security/vuxml 1.1_6

cancelled 6fd9a1e9-efd3-11d8-9837-000c41e2cdad: does not affect FreeBSD   <http://docs.FreeBSD.org/cgi/mid.cgi?20040817123651.GB930>

Add a pointer to Przemyslaw Frasunek's advisory.

For the lukemftpd/tnftpd issue, add a reference to NetBSD security advisory now that it is available.

Note a vulnerability in lukemftpd/tnftpd.

multiple CVS vulnerabilities

Correct the version numbers and dates in the last entry.

Add an entry for:   Ruby insecure file permissions in the CGI session management

Document a setgid "games" security issue in xonix.  Based on a VuXML entry that was

Submitted by:	robert@OpenBSD.org

Correct the version number range affected for ja-samba. Correct the version number range affected for Mozilla 1.8 alphas.

Problem hinted at by:	eik

Correct the version number range affected for Mozilla 1.8 alphas.

Problem hinted at by:	eik

While I'm here, add a CVE name reference and a couple of other relevant
Bugzilla links.  It is interesting that this security issue was reported
as early as 1999.  Also, replace the text plagiarized from the Secunia
advisory without attribution with a more helpful (maybe?) description of
the issue.

Format string vulnerability in jftpgw.

Informed by:	Robert Nagy <robert@openbsd.org>

Repair broken URL.

Noticed by:	simon

Add two issues covering three KDE advisories:  two temporary file handling issues, and a KHTML issue.

The last commit should have changed the comparison tag from <le> to <lt>.

Update Gaim vulnerability (5b8f9a02-ec93-11d8-b913-000c41e2cdad) to indicate that gaim-0.81_1 has a fix for this.

The MSN component of Gaim contains remotely exploitable buffer overflows.

The Adobe Acrobat Reader can be coerced into executing arbitrary commands on UNIX systems.

Under certain configurations of POPfile may allow an attacker to retrieve files from the victim's machine.

Reported by:	Daniel Grund <mail@dgrund.de>

Correct version information syntax in a number of entries.  VuXML-using tools are expected only to understand actual package names and version numbers, not globs such as `foo-{bar,baz}' or `1.*'.

give the ImageMagick png vulnerability an own entry

f72ccf7c-e607-11d8-9b0a-000347a4fa7d is a duplicate of 6f955451-ba54-11d8-b88c-000d610a3b12, move references

add a reference for linux-png-1.0.x to 3a408f6f-9c52-11d8-9366-0020ed76ef5a

add ImageMagick to the list of png-vulnerable ports

correct typo

Add an entry for Thunderbird to the libpng vulnerability.

move abe47a5a-e23c-11d8-9b0a-000347a4fa7d to vuxml, add mozilla to the list of vulnerable ports

move f9e3e60b-e650-11d8-9b0a-000347a4fa7d to vuxml, add mozilla to the list of vulnerable ports

Mozilla / Firefox user interface spoofing vulnerability

Use & instead of naked &.

Add CVE name and correct URL to iDEFENSE advisory for the SSLtelnet issue.

- add some references - correctly match samba 3.0 - add ja-samba

Fix an XML tag.

Mark the 2.2.x series of Samba as vulnerable.

Recently announced Samba issue.

fix courier-imap version number

PHP memory_limit and strip_tags() vulnerabilities.

ethereal

move e5e2883d-ceb9-11d8-8898-000d6111a684 to vuln.xml

XSS vulnerability affecting other webmail systems

Add missing mandatory <body> element for SSLtelnet issue.

Add an entry for the SSLtelnet format string vulnerability.

Pavuk HTTP Location header overflow

Move phpnuke vulnerabilities to VuXML.

GNATS local privilege elevation (corrected PORTREVISION)

GNATS local privilege elevation

Whitespace cleanup.

Add SA-04:13.linux

move "phpMyAdmin code injection" to vuxml

- Add phpMyAdmin 2.5.7 vulnerability.

I hope I got XML right.

Use the equal '=' sign as only the current version was affected.