security/vuxml 1.1_6

The latest xpdf buffer overflow has been repaired in an update to pdftohtml.

Submitted by:	erwin

Add CVE names for recent squid vulnerabilities.

squid -- buffer overflow in WCCP recvfrom() call

PR:		ports/76827
Submitted by:	squid maintainer

Mark cups-base as fixed wrt. to "makeFileKey2() buffer overflow vulnerability".

Document "makeFileKey2()" buffer overflow vulnerability in xpdf (and programs embedding xpdf).

pdflib has been corrected.

Noticed by:	Hilko Meyer <Hilko.Meyer@gmx.de>

Document a vulnerability in zhcon.

Fix last YAMT entry update to actually make sense... Greater than and less than are not the same...

Pointy hat to:	simon

Mark latest YAMT port version as fixed.

Document arbitrary code execution vulnerability in evolution.

Correct the entry date for 4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3 ``squid -- HTTP response splitting cache pollution attack''.

Document a local vulnerability in mod_dosevasive.

Document a possible cache-poisoning issue affecting squid.

Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de>

Document Bugzilla XSS issue.

Oops, forgot to set <discovery> date.

Document window injection vulnerabilities affecting several web browsers.

Cancel duplicate phpbb entry e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae.  It was already documented as e3cf89f0-53da-11d9-92b7-ceadd4ac2edd. Useful references and descriptions were merged.

Noticed by:	simon

Document a vulnerability in YAMT.

Add squid security advisories for two recent squid entries.

Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de>

squid bug #1200:

squid -- HTTP response splitting cache pollution attack

PR:		ports/76550
Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de>

Fix typo in last commit.

Document XSS in Horde.

Oops, I accidently changed an <entry> date when I should have added a <modified> date.

Document vulnerabilities in older versions of Midnight Commander.

Document a race condition in Perl's File::Path module.

Document phpBB vulnerabilities.

Document vulnerabilities in the Opera web browser's Java implementation.

Document that older versions of sudo lack CDPATH environmental variable handling.

Document vulnerabilities in fcron.

Document vulnerabilities in RealPlayer.

Add CVE name and iDEFENSE advisory references to xzgv issue.

Grr, get the imlib version number right!

Oops, imlib 1.9.15 is still affected.  Adjust version number to reflect upcoming fix.

Document xpm heap overflows and integer overflows affecting imlib and imlib2.

Document a vulnerability in eGroupWare.

Document Quake II vulnerabilities reported by Richard Stanway.

Add CVE names for konversation bugs.

Document security issue in irc/konversation.

Pointed out by:	markus

Correct several instances where the "msgid" attribute content had an extraneous trailing greater-than character ">", e.g.

<mlist msgid="some-message@id>">some-url</mlist>

These were probably the result of off-by-one errors during
cut-and-paste.

Eliminate character entity references.  They are technically fine of course, but I prefer to use the UTF-8 character directly: it makes grep'ing and the like easier.

Update entries with 12 new CVE name references.

Fix date (was YYYY-MM-DD, now 2005-01-19)

Thanks for Chimera@#bsdports

squid -- no sanity check of usernames in squid_ldap_auth

(My first attempt to update this thing. Hope all goes fine!)

PR:		ports/76364
Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de>

Document remote DoS in CUPS.

Heads-ups by:	Hilko Meyer <hilko.meyer@gmx.de>
Description by:	nectar

During last year's bumpercrop of vulnerabilities in libtiff, a 2004 CVE name was assigned to what was actually a much older (circa March 2002) denial-of-service issue.  Document it, since occassionally the CVE name crops up and then I wonder why we missed it.

Document exploitable vulnerabilities in zgv and xzgv.

Document bug in Mozilla-based software that may leave downloaded files or attachments world-readable.

Add more references to exim entry.

pdflib contains libtiff, and thus is affected by several vulnerabilities that affected libtiff.

Document remote command execution vulnerability in awstats.