security/vuxml 1.1_6

Add more references to unace -- multiple vulnerabilities entry.

Add CVE name to an older ProZilla entry.

Add more references for latest phpmyfaq entry.

- Add a note that new entries, per convention, should be added to the   start of this file.

For latest phpmyfaq entry:

- Use port directory name as first part of topic.
- No need to include information about affected releases in topic
  (it's somewhat redundant and makes the title longer).
- Reindent body with standard FreeBSD Doc Project (more or less)
  style.

Document vulnerabilities in www/phpmyfaq

Add linux_base-suse-9.3 to the zlib entry.

Inspired by:		trevors commit.

Document clamav -- arbitrary code execution and DoS vulnerabilities.

- Be consistent and call entries "firefox & mozilla", not the other way   around. - Mark latest linux-mozilla port as fixed for recent mozilla   vulnerabilities.

- Document mozilla & firefox -- multiple vulnerabilities. - Add Mozilla Foundation Security Advisory references to two other   firefox/mozilla entries.

Add real references to urban -- stack overflow vulnerabilities.

Document mozilla & firefox -- command line URL shell command injection.

Add CVE name for tor -- diffie-hellman handshake flaw.

Correct package name for entry bind -- buffer overrun vulnerability.

Add CVE name to an older CUPS issue.

Fix the htdig entry, the port version and the VuXML version did not align.

Reported by:		Nic Bellamy <nic at bellamy dot co dot nz>

Fix the squirrelmail entry since only versions prior to 1.4.5 were affected. Bump modification date accordingly.

Reported by:		Avinash Piare <avinash at piare dot org>

Document the following items:

o apache -- Certificate Revocation List (CRL) off-by-one vulnerability
o squirrelmail -- _$POST variable handling allows for various attacks

Reviewed by:		simon

- Add an entry on possible DOS condition regarding NTLM in squid

PR:		ports/86179
Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de>

Document X11 server -- pixmap allocation vulnerability.

Reviewed by:	simon

Document unzip -- permission race vulnerability. [1]

Update the recent htdig entry with it's corrected version.

Reviewed by:		simon [1]

Document firefox & mozilla -- buffer overflow vulnerability.

Prodded by:	pav

Mark the latest version of cups-base fixed for "xpdf -- disk fill DoS vulnerability"

Add forgotten </package> line.

Spotted by:		simon

Mark b2evolution prior to 0.9.0.12_2 vulnerable to the XML_RPC remote php code injection vulnerability.

Inspired by:		pav's commit, updating the port.

Document htdig -- cross site scripting vulnerability.

Reviewed by:	simon

- Document two squid security related issues.

PR:		ports/85688
Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de> (squid maintainer)

Document bind9 -- denial of service. Also merge the FreeBSD-SA-05:12.bind9 advisory in the entry. [1]

Suggested by:		simon [1]
Reviewed by:		simon

Document bind -- buffer overrun vulnerability

Add a more or less bogus reference section to the last entry, to make it a valid entry.  The reference simply references the VuXML entry itself, but at least it fixes the build for now.

Missed by:	simon

Document stack overflow vulnerabilities in games/urban.

Approved by:	simon

Mark latest evolution port version as fixed wrt. evolution -- remote format string vulnerabilities.

Add entry for fswiki's vuln.

Dante 1.1.15 is no longer affected by the fd_set bitmap index overflow. Updated the version in VuXML (was 0).

Approved by:	nectar (mentor)

- Fill out part of the std. VuXML template missed in the last entry. - Mark acroread 7.0.1 as fixed for acroread -- XML External Entity   vulnerability. [1]

Reported by:	Sverre H. Huseby [1]

Document evolution -- remote format string vulnerabilities.

Approved by:	portmgr (blanket, VuXML)

Document pam_ldap -- authentication bypass vulnerability.

Approved by:	portmgr (blanket, VuXML)

Mark phpgroupware as vulnerable to pear-XML_RPC -- remote PHP code injection vulnerability.

Reported by:	olgeni
Approved by:	portmgr (blanket, VuXML)

Document pcre -- regular expression buffer overflow.

Approved by:	portmgr (blanket, VuXML)

Mark latest awstats port as fixed for awstats -- arbitrary code execution vulnerability.

Approved by:	portmgr (blanket, VuXML)

Document mail/elm remote buffer overflow vulnerability.

PR:		ports/85225
Submitted by:	Kevin Day <toasty@dragondata.com> (elm maintainer)
Approved by:	portmgr (blanket, VuXML)

Document four vulnerabilities in openvpn:

* openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server
* openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory
* openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients
* openvpn -- denial of service: client certificate validation can disconnect unrelated clients

Approved by:	portsmgr (blanket VuXML)
Submitted by:	Matthias Andree <matthias dot andree at gmx dot de>

Also mark phpAdsNew as affected by "pear-XML_RPC -- remote PHP code injection vulnerability".

Approved by:	portmgr (blanket, VuXML)

Add the fixed version so that people do not get a stale portaudit when the update is there. Also fix some indentation that i overlooked.

Noticed by:		simon (both of the items)
Approved by:		portsmgr (blanket VuXML)

Document tor -- diffie-hellman handshake flaw.

Submitted by:		Michal Bartkowiak <michal at nonspace dot net>
Approved by:		portsmgr (blanket VuXML)

gpdf has been fixed for "xpdf -- disk fill DoS vulnerability", mark it as such.

Approved by:	portmgr (blanket, VuXML)

Add eGroupWare to the list of packages affected by "pear-XML_RPC -- remote PHP code injection vulnerability".

Approved by:	portmgr (blanket, VuXML)

Document acroread -- plug-in buffer overflow vulnerability.

Approved by:	portmgr (blanket, VuXML)

Add phpmyfaq and drupal to the "pear-XML_RPC -- remote PHP code injection vulnerability" entry since they contain an embedded version of pear-XML_RPC.

Fix typo in body of the latest xpdf entry (note: no modified date bump
as this is a minor typo fix which does change <affects>).

Approved by:	portmgr (blanket, VuXML)

Document pear-XML_RPC -- remote PHP code injection vulnerability.

Submitted by:	hrs
Approved by:	portmgr (blanket, VuXML)

Document awstats -- arbitrary code execution vulnerability.

Approved by:	portmgr (blanket, VuXML)