security/vuxml 1.1_6

- Add gnupg-devel package in last entry - Add secunia reference in las entry

* Fix typo in the latest GnuPG entry, inherited from the original message * Fix the URL in references, the former one gives 404 Not found.   Kuriyama, where did you get it from?

Add CVE-2006-6235 entry for GnuPG.

- Add a modified field for the entry, touched by the previous commit

- List all affected packages for the Novermber ruby cgi DOS vulnerability - This vulnerability was not fixed in ruby_static

- Documenet ruby cgi library vulnerability

- Document buffer overflow vulnerabilities in the libmusicbrainz.

Fix markup in last entry so the file is valid XML again.

Pointy hat to:	simon

- Add a entry for www/tDiary, www/tDiary-devel

Reviewed by:    simon

- Document the SGI Image File heap overflow vulnerability in ImageMagick

Document "gtar -- GNUTYPE_NAMES directory traversal vulnerability".

Document 'kronolith -- arbitrary local file inclusion vulnerability'

In latest gnupg entry: - Use "Werner Koch reports" instead of "Author reports" to follow   normal style in vuln.xml. - Fix some indentation and markup in body.

Add recent gnupg one.

Add <modified> tag to previous proftpd entry.

Requested by:	remko

Add proftpd-mysql to the previous entry.

Document "proftpd -- Remote Code Execution Vulnerability".

The Command Injection Vulnerability was corrected by awstats 6.5_2,1.

Submitted by:	Alex Samorukov
PR:		ports/105233

Add archivers/unzoo Directory Traversal Vulnerability.

Reviewed by:	simon

Add bugzilla -- multiple vulnerabilities entry.

Update earleir bugzilla entry with better topic, add ja-bugzilla as
also potentially vulnerable (thought the version currently in
ja-bugzilla isn't), and add more references.

Add cvs+ipv6 to the cvsbug to the vulnerability.

PR:			ports/104638
Submitted by:		KIMURA Yasuhiro <yasu at utahime dot org>

- Document recent vulerabilties in the imlib2.

- Document recent vulnerability in the ruby CGI library.

Reviewed by:	simon

- pgp < 3.0 and pgpin does not support OpenPGP format no user given symetric key encryption Submitted by:	dinoex

The latest couple of firefox vulnerabilities should be fixed in the 2.0 release, so mark 2.0 as fixed.

Prodded by:	ahze

ru-apache and ru-apacvhe+mod_ssl were fixed.

Add a <modified> tag with the current date to reflect my previous change. I knew I should ask someone before committing, however trivial was the change.

Spotted by:	remko
Approved by:	portmgr (implicit)

Fix typo: "Dmitri Lenev reports reports a privilege ..."

Approved by:	portmgr (implicit)

Document screen -- combined UTF-8 characters vulnerability.

Approved by:	portmgr (secteam blanket)

Document two MySQL privilege escalations.

PR:		ports/104890
Submitted by:	Henrik Brix Andersen <henrik@brixandersen.dk>
Approved by:	portmgr (secteam blanket)

- Add entry for www/serendipity and www/serendipity-devel

Reviewed by:	markus@
Approved by:	portmgr (implicit VuXML), secteam (Remko (not reviewed yet))

Document an integer overflow vulnerability in Qt and kdelibs, based on an entry by sat

Approved by:	portmgr (erwin)

Add reference, which I missed the first time around, from Opera Software to opera -- URL parsing heap overflow vulnerability entry,

Approved by:	portmgr (secteam blanket)

Document opera -- URL parsing heap overflow vulnerability.

Approved by:	portmgr (secteam blanket)

Minor correction to last commit; the NVIDIA driver version 1.0.8762 was also affected, so mark it as such.

Approved by:		portmgr (secteam blanket)

Update entry for nvidia-driver -- arbitrary root code execution vulnerability:

- Add new info about vulnerable versions from NVIDIA.
- Add workaround.
- Add more references.
- Remove suggestion to move to "nv" driver now that we have a simpler
  workaround.

Approved by:		portmgr (secteam blanket)
Parts submitted by:	mnag

Document asterisk -- remote heap overwrite vulnerability

Approved by:		portmgr (VuXML blanket)
Submitted by:		Thomas Sandford
Facilitated by:		Snow B.V.

Some style changes to the plone entry.

Previous commit was also reviewed by myself.

Approved by:		portmgr (Blanket VuXML)
Facilitated by:		Snow B.V.

- Add a entry for www/plone

Approved by:	portmgr (erwin)

Document:   drupal -- HTML attribute injection   drupal -- cross site request forgeries   drupal -- multiple XSS vulnerabilities

Submitted by:	brooks
Reviewed by:	remko
Approved by:	portmgr (erwin)

Document "ingo -- local arbitrary shell command execution"

Submitted by:	thierry
Reviewed by:	remko
Approved by:	portmgr (erwin)

Update php -- _ecalloc Integer Overflow Vulnerability entry with details from Steffan Essers advisory about the implications of this issue.  The advisory was not public when this issue was initially fixed.

Approved by:	portmgr (secteam blanket)

Mark multimedia/win32-codecs as not-vulnerable after the quicktime codecs were optional. The quicktime codecs are still vulnerable though, but we rely on the conditional FORBIDDEN statement in the ports Makefile for this.

Approved by:	portmgr (self), secteam (simon)

Document "nvidia-driver -- arbitrary root code execution vulnerability".

Note that I haven't actually had time to make a test system to reproduce
this on FreeBSD, but due to the nature of this issue and that there is a
PoC exploit in the advisory, I'm adding this entry due to "better safe
than sorry"...

Approved by:	portmgr (secteam blanket)

- Mark php open_basedir fixed

Reviewed by:	secteam (simon)
Approved by:	portmgr (secteam blanket)

- clamav -- CHM unpacker and PE rebuilding vulnerabilities

Approved by:	portmgr (mnag with secteam hat)

- Add some references

Reviewed by:	secteam (simon)
Approved by:	portmgr (secteam blanket)

- Document temporary file symlink privilege escalation in tkdiff - Correct Javier's name spelling in an old advisory

Reviewed by:	secteam (simon)
Approved by:	portmgr (secteam blanket)

- Document multiple remote file inclusion vulnerabilities in vtiger

Reviewed by:	secteam (simon)
Approved by:	portmgr (secteam blanket)

- Document heap overflow in the KML engine in google-earth

Reviewed by:	secteam (simon)
Approved by:	portmgr (implicit)