security/vuxml 1.1_6

phpMyAdmin: document PMASA-2017-8 -- bypass restrictions on 'no password' accounts.

Document hostapd vulnerabilities

PR:		217906

Add entry about Samba vulnerability CVE-2017-2619

Security:	CVE-2017-2619

Document Xen Security Advisory (XSA 211)

Security:	CVE-2016-9603
Security:	https://vuxml.FreeBSD.org/freebsd/af19ecd0-0f6a-11e7-970f-002590263bf5.html

Add CVE ID for recent irssi vulnerability

PR:		217878
Submitted by:	dor.bsd@xm0.uk (irssi mainainer)

Update hostapd on two older entries.

Fixes were not backported prior. Recent update is v2.6 as noted in advisory.

Security:	CVE-2015-5310
Security:	CVE-2015-5315
Security:	CVE-2015-5316
Security:	CVE-2016-4476
Security:	CVE-2016-4477
Security:	https://vuxml.FreeBSD.org/freebsd/967b852b-1e28-11e6-8dd3-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/976567f6-05c5-11e6-94fa-002590263bf5.html

Document use-after-free vulnerability in irc/irssi

PR:		217878

security/vuxml: Add DoS vuln for mysql-client

- Fix typo in 5f453b69-abab-4e76-b6e5-2ed0bafcaee3 while here

security/vuxml: mark firefox < 52.0.1 as vulnerable

Note, sandboxing isn't implemented on FreeBSD.

Document Moodle security advisories from January (MSA-17-0001 - MSF-17-0004) and March releases (details not yet released).

Security:	CVE-2017-2576
Security:	CVE-2017-2578
Security:	CVE-2016-10045
Security:	https://vuxml.FreeBSD.org/freebsd/f72d98d1-0b7e-11e7-970f-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/df45b4bd-0b7f-11e7-970f-002590263bf5.html

Fix incorrect PKGNAME in www/tomcat6 entries. It's been tomcat since r238618.

Pointy hat to:	junovitch (for most of them)

- Document multiple vulnerabilities in www/drupal8

Security:	CVE-2017-6377
Security:	CVE-2017-6379
Security:	CVE-2017-6381
Security:	2730c668-0b1c-11e7-8d52-6cf0497db129

Document PuTTY < 0.68 agent forwarding vuln.

Security:	CVE-2017-6542
Security:	9b973e97-0a99-11e7-ace7-080027ef73ec

Document latest Flash Player vulnerabilities.

Security:	https://helpx.adobe.com/security/products/flash-player/apsb17-07.html

Attempt to fix vuxml build.

Sponsored by:	The FreeBSD Foundation

security/vuxml: modify most recent mariadb entries

- ChangeLog of 10.0.30 and 10.1.22 refer to CVE-2017-3313

Security:	4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf
Security:	CVE-2017-3313

Document mbed TLS Security Advisory 2017-01

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01

Document new vulnerabilities in www/chromium < 57.0.2987.98

Obtained from:	https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html

Document several security defects in the Bouncy Castle Crypto APIs

PR:		215507
Approved by:    vsevolod (mentor)
Obtained from:  https://www.bouncycastle.org/releasenotes.html
Security:       https://vuxml.FreeBSD.org/freebsd/89cf8cd2-0698-11e7-aa3f-001b216d295b

Add entry for CVE-2016-7787 in x11/kde4-runtime.

Security announcement:
https://www.kde.org/info/security/advisory-20160621-1.txt

Add entry for KTNEF directory traversal issue in deskutils/kdepimlibs4.

There is no CVE assigned at the moment.
More information: https://www.kde.org/info/security/advisory-20170227-1.txt

Adress CVE-2017-6410 in devel/kf5-kio and x11/kdelibs4

Using a malicious PAC file, and then using exfiltration methods in the PAC
function FindProxyForURL() enables the attacker to expose full https URLs.

This is a security issue since https URLs may contain sensitive
information in the URL authentication part (user:password@host), and in the
path and the query (e.g. access tokens).

This attack can be carried out remotely (over the LAN) since proxy settings
allow ``Detect Proxy Configuration Automatically''
This setting uses WPAD to retrieve the PAC file, and an attacker who has access
to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
and inject his/her own malicious PAC instead of the legitimate one.

Reviewed by:	mat, rakuco
Approved by:	rakuco (mentor), mat (mentor)
Obtained from:	https://marc.info/?l=kde-announce&m=148831226706885&w=2
MFH:		2017Q1
Security:	CVE-2017-6410
Differential Revision:	https://reviews.freebsd.org/D9908

Document wordpress security issues

PR:       217608, 217598
Security: https://vuxml.FreeBSD.org/freebsd/82752070-0349-11e7-b48d-00e04c1ea73d.html

security/vuxml: mark firefox < 52 as vulnerable

Document security issues fixed in CodeIgniter 3.1.3

Security:	https://vuxml.FreeBSD.org/freebsd/71ebbc50-01c1-11e7-ae1b-002590263bf5.html

Fix PORTEPOCH on Chicken VuXML entry; also additional CVE affecting Chicken

PR:		216661
Reported by:	sevan, Vitaly Magerya
Security:	CVE-2016-9954
Security:	https://vuxml.FreeBSD.org/freebsd/c6932dd4-eaff-11e6-9ac1-a4badb2f4699.html

Add missing reference to last commit for ikiwiki vulnerabilities

PR:		216665
Reported by:	sevan
Security:	CVE-2016-9646
Security:	https://vuxml.FreeBSD.org/freebsd/5ed094a0-0150-11e7-ae1b-002590263bf5.html

Document ikiwiki vulnerabilities

PR:		216665
Reported by:	sevan
Security:	CVE-2016-9645
Security:	CVE-2016-10026
Security:	CVE-2017-0356
Security:	https://vuxml.FreeBSD.org/freebsd/5ed094a0-0150-11e7-ae1b-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/7b35a77a-0151-11e7-ae1b-002590263bf5.html

Document multiple memory failure in potrace

PR:		217347
Reported by:	lightside

Document buffer overflows in audio/musicpd http output module

Add linux-*-openssl to recent openssl vulnerabilities.

Security:	https://rhn.redhat.com/errata/RHSA-2017-0286.html

security/vuxml: curl only vulnerable >= 7.52.0

security/vuxml: Document cURL vulnerability

Document Xen Security Advisory (XSA 209)

Reported by:	royger
Security:	CVE-2017-2620
Security:	https://vuxml.FreeBSD.org/freebsd/8cbd9c08-f8b9-11e6-ae1b-002590263bf5.html

Document information disclosure vulnerability on fbsdmon

PR:             217099
Submitted by:   asomers

security/vuxml: chase r434427

$ svn ci -F libevent-rename.msg
[...]
svn: E165001: Commit failed (details follow):
svn: E165001: Commit blocked by pre-commit hook (exit code 1) with output:
Commit to security/vuxml/vuln.xml first, and then other files

PR:		216777

Document multiple vulnerabilities in audio/wavpack

PR:		216847
Submitted by:	pkubaj@anongoth.pl

Document multiple vulnerabilities in optipng.

PR:		216955
Submitted by:   Thomas Hurst <tom@hur.st> (affected port maintainer)

Complete PKGNAMEPREFIX of py-diffoscope

security/vuxml: Document openssl-devel vulnerability

- While here fix whitespace on 077bbadf-f2f4-11e6-92a7-902b34361349

Document arbitrary file write in diffoscope < 76

Reported by:	koobs (via Debian bug report)
Reviewed by:	delphij
Approved by:	delphij
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D9598

Document heap overflow in multimedia/ffmpeg < 3.2.4

Document gtk-vnc bounds checking vulnabilities

Security:	CVE-2017-5884, CVE-2017-5885

Document Xen Security Advisory (XSA 208)

Reported by:	royger
Security:	CVE-2017-2615
Security:	https://vuxml.FreeBSD.org/freebsd/a73aba9a-effe-11e6-ae1b-002590263bf5.html

List all linux package names in latest libtiff vulnerability.

Undocument a linux-*-curl vulnerability that has low impact and Red Hat "will not fix".

Security:	https://access.redhat.com/security/cve/CVE-2016-0755

Document libtiff vulnerabilities.

Security:	http://simplesystems.org/libtiff/v4.0.7.html

Document mantis vulnerability

PR:		216662
Security:	CVE-2016-6837

Document vulnerabilities in guile2

PR:		216663
Security:	CVE-2016-8605 CVE-2016-8606

Document vulnerabilities in chicken

PR:		216661
Security:	CVE-2016-6830 CVE-2016-6831