security/vuxml 1.1_6

coppermine -- Multiple File Extensions Vulnerability coppermine -- "file" Local File Inclusion Vulnerability coppermine -- File Inclusion Vulnerabilities

phpmyadmin -- XSRF vulnerabilities

- Normalize the topic of last entry

Requested by:	remko

- Add VuXML entry for vnc 4.1.1

- Add vulnerabilities in last topic.

phpldapadmin -- Cross-Site Scripting and Script Insertion

Modify the entry for p5-DBI insecure temporary files creation to reflect the fact that version 1.37_1 of p5-DBI-137 is OK now.

Reviewed by:	simon

Add www/fswiki vulnerability.

- Add missing s in latest awstats entry's title. - Document mysql50-server -- COM_TABLE_DUMP arbitrary code execution.

- Cancel last rsync entry. Does not affect FreeBSD port.

Notified by:	simon, pav
Discussed with:	simon

Document awstat -- arbitrary command execution vulnerability.

Fix a incorrect use of cvename in the latest firefox entry, which I
missed when reviewing the entry (and which make validate did not / can
not catch).

phpwebftp -- "language" Local File Inclusion

Document firefox -- denial of service vulnerability

Reviewed by:	simon

trac -- Wiki Macro Script Insertion Vulnerability

rsync -- "xattrs.diff" Patch Integer Overflow Vulnerability

clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability

- Add last jabberd entry:

jabberd -- SASL Negotiation Denial of Service Vulnerability

Also mark linux-seamonkey vulnerable to recent mozilla vulnerabilities.

Reported by:	Andrew Pantyukhin infofarmer at gmail dotty com

cacti -- ADOdb "server.php" Insecure Test Script Security Issue

amaya -- Attribute Value Buffer Overflow Vulnerabilities

lifetype -- ADOdb "server.php" Insecure Test Script Security Issue

ethereal -- Multiple Protocol Dissector Vulnerabilities

My 100th commit to the vuln.xml file:

- Document Asterisk -- denial of service vulnerability, local system access.

Change paraview checks to be < 2.4.3 now that paraview uses system libtiff.

Document zgv, xzgv -- heap overflow vulnerability.

Document crossfire-server -- denial of service and remote code execution vulnerability.

Document p5-DBI -- insecure temporary file creation vulnerability.

Document wordpress -- full path disclosure.

Document xine -- multiple remote string vulnerabilities.

Add an entry for cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service.

Also mark all other versions of FreeBSD (That were released) as vulnerable.

Noticed by:	brueffer
Discussed with:	brueffer, simon

Add FreeBSD -- FPU information disclosure (SA-06:14) to the vuxml list.

Add some CERT references to latest Mozilla entry.

plone -- "member_id" Parameter Portrait Manipulation Vulnerability

Fix copy/paste error in last commit and mark linux-mozilla < 1.7.13 as vulnerable.

Document mozilla/firefox/thunderbirds's latest attempt at Internet Explorer compatibility.

Note that I omitted marking some really old mozilla versions as
vulnerable this time, since there is already a bunch of entries
covering these versions (which haven't been in ports for a while).

Update entry for sysutils/heartbeat. The insecure temporary file creation vulnerability is fixed in 1.2.4.

Approved by:	secteam (simon)

mailman -- Private Archive Script Cross-Site Scripting

Document f2c -- insecure temporary files.

It is not very clear to me to see what version is fixed.  The one fixing
this port should import the latest available one which is fixed.

mplayer -- Multiple integer overflows

- Add Secunia references for last phpMyAdmin issue.

Document kaffeine -- buffer overflow vulnerability.

Document thunderbird -- javascript execution.

Update the latest zoo entry to match the latest update to the port. This will mark zoo-2.10.1_2 and later as not vulnerable for this issue.

phpmyadmin -- XSS vulnerabilities phpmyadmin -- 'set_theme' Cross-Site Scripting

clamav -- Multiple Vulnerabilities

Add cvename to the recent OpenVPN entry.

Submitted by:	Matthias Andree <matthias dot andree at gmx dot de>

Document mediawiki -- hardcoded placeholder string security bypass vulnerability.

Document netpbm -- buffer overflow in pnmtopng.

Document zoo -- stack based buffer overflow.