities in moodle, tomcat55, tomcat66 and cacti

PR:		ports/146021
PR:		ports/146022
Approved by:	remko (secteam)
Security:	http://seclists.org/bugtraq/2010/Apr/200
Security:	http://docs.moodle.org/en/Moodle_1.9.8_release_notes
Security:	http://www.bonsai-sec.com/en/research/vulnerability.php

Documented emacs movemail vulnerability and marked the seperate mail/movemail port vulnerable to an old format string vulnerability.

Approved by:	remko (secteam)
Security:	http://www.ubuntu.com/usn/USN-919-1

Added krb5 double free vulnerability

Approved by:	remko (secteam)
Security:	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt
Security:	CVE-2010-1320