security/vuxml 1.1_6

Add entry for www/gitea

PR:		236563

security/vuxml: mark firefox < 66 as vulnerable

Document PowerDNS issue

PR:		236634
Reported by:	Dani <i.dani@outlook.com>

Document Rails vulnerability

Record PuTTY security vulnerabilities in versions before 0.71.

Document py-notebook vulnerability

Document ruby-gems vulnerability

Document CVE fixes in libsndfile-1.0.28_2

PR:		227669
Reported by:	p5B2E9A8F@t-online.de

Fill in the actual URL for March 2019 ntp-4.2.8p13 NTP Release and Security Vulnerability Announcement

security/vuxml: Document OpenSSL 1.1.1 vulnerability

Document crafted ull dereference ntp attack.

Security:	CVE-2019-8936
Obtained from:	nwtime.org

security/vuxml: Document shells/rssh < 2.3.4_2 vulnerabilities

PR:		235121
Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D19473

Document a jQuery related XSS security fix in rt4.4.4 and rt4.2.16

Note: the release notes also mention 3 other security issues in perl
modules depended on by these packages.  Of those, vulnerabilities in
the Email::Address and Email::Address::List perl modules have already
been addressed in their respective ports, while the third: HTML::Gumbo
is not currently in the ports at all.

Document a slixmpp < 1.4.1 vulnerability

Reviewed by:	krion, mat
Approved by:	krion (mentor), mat (mentor)
MFH:		2019Q1

Doucumented several www/gitlab-ce security vulnerabilities.

Document www/py-gunicorn vulnerability

Update mybb entry

Sponsored by:	Netzkommune GmbH

security/vuxml: document Node.js February 2019 Security Releases

https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/

Sponsored by:	Miles AS

Document vulnerability in www/mybb

Sponsored by:	Netzkommune GmbH

Document new asterisk vulnerability.

Security:	CVE-2019-7251

security/vuxml: Update OpenSSL 1.0.2r entry

Document webkit-gtk CVE's

Security:	CVE-2019-6212, CVE-2019-6215, CVE-2019-6216, CVE-2019-6217, \
		CVE-2019-6226, CVE-2019-6227, CVE-2019-6229, CVE-2019-6233, \
		CVE-2019-6234.

security/vuxml: dokument rdesktop < 1.8.4 vulnerabilities

PR:		235885, 229029

Document sysutils/puppetserver* vulnerabilities.

PuppetServer bundles Bouncy Castle, so add affected ports to the Bouncy Castle
entry.

sysutils/puppetserver is EOL and will likely never get a fix;
sysutils/puppetserver5 may get fixed in a future release of the 5.x branch;
sysutils/puppetserver6 was fixed in the latest release.

With hat:	puppet

- Add drupal8 vulnerability entry

security/vuxml: Document announced OpenSSL vulnerability

- To be updated with more specifics on 2019-02-26

Document mail/msmtp certificate verification issue

fix firefox-esr PORTEPOCH in latest entry

Submitted by:	jbeich

add more mozilla products to latest entry

https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/
(same CVEs as mfsa2019-04, so not creating another entry)

document firefox vulnerabilities

https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb19-06.html

Fix r492723 for the name of NVD report

Update openjpeg status

There were 5 vulnerabilities in openjpeg and 4 of them are fixed.
The current status  is described in [1] as follows:
- CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.
- CVE-2018-5785 was fixed in r480624.
- CVE-2018-6616 was fixed in r489415.
- CVE-2018-5727 is not fixed yet.

Though I keep committing fixes and updating the status, it does not show in the
"pkg audit" result. Users have to follow the link but apparently few people
would do that. Therefore, I got mails asking if the CVEs are fixed, etc.

I don't know if there's a better way to handle this condition (partly fixed over
several months). Instead of removing fixed CVEs from vuln.xml, I decided to add
a new entry (5efd7a93-2dfb-11e9-9549-e980e869c2e9) which is split from the old
entry (11dc3890-0e64-11e8-99b0-d017c2987f9a). It should be clearer for users if
they only read the "pkg audit" result.

[1] https://www.vuxml.org/freebsd/11dc3890-0e64-11e8-99b0-d017c2987f9a.html

Document FreeBSD-SA-19:02.fd

Document FreeBSD-SA-19:01.syscall

Document kf5-kauth vulnerability.

Update versions range for recent unit vulnerability.

Document unit vulnerability.

Document curl vulnerability

Document gitlab-ce vulnerability.

mail/dovecot: update reporter for latest vuln

mail/dovecot: Suitable client certificate can be used to login as other user

update vuxml

Document typo3 vulnerability

PR:		235187, 235188

security/vuxml: Document Gitea < 1.7.1 vulnerabilities

PR:		235399
Submitted by:	stb@lassitu.de (www/gitea maintainer)

Document vulnerability addressed by release 0.06 of p5-Email-Address-List

Unfortunately there is very little real description of the
vulnerability available, other than what is in the changelog.  Even
the CVE number only leads to a page saying the number is reserved.

Documented multiple vulnerabilities for www/gitlab-ce.

security/vuxml: document vulnerabilities in net/turnserver

Sponsored by:	Miles AS

security/vuxml: mark firefox < 65 as vulnerable

Document powerdns-recursor issue

PR:		235113
Submitted by:	Ralf van der Enden <tremere@cainites.net>

Update py-requests entry

Reference:	https://lists.freebsd.org/pipermail/svn-ports-head/2019-January/198601.html