security/vuxml 1.1_6

Document an integer overflow in the GD Graphics Library.

Correct entry date for the putty entry.

OK'ed by:	josef

Document vulnerability in putty

Reviewed by:	simon

Add an entry for a wzdftpd remote DoS.

Updates to the bogofilter entry:

- Improve information about which versions are vulnerable. [1]
- Add a few more references.

Submitted by:	Matthias Andree <matthias.andree@gmx.de> [1]

Update linux-openmotif to 2.2.4 to fix the security.

http://vuxml.freebsd.org/ef253f8b-0727-11d9-b45d-000c41e2cdad.html

Document rssh format string vulnerability.

Approved by:	nectar

Create a VuXML entry for Horde XSS help window vulnerability to replace the portaudit-db entry.

Document a denial-of-service issue in bogofilter. This entry is slightly modified from one that was Submitted by:	Matthias Andree <matthias.andree@gmx.de>

Fix integer overflow vulnerabilities.

Patch made by:	Chris Evans, Dirk Muller, Sebastian Krahmer,
		Derek Noonburg and Marcus Meissner
Submitted by:	nectar

Document xpdf 2 and xpdf 3 vulnerabilities.

Document several security issues in gaim, fixed in various versions from 0.82 through 1.0.2.  While I'm here, notice that there have been ru-, ko-, and ja- flavors of gaim, as well as a fairly short-lived range of version numbers based on dates (snapshots).

Note that the Red Hat based linux_base ports contain vulnerable libXpm.so files.

Noticed by:	maho

Document SSL_Cypherbypass vulnerability in mod_ssl and buffer overflow vulnerability in gaim.

- Document more buffer overflows in mpg123. - Fix package name in two older mpg123 entries.

Approved by:	nectar

I suck.    (Correct a typo that would have been readily detected if             I would have run `make validate' before committing.)

Add CVE name for cabextract issue.

Fix a copy/paste typo in last commit.

Document DoS in Apache 2 SSL handling.

Approved by:	nectar

Note that xpm has been fixed. Also, it appears that Motif itself is affected, so add related packages.

Update entry regarding INN 2.4.x buffer overflow:  - The email archive referenced is no longer available.  Use    marc.theaimsgroup.com archive instead.  - Note that only 2.4.x versions are affected (earlier ones    are not).

Reported by:	leeym

Document remote command execution vulnerability in phpMyAdmin.

Approved by:	nectar

Document insecure directory handling in cabextract.

Approved by:	nectar

Set correct entry date for the a2ps issue.

Noticed by:	nectar
Pointy hat to:	simon

Document insecure command line argument handling in a2ps.

Approved by:	nectar

Document a vulnerability in ifmail.  (There does not exist an appropriate public reference yet--- this entry should be updated when the port is updated.)

Reported by:	Niels Heinen <niels.heinen@ubizen.com>

Document a vulnerability in imwheel.

Add CVE names for FreeRADIUS vulnerabilities.

Document NTLM authentication vulnerability in squid

Approved by:	nectar

Document a SQL command injection in Cacti.

The status of the PHP configuration option magic_quotes_gpc was
confirmed by:	ale

Approved by:	nectar

Document a format string vulnerability in the apache13 mod_ssl proxy support.

Approved by:	nectar

- Change a few uses of <url> into <mlist>.

OK'ed by:	nectar

Additional comment to the Tor entry from v. 1.302, it was:

Submitted by:	rik <freebsd-security@rikrose.net> (original version)

- Document remote DoS and loss of anonymity in Tor. - Update a Samba entry with new information about vulnerable versions.

Approved by:	nectar

lesstif has been upgraded to a version that is not affected by the libXpm vulnerability.

Recommit my changes from 1.298 which was accidently removed in 1.299.

Pointy hat to:	josef (who also noticed the problem)

Document two seperate security vulnerabilities in icecast1 and icecast2.

Approved by:	nectar

Change the Xerces-C++ entry to match the xerces-c2 port.

Noticed by:	nectar

Document vulnerability in freeradius.

Approved by:	nectar

- Document DoS in Xerces-C++. - Fix typo in a mozilla entry.

Approved by:	nectar

It turns out that lesstif has libXpm sneakily embedded.  There are at least three files with this comment at the top:

* This file contains most of the source files of Xpm, concatenated and with
  * the public names changed (to have an _LtXpm prefix).

Document XSS in wordpress.

Approved by:	nectar

Document integer overflows in libtiff.

- Document a CUPS local information disclosure. - Note the impact of the sharutils buffer overflows.

Approved by:	nectar

Document a vulnerability in Zinf (freeamp).

Approved by:	nectar

Document libtiff RLE decoder issues.

The sharutils buffer overflows has been fixed in sharutils 4.2.1_2.

Document a vulnerability in sharutils.

Approved by:	nectar

Document 2 DoS attacks possible against older versions of mail-notifier.

Based on the security advisories
mentioned in the reference links.

Approved by:	nectar

ale@ reports that the only ports affected are php[45], php[45]-cgi, and mod_php[45].

Note squid SNMP DoS.  Based on an entry that was Submitted by:	Thomas-Martin Seck <tmseck@netcologne.de>