security/vuxml 1.1_6

- fix typo

- Add entry for mplayer -- DMO File Parsing Buffer Overflow Vulnerability

Reviewed by:    simon (secteam)

- Add entry for Trac "download wiki page as text" Cross-Site Scripting Vulnerability.

Reviewed by:    simon@

Correct affected versions in "mod_jk -- long URL stack overflow vulnerability" entry.

Noticed by:	Nick Barkas

Document mod_jk -- long URL stack overflow vulnerability.

For recent "mozilla -- multiple vulnerabilities" entry:

- Mark Seamonkey 1.1.1 as safe.  While mozilla.org does not clearly
  state this, it does seem to be the case. [1]
- Add another critical vulnerability which wasn't on the web site when
  the vuxml entry was initially added.

Reported by:	Volodymyr Kostyrko [1]

Document bind -- Multiple Denial of Service vulnerabilities Now all Security Advisories are merged again in VuXML.

Document FreeBSD -- Jail rc.d script privilege escalation

Document: gtar -- name mangling symlink vulnerability

Document FreeBSD -- Kernel memory disclosure in firewire(4).

Document libarchive -- Infinite loop in corrupt archives handling in libarchive.

This is also FreeBSD SA-06:24.libarchive, FreeBSD systems are not
affected, only specific STABLE versions which are not released!!

Document FreeBSD SA 06:23 OpenSSL - Multiple problems in crypto (3).

- Bump modified date for last update in mozilla entry. - Bump file copyright year.

Extend the latest gecko vulnerabilities to mail/lightning.

Fix whitespace which I forgot before committing the last update.

Document mozilla -- multiple vulnerabilities.

Note that Seamonkey 1.1 is marked vulnerable under the "better safe than
sorry" principle, since it's not yet clear if Seamonkey 1.1 is
vulnerable to this batch of vulnerabilities.

Document snort -- DCE/RPC preprocessor vulnerability.

Document rar -- password prompt buffer overflow vulnerability.

Reminded by:	Nate Eldredge

Mark 5.2.1_2 as the first safe version for the recent "php -- multiple vulnerabilities" entry since there was a bug in one of the fixes in upstream 5.2.1 which port revision 5.2.1_2 fixed.

Document php -- multiple vulnerabilities.

joomla -- multiple remote vulnerabilities

Reviewed by:	secteam (remko)
Approved by:	erwin (mentor, implicit)

Document two sircd vulnerabilities:

sircd -- remote reverse DNS buffer overflow
  sircd -- remote operator privilege escalation vulnerability

Reviewed by:	secteam (remko)
Approved by:	erwin (mentor)

- Document multple net/cacti vulnerabilities.

Add mplayer RealMedia RTSP streams buffer overflow entry.

PR:		ports/107217
Submitted by:	Thomas E. Zander (multimedia/mplayer maintainer)
Reviewed by:	simon@

Document two fetchmail vulnerabilities.

See also:	http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt
		http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt

Reported by:	Matthias Andree (upstream author)

Document opera -- multiple vulnerabilities.

Upgrade drupal to 4.7.5 fixing a couple security issues. Upgrade drupal-pubcookie and drupal-textile to the 4.7 versions.

Submitted by:	Nick Hilliard <nick at foobar dot org> (upgrade to 4.7.4)
Security:	vid:3d8d3548-9d02-11db-a541-000ae42e9b93

Unbreak file by using & in w3m entry.

Pointy hat to:	nobutaka
Reported by:	Philipp Wuensche

Document a format string vulnerability of w3m.

- Document www/plone vulnerability

Reviewed by:	simon
Approved by:	erwin (mentor)

- Update the www/zope entry to indicate it is fixed now

PR:		ports/106505
Submitted by:	HAYASHI Yasushi <yasi@yasi.to>
Reviewed by:	simon
Approved by:	erwin (mentor)

phpbb -- NULL byte injection vulnerability has been fixed in their 2.0.22, so mark it as safe.  Update to the port is pending.

Add an entry for recently fixed proftpd remote code execution vulnerabilities.

Reviewed by:	remoko

Document gzip -- multiple vulnerabilities, this is FreeBSD-SA06:21.gzip

Document bind9 -- Denial of Service in named(8) which is also known as FreeBSD-SA-06:20.bind

Notice: The previous commit was FreeBSD-SA-06:19.openssl

Document openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)

sql-ledger -- multiple vulnerabilities

Reviewed by:	remko

Update several entries, making them a bit clearer (Were possible), adjusting some package names, and collapsing some ruby entries that can be combined. Also properly sort the <bid> and <cvename> tags. b comes before c.

Document the recent D-BUS vulnerability as described by CVE-2006-6107.

Submitted by:	mnag

- evince -- Buffer Overflow Vulnerability

- Change spaces to tabs in <name> and <range> - Remove some empty lines - Respect 2 spaces between <body> and <p> - Respect empty line between <vuln vid=""> entry.

tDiary - Injection Vulnerability

- wv -- Multiple Integer Overflow Vulnerabilities

- wv2 -- Integer Overflow Vulnerability

- Fix tnftpd entry (made validate happy)

tnftpd - remote root exploit

Reviewed by:	simon
Approved by:	secteam

- clamav -- Multipart Nestings Denial of Service

Rewrite the libxine entry:

o Use the FDP style to fill in the entry.
o Remove the secunia references and use the libxine information.
o Properly sort the references section
o Add the modified tag (since I changed it).

Add an entry for libxine multiple buffer overflow vulnerabilities.

- Ok. gnupg-devel are not affected.