security/vuxml 1.1_6

Document integer overflows in xli.

Document arbitrary command execution vulnerabilities in xli and xloadimage.

Add new CVE names for yamt entry.

Correct and improve recent xli entry: * It actually affected xloadimage and xli * A slightly better topic than just "buffer overflows" * More refererences * Fix the version number for xli... it is still vulnerable as of this   writing

Correct recently added yamt entry: * This is not CAN-2004-1302, which was documented much earlier * Try to explain the issue * Add the only public reference to the issue I can find

Buffer overflow in xli.

Fix breakage I caused.

Note buffer overflows and directory transversal issues in audio/ymat.

Update entry for FreeStyle Wiki: * <topic> style: ASCII em-dash "--" for separator * replace quoted text with more informative excerpt from a Secunia   advisory * add CVE name

Document vulnerabilities in XView library.

document a vulnerability in xtrlock

Document vulnerabilities reported in the Red Hat 7.1 libraries.

Document squirrelmail vulnerabilities.

correct version number for mailman password generation issue

Document vulnerability in set-user-ID sympa application.

Another older mailman vulnerability, somewhat minor

Add year-old mailman vulnerability, that seems to not have been previously documented here.

document Apache Jakarta Tomcat 5.x XSS issue

Mark samba-2.2.12.j1.0beta1_2 as safe from "samba -- integer overflow vulnerability".

Reminded by:	NAKAJI Hiroyuki <nakaji@jp.freebsd.org>

- Update to 3.5.8 (including XSS problem fix).

Submitted by:	Toshiya SAITOH <toshiya@saitoh.nu>
PR:		ports/81520

Remove a forgotten :.

Spotted by:		simon

Document the following issues:

o freeradius -- sql injection and denial of service vulnerability
o ppxp -- local root exploit
o oops -- format string vulnerability

Approved by:	simon

Fix entry dates for latest squid entries.

Reword the cdrdao entry, this includes comments from Simon which i overlooked.

Forgotten by:	remko
Spotted by:	simon

- Update Squid to 2.5.STABLE10

PR:		ports/81213
Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de> (maintainer)

Document cdrdao -- unspecified privilege escalation vulnerability.

Approved by:		simon

Document two gaim issues.

Add FreeBSD-SA-05:09.htt.

$EDITOR should not be quoted.  It might be "emacsclient -a vi" or something.

MAINTAINER -> security@FreeBSD.org

Update some leafnode references. Add new leafnode vulnerability.

PR:		ports/80724
Submitted by:	Matthias Andree <matthias.andree@gmx.de>

Document two new vulnerabilities in mozilla/firefox.

Document mozilla -- code execution via javascript: IconURL vulnerability.

Document some vulnerabilities in groff. - pic2graph and eqn2graph are vulnerable to symlink attack through temporary files - groffer uses temporary files unsafely

PR:		ports/80671
Submitted by:	KOMATSU Shinichiro

- gnu-radius exploitation was fixed in maintenance release 1.2.94   as reported in http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities

PR:		ports/80558 (follow-up)
Submitted by:	Vsevolod Stakhov <vsevolod@highsecure.ru>

. Update the version for the jar(1) vulnerability so that 1.2.2p11_4 is   no longer considered vulnerable.  Adjust the modified date for the entry.

Document sharutils -- unshar insecure temporary file creation

Approved by:		simon

Document rsnapshot -- local privilege escalation

Approved by:	simon

coppermine -- IP spoofing and XSS vulnerability

. Correct the range of vulnerable jdk14 ports for the jar(1) vulnerability   and update the modified time for the entry.

Document ImageMagick -- ReadPNMImage() heap overflow vulnerability.

Bump modified date for last commit.

. Adjust ranges so that jdk-1.3.1p9_5 is no longer marked as vulnerable to   the jar(1) vulnerability but is still marked vulnerable to the browser   plugin vulnerability (although the plugin is no longer built by default).

Document mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities.

Document some older vulnerabilities in GAIM.

Document kdewebdev -- kommander untrusted code execution vulnerability.

Fix a typo in the kdelibs - kimgio entry.

junkbuster -- heap corruption vulnerability and configuration modification vulnerability

Approved by:		simon

Document kdelibs -- kimgio input validation errors.

Mark latest openoffice 1.1 as fixed wrt. openoffice -- DOC document heap overflow vulnerability.

Informed by:	maho