security/vuxml 1.1_6

security/vuxml: add www/*chromium < 124.0.6367.78

Obtained from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_24.html

security/vuxml: correct historical www/glpi entries

Several older entries for www/glpi had incorrect version ranges, causing
pkg audit to complain about false positives.  This corrects the older
entries and adds some missing ones.

PR:	        278549

security/vuxml: Document matrix-synapse vulnerability

security/vuxml: document gitlab vulnerabilities

security/vuxml: add CVEs related to www/glpi

New CVEs for GLPI which were corrected in versions 10.0.11, 10.0.12 and
10.0.13.

PR:		278548
PR:             278090

security/vuxml: Document arbitrary memory address read vulnerability in Ruby

security/vuxml: document sdl2_sound vulns

PR:		278491

security/vuxml: add www/*chromium < 124.0.6367.60

Obtained from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html

security/vuxml: Document possible DoS attack valnerability in ClamAV

security/vuxml: Document Jenkins Security Advisory 2024-04-17

Sponsored by:	The FreeBSD Foundation

security/vuxml: document electron{27,28,29} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.11,
		https://github.com/electron/electron/releases/tag/v28.3.1,
		https://github.com/electron/electron/releases/tag/v29.3.1

security/vuxml: Add entries for php8*

Approved by:	portmgr (blanket)

security/vuxml: document PuTTY/FileZilla NIST P521 private key recovery

Security:       080936ba-fbb7-11ee-abc8-6960f2492b1d
Security:       CVE-2024-31497

security/vuxml: Document go language vulnerabilities

security/vuxml: add www/*chromium < 123.0.6312.122

Obtained from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_10.html

security/vuxml: document electron{27,28} out of bounds memory access in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.10,
		https://github.com/electron/electron/releases/tag/v28.3.0

security/vuxml: Document OpenSSL vulnerability

security/vuxml: add www/forgejo HTTP/2 vulnerability

PR:	278119

security/vuxml: add net/jose DoS vulnerability

PR:	278243

security/vuxml: added gitlab 16.10.2, 16.9.4, 16.8.6 updates

security/vuxml: Add wordpress vulnerability

security/vuxml: Document Apache httpd vulnerabilities

security/vuxml: document electron{27,28} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.9,
		https://github.com/electron/electron/releases/tag/v28.2.10

security/vuxml: add www/*chromium < 123.0.6312.105

Obtained from:	https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop.html

security/vuxml: close off-by-one gap after 1f3a9629b7a4

xwayland-devel-21.0.99.1.672 *is* vulnerable but wasn't ever in ports/.

security/vuxml: add xwayland-devel to 9661a37b4dff list

security/vuxml: Document recent xorg-server and xwayland vulnerabilities

Sponsored by:	Beckhoff Automation GmbH & Co. KG

security/vuxml: Document Jenkins Security Advisory 2024-03-20

Sponsored by:	The FreeBSD Foundation

security/vuxml: Fix vid d58726ff-ef5e-11ee-8d8e-080027a5b8e9

Temporarily remove cvename tag as it is not a valid CVE name and breaks
vuxml build.

Sponsored by:	The FreeBSD Foundation

security/vuxml: reference FreeBSD SA-24:03.unbound

Add a reference to FreeBSD SA-24:03.unbound (announced 2024-03-28) to
the vuxml entry for Unbound CVE-2023-50387 and CVE-2023-50868.

Unbound was updated to 1.19.1 in FreeBSD 14.0-RELEASE-p6 and in FreeBSD
13.2-RELEASE-p11.  FreeBSD 13.3 was not affected (Unbound 1.19.1 was
included in the release).

security/vuxml: Document mediawiki multiple vulnerabilities

security/vuxml: Register net/quiche vulnerabilities

PR:		277692
Reported by:	Ralf van der Enden <tremere@cainites.net>
Approved by:	junho.choi@gmail.com (maintainer)

security/vuxml: document electron{27,28} object lifecycle issue in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.8,
		https://github.com/electron/electron/releases/tag/v28.2.9

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 123.0.6312.86

Obtained from:	https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_26.html

security/vuxml: add phpmyfaq < 3.2.6

security/vuxml: Document vulns in Emacs prior to version 29.3

Obtained from:	https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3
Sponsored by:	The FreeBSD Foundation

security/vuxml: Remove references to non-existent package.

There never was a grafana10 package.  Initially there was www/grafana
providing grafana-8.x.  Then a www/grafana9 port was added providing
grafana-9.x.  The www/grafana port was subsequently obsoleted, and
then revived, now providing grafana-10.x.  I believe the idea is that
going forwards, www/grafana will provide the latest stable release
version and there may be numbered ports for older major versions.

PR:	277631

security/vuxml: Add www/grafana and www/grafana9 data sourceprivilege escalation

PR:	277631

security/vuxml: add www/*chromium < 123.0.6312.58

Obtained from:	https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop_19.html

security/shibboleth-idp: Document CAS SSRF vulnerability

security/vuxml: document mongodb* vuln: CVE-2024-1351

Improper Certificate Validation

Security:	CVE-2024-1351

security/vuxml: Document www/varnish7 vuln: CVE-2023-43622

security/vuxml: remove duplicated entry, see 3bac9fee140f64f562008b81ea2f2391b3fca116

Reported by:	flo@smeets.xyz

security/vuxml: Add amavisd-new vulnerability

security/vuxml: document typo3-{11,12} security issues

PR:		277117
Reported by:	 Helmut Ritter <freebsd-ports@charlieroot.de>

security/vuxml: remove duplicate entry for CVE-2024-1931

PR:		277686

dns/unbound: Update to unbound 1.19.3

This release has a number of bug fixes. The CNAME synthesized for a
DNAME record uses the original TTL, of the DNAME record, and that means
it can be cached for the TTL, instead of 0.

There is a fix that when a message was stored in cache, but one of the
RRsets was not updated due to cache policy, it now restricts the message
TTL if the cache version of the RRset has a shorter TTL. It avoids a
bug where the message is not expired, but its contents is expired.

For dnstap, it logs type DoH and DoT correctly, if that is used for
the message.

The b.root-servers.net address is updated in the default root hints.

When performing retries for failed sends, a retry at a smaller UDP size
is now not performed when that attempt is not actually smaller, and at
defaults, since the flag day changes, it is the same size. This makes
it skip the step, it is useless because there is no reduction in size.

Clients with a valid DNS Cookie will bypass the ratelimit, if one is
set. The value from ip-ratelimit-cookie is used for these queries.

Furthermore there is a fix to make correct EDE Prohibited answers for
access control denials, and a fix for EDNS client subnet scope zero
answers.

For more details, see
https://github.com/NLnetLabs/unbound/releases/tag/release-1.19.3
PR:		277686
Security:	c2ad8700-de25-11ee-9190-84a93843eb75

security/vuxml: document electron{27,28} out of bounds memory access in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.6,
		https://github.com/electron/electron/releases/tag/v28.2.7

security/vuxml: Document Intel CPU vulnerabilities

Security:	CVE-2023-43490
Security:	CVE-2023-22655
Security:	CVE-2023-28746
Security:	CVE-2023-38575
Security:	CVE-2023-39368
Sponsored by:	The FreeBSD Foundation