security/vuxml 1.1_6

- Note that plone is also affected by 34414a1e-e377-11db-b8ab-000c76189c4c   prior to version 2.5.3

Reviewed by:	simon

- gzip 1.3.12 has been patched and is not affected by   11a84092-8f9f-11db-ab33-000e0c2e438a any more

Reviewed by:	simon

Document an information disclosure vulnerability in mod_jk < 1.2.23.

Reviewed by:	simon

Add an entry for an email header injection vulnerability in www/typo3 from February.

Reviewed by:	remko
Persuaded by:	cperciva and simon by setting up the
		ports-security team

- Document phppgadmin - Cross Site Scripting Vulnerability.

Reviewed by:	mnag@
Reported by:	dinoex@

- Add entry for findutils -- GNU locate heap buffer overrun.

Revieved by:	simon (secteam)
Approved by:	miwi (mentor)

Mark file < 4.21 as vulnerable to the heap overflow.

Add an entry for the recent Freetype heap overflow vulnerability.

Submitted by:	Nick Barkas <snb@threerings.net>

Document FreeBSD-SA-07:04.file (heap overflow in file(1))

Approved by:	portmgr (secteam implicit)

- Document squirrelmail -- Cross site scripting in HTML filter

Approved by:	portmgr (marcus)

Document png -- DoS crash vulnerability.

Document samba -- multiple vulnerabilities.

Brought to you from Heathrow Airport and BSDCan 2007 Devsummit.

Backout last change.

Blackboard:

- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.
- I will remember to look at which files are committed.

x1000

Pointy hat to:	simon

Update PHP entry to include the vulnerable version so the entry is correct for when PHP is updated in ports (yes it's being worked on), or for people who upgrade "manually".

With hat:	secteam
Requested by:   several

Document a lot of PHP vulnerabilities, mark all php4 and php5 (+cli,cgi) ports as vulnerable till the ports had been upgraded.

Bump modification date for the latest mod_perl entry, this was forgotten by erwin, but there were "massive" changes that warrant a date bump.

Standarize the latest entry (qemu) a bit more and add a forgotten 'a' in the p5-Imager text.

Document multiple qemu vulnerabilities

Obtained from:	debian-security-announce@lists.debian.org mailing list
Security:	multiple qemu vulnerabilities

Update to 0.57 - fixes possible overflow vulnerability regarding malformed BMPs, see vuln.xml for details.

Security:	VuXML ID: 632c98be-aad2-4af2-849f-41a6862afd6a

Document FreeBSD -- IPv6 Routing Header 0 is dangerous

Rework the mod_perl entry to note that Mandriva originally released an advisory.  Also add mod_perl2 to the vulnerable versions.

Minor wordsmithing in the last mod_perl entry.

Submitted by:	simon

Add entry for mod_perl -- remote DOS in PATH_INFO parsing

PR:		111844
Submitted by:	"Philip M. Gollucci" <pgollucci@p6m7g8.com>

p5-Crypt-OpenPGP 1.03_1 should not be vulnerable to CVE-2005-0366.

- Mark latest firefox and seamonkey snapshots as safe

- Add entry for claws-mail - APOP vulnerability

lighttpd -- DOS when access files with mtime 0 lighttpd -- Remote DOS in CRLF parsing

- Add freeradius-mysql to the list of affected packages of the recent   freeradius entry.

Submitted by:	David Wood <david@wood2.org.uk>

Mark Google Earth >= 4.0.2414 as safe.

- Document recent remote dos vulnerability in freeradius.

Add an extra reference to the old "gnupg -- OpenPGP symmetric encryption vulnerability" entry which explains the problem in a more easy to read way.

Submitted by:	tobez (sort of)

Document fetchmail's "insecure APOP authentication" issue (fixed in 6.3.8).

Stylify the latest zope entry:

o Use consistent title description
o Use tabs when 8 spaces are hit
o Sort the references list (the alphabet goes from a to z)
o Bump modification date (note: please check the entry date
  so that it matches the correct data of insertion).

Also stylify the latest mcweject entry.

Add entry for exploitable buffer overflow in mcweject.

PR:		111365
Submitted by:	Jeff Forsythe<tornandfilthy2006@yahoo.com>

Add entry for webcalendar "noSet" variable overwrite vulnerability.

PR:		110585
Submitted by:	Greg Larkin <glarkin@sourcehosting.net>

Add entry for Zope2 cross-site scripting vulnerability.

Inspired by:	Yasushi Hayashi<yasi@yasi.to> (in PR 111119)

Remove f951cf4a-a1fe-11db-98f9-0004aca3703d entry. It's duplicate to 41da2ba4-a24e-11db-bd24-000f3dcc6a5d.

- Fix versions and dates in latest squid entry

Pointy hat to:	miwi

Standarise the latest Squid entry.

- Add entry for squid  TRACE method handling denial of service

Fix range for sql-ledger entry which I missed in my original review.

Document sql-ledger vulnerability

PR:		ports/110350
Submitted by:	Antoine Beaupre <anarcat@koumbit.org>

Document cacti -- remote injection exploit

PR:		ports/107838
Submitted by:	Dan Langille <dan at langille dot org>

Correct two tdiary entries:

o correct the affected version numbers
o package name of www/tdiary-devel is "tdiary-devel", not "tdiary"
o add ja-tdiary and ja-tdiary-devel to affected packages

PR:		ports/109086
Submitted by:	KOMATSU Shinichiro <koma2 at lovepeers dot org>

Document two long forgotten Samba vulnerabilities.

PR:		ports/109049
Submitted by:	KOMATSU Shinichiro <koma2 at lovepeers dot org>

ktorrent -- multiple vulnerabilities: - Add CVE references - Bump modification date

Spell out multiple vulnerabilities instead of specifying the exact amount (we always do that). Also bump the modification date for this entry and the PHP entry that had been touched

Fix typo in PHP entry

Document ktorrent -- two vulnerabilities

Add ja-trac-*.