security/vuxml 1.1_6

Document win32-codecs -- multiple vulnerabilities

Attempt two:

Document php -- multiple vulnerabilities

OK, I do not know WHAT went wrong but it went wrong, revert to the old situation and i will re-adopt the PHP entry.

Document php -- multiple vulnerabilities

Cancel latest gnutls entry (GNUTLS-SA-2006-3) - it is a false alarm:

http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001208.html

Upgrade drupal-pubcookie to the latest version fixing a security hole allowing anyone to bypass the authenication system and become an arbitrary drupal user.

Security:	vid:c0fd7890-4346-11db-89cc-000ae42e9b93

Style neats for the latest gnutls entry.

Reviewed by:	remko

correct the tomcat entry (change the ,5 to _5 since we talk about PORTREVISION instead of PORTEPOCH) [1]

correct the jdk -- jar directory traversal vulnerability entry, the
FreeBSD Foundation uses different package names [2], [3].

For both entries the modification date was bumped.

Reported by:		Gabor Kovesdan (on #bsdports) [1]
			David Robillard <david dot robillard at gmail dot com> [2]
			Tim Zingelman <zingelman at fnal dot gov>

Document linux-flashplugin7 -- arbitrary code execution vulnerabilities.

Mark jakarta-tomcat5 as fixed since 5.0.30,5 regarding minor XSS issue.

Add an info about GNUTLS-SA-2006-3.

- mailman -- Multiple Vulnerabilities

Bump modification date for last jabber entry change

Noted by:	remko

Fix jabber entry

Document hlstats -- multiple cross site scripting vulnerabilities.

Document gtetrinet -- remote code execution

Bump modified date in the entry changed by garga.

Forgotten by:	garga

net-im/jabber -- Mark the correct versions with fd_set vulnerability, author fixed the problem on trunk and 2 new releases (1.4.3.1 and 1.4.4.1) is comming soon

Update the latest FreeBSD-SA entry, ppp got replaced by sppp. Also implement a suggestion from Simon, mark all versions before the latest version vulnerable.

Document joomla -- multiple vulnerabilities

Note that I only documented the high level
threats, there are several others which can
be found at the link provided [1]

Reference:	http://www.joomla.org/content/view/1841/78/ [1]

Document FreeBSD-SA-06:18.ppp

Minor whitespace cleanup (we need a blank line every after </entry> so that we can easily see the different entries).

- Add imp to the previous entry. - Add some SecurityFocus BIDs too.

Document horde -- Phishing and Cross-Site Scripting Vulnerabilities.

Convert 8 spaces to tab as per the FDP for the latest entry.

Add entry for globus tmpfile creation bugs.

The lang/f2c port has been updated, update affected versions.

Reviewed by:	simon

Document x11vnc -- authentication bypass vulnerability.

The 1.1111th commit, yay.

Document alsaplayer -- multiple vulnerabilities.

Document postgresql -- encoding based SQL injection.

Reported by:		Radim Kolar <hsn at netmag dot cz>

Bump modified date in the older entry I just corrected.

Spotted by:	simon (again)

Document postgresql -- multiple vulnerabilities.

These are all older vulnerabilities which had not yet been documented
by the Security Team.

Also fix a minor mistake in an older PostgreSQL entry.

Fix the discovery date in the latest MySQL entry.

Spotted by:	simon

Document mysql -- format string vulnerability.

OK after some more discussions with Simon it appeared that the ,2 marked all future releases of squirrelmail as vulnerable.

The negative side-effect of PORTEPOCH.  Split the previous entry
into two seperated entries again, restoring the old entry for
squirrelmail, and having the 'new' entry for ja-squirrelmail.

This would grab any future versions of ja-squirrelmail if it were
to be readded, and does not conflict with future versions of
squirrelmail.

For more information about the portepoch discussion etc:
http://lists.freebsd.org/pipermail/freebsd-vuxml/2006-July/000185.html

Simon provided me with the necessary clue to mark the appropriate ports as vulnerable.  I was soo close..

Document squirrelmail -- random variable overwrite vulnerability.

Note that I marked all ja-squirrelmail entries as vulnerable, it
does no longer exist on it's own and the portepoch is giving me
matching problems.

Document rubygem-rails -- evaluation of ruby code.

Submitted by:	Marius Nuennerich <marius.nuennerich@gmx.net>

Add CVE name to recent ClamAV entry.

Document clamav and clamav-devel vulnerability

Reviewed by:	secteam (mnag)

- Fix discovery date in latest entry - Remove extra "." in latest entry

Update drupal to 4.6.9 to fix yet another XSS vulnerability.

Security:	vuxml vid c905298c-2274-11db-896e-000ae42e9b93

Add recent gnupg issue.

We are not affected by: CAN-2005-0018 in the f2c entry (43cb40b3-c8c2-11da-a672-000e0c2e438a).  We do not have the shellscript, and it is not installed.

Reported by:		thierry

Unbreak latest ruby entry by adding missing </lt>.

Run make tidy to clean up some style issues.

Only sort on entry date, not modified date.  It simply causes too much repo churn with little value to resort all entries which have been modified.

- The last vulnerabilities was fixed in ruby18 port

OK, I misunderstood Simon with this one.  The <gt>1.8.*</gt> entry should have stayed and I interpreted that wrong.

Pointyhat:		remko

Fix my previous version commit.  The two entries matched twice when you have ruby installed.  You learn something new everyday...

Noticed/discussed with:		simon