security/vuxml 1.1_6

- add CVE entries for saltstack

Fix the redis5 affected versions.

Document vault issue

security/vuxml: add FreeBSD SA-21:04.jail_remove

security/vuxml: add FreeBSD SA-21:06.xen

security/vuxml: add FreeBSD SA-21:05.jail_chdir

security/vuxml: add FreeBSD SA-21:03.pam_login_access

Document integer overflow on 32-bit systems (CVE-2021-21309): o) databases/redis5 o) databases/redis o) databases/redis-devel

security/vuxml: Mark zeek < 3.0.13 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v3.0.13

Fix ASCII Input reader's treatment of input files containing
null-bytes. An input file containing null-bytes could lead to a
buffer-over-read, crash Zeek, and be exploited to cause Denial of
Service.

Add vuxml entry for textproc/raptor2 CVE

PR:		251102

Connect vuln-2020.xml (2/2)

Connect vuln-2020.xml (1/2)

Split out vuln-2020.xml

Document  Jenkins Security Advisory 2021-02-19

Sponsored by:	The FreeBSD Foundation

Report new asterisk vulnerabilities.

security/openssl-devel: Mark vulnerable CVE-2021-23841

MFH:		2021Q1
Security:	96a21236-707b-11eb-96d8-d4c9ef517024

Document rails vulnerability

Document new vulnerabilities in www/chromium < 88.0.4324.182

Obtained from:	https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html

security/vuxml: Document OpenSSL 1.1.1i vulnerabilities

openexr/ilmbase < v2.5.5 security vulnerabilities

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.5

Security:	98044aba-6d72-11eb-aed7-1b1b8a70cc8b

Document gitlab vulnerabilities.

Add security/vuxml entry for CVE-2021-21291 affecting www/oauth2-proxy < 7.0.0.

While I'm here, fix formatting for mod_dav_svn CVE-2020-17525 vuxml entry,

MFH:		2021Q1

Fix build.

Sponsored by:	Rubicon Communications, LLC ("Netgate")

Document https://subversion.apache.org/security/CVE-2020-17525-advisory.txt.

security/vuxml: Add entry for gitea < 1.13.2

PR:		253295
Submitted by:	maintainer

Document new vulnerability in www/chromium < 88.0.4324.150

Obtained from:	https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html

Document new vulnerabilities in www/chromium < 88.0.4324.146

Obtained from:	https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html

Document gitlab-ce vulnerabilities.

Document minio issue

security/vuxml: add FreeBSD SA-21:02.xenoom

security/vuxml: add FreeBSD SA-21:01.fsdisclosure

security/vuxml: Document graphics/pngcheck vulnerability

PR:			253019
Approved by:		fernape (mentor)
Differential Revision:	https://reviews.freebsd.org/D28308

Document sudo CVE-2021-3156.

* When invoked as sudoedit, the same set of command line options
   are now accepted as for "sudo -e".  The -H and -P options are
   now rejected for sudoedit and "sudo -e" which matches the sudo
   1.7 behavior.  This is part of the fix for CVE-2021-3156.

 * Fixed a potential buffer overflow when unescaping backslashes
   in the command's arguments.  Normally, sudo escapes special
   characters when running a command via a shell (sudo -s or sudo
   -i).  However, it was also possible to run sudoedit with the -s
   or -i flags in which case no escaping had actually been done,
   making a buffer overflow possible.  This fixes CVE-2021-3156.

PR:		253034
Reported by:	"Todd C. Miller" <Todd.Miller@sudo.ws> via mailing list
		emaste
Obtained from:	sudo

Document py-pysaml2 vulnerability

Document Jenkins Security Advisory 2021-01-26

Sponsored by:	The FreeBSD Foundation

Rework vuxml a bit to make them validable again

modify tidy.xsl to make it generates manually the xml declaration
xsl is not able to generate a list of entity otherwise.

Remove copyright form included files, they are redudundant anyway and
in the end only the vuln.xml file is distribued with entities expanded

Rework a bit the entity declaration in order for the document to look
great after expansion (as it did before we introduced the expansion
mechanism)

All validation are now processed direcly on the flattened file.

This is based on a patch from mfechner here

Submitted by:		mfechner
Differential Revision:	https://reviews.freebsd.org/D28299

Rework the entity declaration

when expanded they will look better (as when the file was not split)

While here cleanup some indentation

Fix indentation

security/vuxml: Document mail/mutt vulnerability

Document mail/mutt vulnerability CVE-2021-3181

PR:		252931
Submitted by:	Derek Schrock <dereks@lifeofadishwasher.com>
Reported by:	Derek Schrock <dereks@lifeofadishwasher.com>
Reviewed by:	osa (mentor)
Approved by:	osa (mentor)
Differential Revision:	https://reviews.freebsd.org/D28308

Fix build.

Sponsored by:	Rubicon Communications, LLC ("Netgate")

security/vuxml: Add new MySQL vulnerabilities

Document new vulnerabilities in www/chromium < 88.0.4324.96

Obtained from:	https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html

Document CVE-2020-15983 for games/chocolate-doom and games/crispy-doom

Made clear how to test now entries against the newly formatted file.

Fix build.

Yes, please do FIXME.

Sponsored by:	Rubicon Communications, LLC ("Netgate")

Added security vulnerability for rubygem-nokogiri.

Split vuln.xml file [2/2]

The vuln.xml file has grown a lot since 2003. To avoid having to unlock
the svn size limitation, the file is now split into 1 file per year up
to the current year + previous one. The split is made based on the date
when the entry has been added.

In order to achieve the split without breaking any consumer we use a standard
XML mechanism via the definition of entities.

While here add a new target make vuln-flat.xml which will expand the entities
in order to be able to regenerate a one uniq file if needed. This useful to for
example allow to test with pkg audit directly given the XML parser used in pkg
does not support custom entities.

The vuxml web site generator has been modified to ensure the vuln.xml file it
provides is the expanded version, so for consumers it is still only one single
file to download.

Split vuln.xml file [1/2]

The vuln.xml file has grown a lot since 2003. To avoid having to unlock
the svn size limitation, the file is now split into 1 file per year up
to the current year + previous one. The split is made based on the date
when the entry has been added.

In order to achieve the split without breaking any consumer we use a standard
XML mechanism via the definition of entities.

While here add a new target make vuln-flat.xml which will expand the entities
in order to be able to regenerate a one uniq file if needed. This useful to for
example allow to test with pkg audit directly given the XML parser used in pkg
does not support custom entities.

The vuxml web site generator has been modified to ensure the vuln.xml file it
provides is the expanded version, so for consumers it is still only one single
file to download.

dns/dnsmasq-devel: mark stale name vulnerable, too

dnsmasq-devel isn't currently in ports, but if someone never
switched to dnsmasq, we should also flag the older dnsmasq-devel
vulnerable.

Security:	5b5cf6e5-5b51-11eb-95ac-7f9491278677

dns/dnsmasq < 2.83 vulnerabilities (buffer overflow, DNS cache poisoning)

Security:	5b5cf6e5-5b51-11eb-95ac-7f9491278677
Security:	CVE-2020-25684
Security:	CVE-2020-25685
Security:	CVE-2020-25686
Security:	CVE-2020-25681
Security:	CVE-2020-25682
Security:	CVE-2020-25683
Security:	CVE-2020-25687