security/vuxml 1.1_6

security/vuxml: add libvpx to the entry

The libvpx port was already updated.
https://chromium.googlesource.com/webm/libvpx/+log/v1.13.0..v1.13.1

Security: CVE-2023-5217

security/vuxml: Improve affected version ranges of composer vulnerability entry.

security/vuxml: Add devel/php-composer* vulnerability

security/vuxml: add www/*chromium < 117.0.5938.132

Obtained from:	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html

security/vuxml: fix long description warning

Eliminate an annoying warning from "make validate"

Modify entry 441e1e1a-27a5-11ee-a156-080027f5fec9 description and get rid of
empty lines and some expendable words. vuxml.freebsd.org prints all the lines
joined together.

security/vuxml: document electron heap buffer overflow in vp8 encoding

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.25,
		https://github.com/electron/electron/releases/tag/v24.8.5,
		https://github.com/electron/electron/releases/tag/v25.8.4

security/vuxml: add gitlab vulnerabilities 2023-09-28

security/vuxml: document multiple xrdp vulnerabilities

security/vuxml: Fix name

security/vuxml: Record net/routinator vulnerability

CVE-2023-39916

	Base Score:	6.5 MEDIUM
	Vector:		CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

PR:	274105

security/vuxml: Fix make newentry CVE_ID

Fix description body, broken when introducing SA_ID

Fixes:	e90a0b117fdc61d6d6bc4b02a4b7b5be5a878b2d

security/vuxml: Add SA_ID to make newentry

Automate registration of FreeBSD Security Advisories.

It adds a new parameter for the newentry subcommand accepting a SA ID as present
in the FreeBSD Security Advisories web page
(https://www.freebsd.org/security/advisories/)

Fills an entry following the common structure for FreeBSD SAs and leaves some
"FIXME" strings in those places that need special care.
Developers should NOT blindly trust the output of the script.

`make newentry SA_ID=FreeBSD-SA-23:11.wifi.asc`
`make newentry SA_ID=FreeBSD-SA-22:01.vt`

Reviewed by:		philip@
Differential Revision: https://reviews.freebsd.org/D41966

security/vuxml: Document Jenkins Security Advisory 2023-09-20

Sponsored by:	The FreeBSD Foundation

security/vuxml: Add information about mail/mailpit vulnerability.

security/vuxml: Remove spurious file

Fixes:	20c93ef1ae8f43a36f9b05e79e6531b6186f3a86

security/vuxml: add graphics/webp heap buffer overflow

graphics/webp was updated to 1.3.2

PR:		273766
Security:	CVE-2023-4863

security/vuxml: Add Tor browser libwebp vulnerability

CVE-2023-4863
	Base Score:  8.8 HIGH
	Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PR:		273416
Reported by:	kaltheat <kaltheat@gmail.com>
Security:	CVE-2023-4863

security/vuxml: document gitlab vulnerability

security/vuxml: document routinator vulnerabilities

Obtained from:	https://nlnetlabs.nl/news/2023/Sep/13/routinator-0.12.2-released/

security/vuxml: Document cURL vulnerability

PR:		273764
Reported by:	yasu

security/vuxml: Document Roundcube XSS vuln

security/vuxml: remove unnecessary placeholder for cvename and url

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.24,
		https://github.com/electron/electron/releases/tag/v24.8.3,
		https://github.com/electron/electron/releases/tag/v25.8.1

security/vuxml: add www/*chromium < 117.0.5938.62

Obtained from:	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.htm

security/vuxml: document vscode remote code execution vulnerability

Obtained from:	https://github.com/microsoft/vscode/issues/192906

security/vuxml: Mark zeek < 6.0.1 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v6.0.1

This release fixes the following potential DoS vulnerabilities:

 - File extraction limits were not correctly enforced for files
   containing large amounts of missing bytes.

 - Sessions are sometimes not cleaned up completely within Zeek
   during shutdown,
   potentially causing a crash when using the -B dpd flag for debug logging.

 - A specially-crafted HTTP packet can cause Zeek's filename
   extraction code to take a long time to process the data.

 - A specially-crafted series of FTP packets made up of a CWD request
   followed by a large amount of ERPT requests may cause Zeek to
   spend a long time logging the commands.

 - A specially-crafted VLAN packet can cause Zeek to overflow memory
   and potentially crash.

Reported by:	Tim Wojtulewicz

security/vuxml: Document Gitea vulnerabilities

PR:		273691

security/vuxml: Document Python multiple vulnerabilities

security/vuxml: Document Go vulnerabilities

security/vuxml: add FreeBSD SA-2023:11.wifi

security/vuxml: add FreeBSD SA-23:10.pf

security/vuxml: Document possible bypassing ACL configuration in redis

security/vuxml: add www/*chromium < 116.0.5845.179

Obtained from:	https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop.html

security/vuxml: Fix a typo in previous commit

security/vuxml: Document Django multiple vulnerabilities

security/vuxml: document gitlab vulnerabilities

security/vuxml: document borgbackup < 1.2.5 archive spoofing

Security:	b8a52e5a-483d-11ee-971d-3df00e0f9020
Security:	CVE-2023-36811
Security:	https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.23,
		https://github.com/electron/electron/releases/tag/v24.8.2,
		https://github.com/electron/electron/releases/tag/v25.8.0

security/vuxml: Document 18 py*-* vulnerabilities

Vulnerable Python ports discovered with pysec2vuxml.
See also: <https://github.com/HubTou/pysec2vuxml>.

PR:		270923
Co-Authored by:	kai

security/vuxml: fix the vuxml build

Correctly spell the <cvename> entries added in d6f580f7470f.

Pointy hat to:	philip

security/vuxml: catch up with recent FreeBSD SAs

Add FreeBSD SAs issued since FreeBSD-SA-22:13.zlib in August 2022.

2022-11-15  FreeBSD-SA-22:14.heimdal
2022-11-29  FreeBSD-SA-22:15.ping
2023-02-08  FreeBSD-SA-23:01.geli
2023-02-16  FreeBSD-SA-23:02.openssh
2023-02-16  FreeBSD-SA-23:03.openssl
2023-06-21  FreeBSD-SA-23:04.pam_krb5
2023-06-21  FreeBSD-SA-23:05.openssh
2023-08-01  FreeBSD-SA-23:06.ipv6
2023-08-01  FreeBSD-SA-23:07.bhyve
2023-08-01  FreeBSD-SA-23:08.ssh
2023-08-01  FreeBSD-SA-23:09.pam_krb5

security/vuxml: add www/*chromium < 116.0.5845.140

Obtained from:	https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_29.html

security/vuxml: Document gitea -- information disclosure

PR:		273379

security/vuxml: add www/*chromium < 116.0.5845.110

Obtained from:	https://chromereleases.googleblog.com/2023/08/chrome-desktop-stable-update.html

security/vuxml: fix an error in the previous commit

<package> tag was wrongly formatted.

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v22.3.22,
		https://github.com/electron/electron/releases/tag/v24.8.1,
		https://github.com/electron/electron/releases/tag/v25.7.0

security/vuxml: add phpmyfaq < 3.1.16

security/vuxml: add www/*chromium < 116.0.5845.96

Obtained from:	https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html

security/vuxml: Document 2023Q3 MySQL vulnerabilities

security/vuxml: Document two vulnerabilities in ClamAV