security/vuxml 1.1_6

- Document p5-Mail-SpamAssassin vulnerabily (alread fixed in ports) - Document flyspray cross-site scripting vulnerabilities

Update the recent gallery2 and webcalendar entries:

o Add a better topic (description)
o Reword the webcalendar entry to have some more usefull data
o Add references (bid's and CVE names).

Document qpopper -- multiple privilege escalation vulnerabilities.

Note that the current version is not affected anymore.

- Add missed </p> tag [1] - Modify 594eb447-e398-11d9-a8bd-000cf18bbe54 entry:   ruby 1.6.x is not affected this vulnerability,   it have no XMLRPC support.

Pointy hat to:	simon [1]

Add a bit more info from the PEAR advisory about the vulnerability to make the scope of the vulnerability a bit more clear.

Disussed with:	thierry

The two latest OpenVPN vulnerabilities were both only for 2.0 and newer, so mark the correctly as such.

Submitted by:	Matthias Andree <matthias.andree@gmx.de>

Add an entry for pear-PEAR arbitrary code execution vulnerability.

Correct skype entry to match the correct fixed port version number.

Noted by:	Stefan Lambrev, cheffo FreeBSD-BG org

Document two OpenVPN vulnerabilities.

Submitted by:	Matthias Andree <matthias.andree@gmx.de>

As Peter Jeremy points out, the recent lynx vulnerability also concerns lynx-ssl.

- Document skype vulnerabilities - Document PHP vulnerabilities - Convert first letters in titles from upcase to lowercase   in my last additions.

- Document CVE-2005-3258:     Squid FTP Server Response Handling Denial of Service

- Document a BASE Basic Analysis and Security Engine vulnerability

Back out the accidentally committed white-space modification parts of rev.  1.869, but keep the lynx entry.

Pointy hat to:	naddy
OK'ed by:	naddy

Add entry for "fetchmail -- fetchmailconf local password exposure", which was fixed with fetchmail-6.2.5.2_1 and above.

Document lynx remote buffer overflow in NNTP header handling.

- Fix a ruby vulnerabuility in the safe level settings.

Based on:	ports/87816
Submitted by:	Phil Oleson <oz@nixil.net>

Security:	http://vuxml.FreeBSD.org/1daea60a-4719-11da-b5c6-0004614cc33d.html

Add more references to entry net-snmp -- remote DoS vulnerability.

- Mark linux-firefox 1.0.7 as fixed   wrt. 8665ebb9-2237-11da-978e-0001020eed82 (Mozilla/firefox IDN buffer   overflow) [1]. - Correct some of the the earlier linux-firefox entries to match   versions before 1.0.7, not after (whoops)...

Prodded by:	Andrew P. <infofarmer@gmail.com> [1]

Add misc/compat5x to "openssl -- potential SSL 2.0 rollback".

Reviewed by:	simon

Also mark xli as vulnerable to xloadimage -- buffer overflows in NIFF image title handling, and latest port version as fixed.

Reported by:	jkoshy

For entry libgadu -- multiple vulnerabilities:

- Mark latest centericq port version as fixed.
- Fix cite in description.

For entry zope28 -- expose RestructuredText functionality to untrusted users:

- Do not match zope 2.7.8 which has been fixed. [1]
- Fix typo in topic.
- Add another reference.

Reported by:	Gerhard Schmidt <estartu augusta de> [1]

Add another reference to clamav -- arbitrary code execution and DoS vulnerabilities entry.

Document x11/xloadimage buffer overflows in NIFF image title handling.

Rename all CAN-yyyy-nnnn to CVE-yyyy-nnnn, with the exception of text inside <blockquote>s. See <URL:http://www.cve.mitre.org/cve/renumber.html>.

For entry: snort -- Back Orifice preprocessor buffer overflow vulnerability: - Sort references. - Add ISS advisory to references.

- Document snort -- Back Orifice preprocessor buffer overflow vulnerability. - Use standard topic format for webcalendar entry. - Fix package name in webcalendar so it matches the actual package   name.

- Document www/webcalendar vulnerability.

- Document www/gallery2 vulnerability.

Improve last couple of entries: - Use standard topic format. - Fix packagename in phpmyadmin and zone entries. - Fix indention and remove EOL white-space. - Make lead in a bit more verbose. - Add more references to phpmyadmin issue. - Remove some redundant quoted text in zope issue.

Add entry for openssl Remove entry about safe mode in phpmyadmin

Add entry for phpmyadmin (PMASA-2005-4)

Fix typo with range values

Add entry from zope28

For libxine -- format string vulnerability entry: - Add reference to xine security announcement. - Fix indention on a few lines.

Add an entry for libxine format string vulnerability.

Mark older revisions linux_base-suse 9.3 as vulnerable to kdebase -- Kate backup file permission leak.

- Mark cfengine's arbitrary file overwriting vulnerability as fixed in 2.1.6_1 - Add another possible variant of package name - cfengine2

Add an entry for UW-IMAP Mailbox Name Handling Remote Buffer Overflow Vulnerability (CAN-2005-2933).

Add credit for recent ftp/weex incident

Approved by:	novel (mentor)

rinetd >= 0.62_1 has no more vulnerabilities

Add references to three squid entries.

Submitted by:		Thomas-Martin Seck <tmseck at netcologne dot de>
			(except for the bid's which i added myself).

Use the <freebsdpr> tag to markup a PR in weex -- remote format string vulnerability entry.

Document a format string vulnerability in ftp/weex.

Document picasm -- buffer overflow vulnerability.

Add an URL to the entry of the japanese/uim.

Document japanese/uim privilege escalation vulnerability.

Document cfengine -- arbitrary file overwriting vulnerability.

Mark zsync <= 0.4.1 vulnerable to the zlib buffer overflow vulnerability.

Inspired by:		gordon's commit