security/vuxml 1.1_6

Mark all 1.6 and 1.8 versions as vulnerable, we do not have a fix yet and are unable to tell what the naming scheme will be with those patches.  We can narrow down the scope later, we should not do so before we know the mentioned scheme.

Triggered by:		sem

Add a BID to the latest vuxml entry. Some minor changes to the markup of the entry.

- Document Ruby vulnerability. [1] - Fix URL in previous mutt entry while here.

Reported by:	Joel Hatton via freebsd-ports [1]

Add linux-thunderbird to mozilla -- multiple vulnerabilities entry.

Prodded by:	sat

Document apache -- mod_rewrite ldap buffer overflow vulnerability.

Thanks to remko for doing initial list of apache package names in an
earlier VuXML entry.

Fix error in latest mozilla entry which marked all firefox version as vulnerable.

Reported by:	Craig Leres

Document mozilla -- multiple vulnerabilities.

Note I assume that linux-firefox-devel 3.0.a2006.07.26 is fixed, I
haven't actually checked (way to many issues to check for).

Add "zope -- information disclosure vulnerability" entry

Reviewed by:	simon

For latest drupal entry:  - Unbreak vuln.xml format by adding content to the references section.  - Remove vulnerabilities already documented in    40a0185f-ec32-11da-be02-000c6ec775d9.

Add entry for drupal issues.

Add shoutcast crosssite scripting.

Submitted by:	gabor
Reviewed by:	simon

Cancel VID 0a4cd819-0291-11db-bbf7-000c6ec775d9 / opera -- JPEG processing integer overflow vulnerability, since it turns out that the issue does not affect the FreeBSD or Linux versions of Opera.

Source:	http://www.opera.com/support/search/supsearch.dml?index=834

Correct dates in latest mambo entry by resetting entry date and adding a modified date.

OK'ed by:	itetcu

Bump modified date for previous commit.

Requested by:	simon

The two two SQL injection vulnerabilities in Mambo described in vid f70d09cb-0c46-11db-aac7-000c6ec775d9 are fixed in 4.5.4

PR:		ports/100044
Submited by:	maintainer

Fix markup breakage that slipped in just before commit of the latest samba entry.

Document samba -- memory exhaustion DoS in smbd.

- For the latest trac entry include information from the release   announcements about setups which are not affected.  To avoid having   to reference two documents simply reference the release notes for   all the information (it's basically the same as the changelog with   slightly different wording). - Add a modified date tag.

Document twiki -- multiple file extensions file upload vulnerability.

Improve markup for last entry.  No content change.

Add trac DoS.

Add an entry for Horde's latest vulnerabilities.

Document mambo -- SQL injection vulnerabilities.

Document phpmyadmin -- cross site scripting vulnerability

Approved by:	markus (co mentor)

Document webmin, usermin -- arbitrary file disclosure vulnerability.

Details are unknown, all sources talk about an "unspecified" vulnerability.

Document mutt -- Remote Buffer Overflow Vulnerability.

Approved by:	ahze (mentor)

Document joomla --  multiple vulnerabilities

Approved by:	markus (co mentor)

Document hashcash -- heap overflow vulnerability.

Document gnupg -- user id integer overflow vulnerability.

Document opera -- JPEG processing integer overflow vulnerability.

Update the webcalendar entry, use alphabetic sorting, no functional change of information.

Add an entry for Horde's latest XSS vulnerabilities.

Add webcalendar -- information disclosure vulnerability.

PR:		ports/98993
Submitted by:	Gregory C. Larkin <glarkin@sourcehosting.net>

Add FreeBSD-SA-06:17.sendmail to the VuXML database.

Bump modification date in the last entry and earn my own pointyhat.

Forgotten by/pointyhat:		remko

Fix the latest entry by using the entity for &, this passes make validate.

Reported by:	Michal Kaps <michal at ionic dot co dot uk>
Pointyhat by:	aaron, (tobez implicit)

- Added multiple dokuwiki vulnerabilities

Approved by:	tobez

Add an entry for libxine -- buffer overflow vulnerability.

Document FreeBSD-SA-06:15.ypserv and FreeBSD-SA-06:16.smbfs. Add the proper freebsdsa tag for older entries and bump their modification date.

Document two freeradius issues, one newer and one older issue: freeradius -- multiple vulnerabilities freeradius -- authentication bypass vulnerability

Mark graphics/fractorama 1.6.7_1 "clean". This port now links against libtiff from ports.

Approved by:	simon (secteam)

The awstats port has PORTEPOCH bumped, so update the vuxml entry awstats -- arbitrary command execution vulnerability to reflect that.

Mumble, back out local changes which should not have been committed.

Mark squirrelmail-1.4.6_1 as fixed for squirrelmail -- plugin.php local file inclusion vulnerability.

Document squirrelmail -- plugin.php local file inclusion vulnerability.

Document dokuwiki -- spellchecker remote PHP code execution.

Document drupal -- multiple vulnerabilities.

- Add last two MySQL vulnerabilities

MySQL -- SQL-injection security vulnerability
MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities

Document frontpage -- cross site scripting vulnerability and point FORBIDDEN from the frontpage ports at it.

While this is "only" a cross site scripting vulnerability it has some
rather serious implications which can allow an attacker to take over a
web site, so I'm keeping FORBIDDEN.

cscope -- buffer overflow vulnerabilities