security/vuxml 1.1_6

Document affected FreeBSD versions for recent OpenSSL vulnerabilities

Remove extra / invalid CVE entry for OpenSSL

Update range of vulnerable irssi versions

security/vuxml: Add new OpenSSL 1.0.2 and 1.1.0 vulnerabilities

- 2016-09-22 security advisory

Document that chinese/irssi is vulnerable as well

Document irssi vulnerabilities

PR:		212888
Security:	CVE-2016-7044
Security:	CVE-2016-7045

Document recent Firefox vulnerabilities

security/vuxml: Fix curl version ranges

Document new vulnerabilities in www/chromium < 53.0.2785.113

Obtained from:	https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html

Document CVE 2016-6662: zero-day remote vulnerability in mysql ports

PR:		212612
Submitted by:	mokhi64@gmail.com (mysql57-* maintainer)
Reported by:	rootservice@gmail.com
Security:	CVE 2016-6662

Document security problems in dropbear

PR:		212699
Submitted by:	pkubaj@anongoth.pl

security/vuxml: Document www/h2o vulnerability

PR:		211892
Submitted by:	Dave Cottlehuber <dch@skunkwerks.at> (maintainer)
Reviewed by:	brnrd
MFH:		2016Q3
Security:	08664d42-7989-11e6-b7a8-74d02b9a84d5

ftp/curl: Document integer overflow vuln

Add vulnerabilities for www/chromium < 53.0.2785.92

Obtained from:	https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html

Belatedly add vulnerabilities for www/chromium < 52.0.2743.116

Obtained from:	https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html

Document MySQL root code execution vulnerability.

Fix build.

Sponsored by:	The FreeBSD Foundation

Document WolfSSL vulnerabilities (< 3.6.8)

PR:		205936
Submitted by:	Christoph Moench-Tegeder

Add entry for GNUTLS-SA-2016-3.

document mozilla vulnerabilities (<48, <45.3esr)

PR:		212463
Approved by:	jbeich (maintainer), rene (mentor)

Document asterisk vulnerabilities.

- Add linux-*-tiff information to existing tiff vulnerabilities. - Like r419692, cancel a gif2tiff vulnerability that upstream marked   WONTFIX: http://bugzilla.maptools.org/show_bug.cgi?id=2536

PR:		211552

Document vulnerability in irc/inspircd

No CVEs have been assigned at this time.

Add CVE-2016-7123 for resolved mailman CSRF.

PR:		212378
Reported by:	Sevan Janiyan
Security:	CVE-2016-7123
Security:	9e50dcc3-740b-11e6-94a2-080027ef73ec

Fix the version range for a linux-c6-nss vulnerability.

PR:		208385

Fix build.

Sponsored by:	The FreeBSD Foundation

Document OpenSSH CVE-2015-8325 and CVE-2016-6210 fixed in OpenSSH 7.3p1.

PR:		212275
Reported by:	<Sevan Janiyan> venture37@geeklan.co.uk
Security:	CVE-2015-8325
Security:	CVE-2016-6210

Document mailman < 2.1.23 CVE-2016-6893, insufficient CSRF protection.

Document libxml2 vulnabilities.

Document kdelibs KArchive directory traversal vulnerability.

Approved by: rakuco (mentor)
Security: CVE-2016-6232

Docuement eog out of bounds write.

Security:	CVE-2016-6855

Some more cleanup to Perl vulnerabilities.

Sponsored by:	Absolight

Document fontconfig insufficiently cache file validation

Security:	CVE-2016-5384

Fix ruby version range which was missing the important portepoch

Add postgres and mysql to the EoL port list

PR:		211975

Fix PKGNAME matching for old ruby in vuxml

PR:		211975

Fixup Perl package names in the EoL vuln.

Sponsored by:	Absolight

unbreak build (validation and tests pass)

Reported by:	feld
With hat:	ports-secteam

Add a number of old expired and End of Life ports to vuxml

PR:		211975

Fix CVE name for security/gnupg and security/libgcrypt.  There was a typo in the official release announcement.

Register recent gnupg1/libgcrypt vuln.

Document 26 new security advisories from phpmadmin.  Some of these are described as 'critical'.

Note where the XSLoader thing is being fixed in Perl 5.18 and 5.20.

Sponsored by:	Absolight

security/vuxml: Fix/Improve a few entry titles (<topic)

- TeamSpeak 3 Server: Use standard "Product -- Description" title format
 - TeamSpeak 3 Server: Include RCE in title so people dont miss it. Importante.
 - puppet-agent MCollective: Remove duplicate name in title, use software name
 - FreeBSD ntp entry: Fix grammo

audio/teamspeak3-server: Document remote code execution

PR:		211846
Security:	http://seclists.org/fulldisclosure/2016/Aug/61
Submitted by:	Ultima1252@gmail.com

Fix PKGNAME for collectd5

PR:		211613

Add entry for CVE-2015-7331

mcollective-puppet-agent -- Remote Code Execution in mcollective-puppet-agent plugin

Fix the perl5* section for the two recent vuln.

For some reason, perl5-devel was having a wrongly special treatment, and
it was failing to take into account the fact that we've had 5.21 and
5.23 in the tree.
Also, correct the version at which the XSLoader thing was solved in 5.25.

Sponsored by:	Absolight

The perl5 release candidate versions also address the XSLoader local arbitrary code execution vulnerability (CVE-2016-6185), as documented in perldelta(1)

So perl5.22-5.22.3.r2 and perl5.24-5.24.1.r2 are not vulnerable.

I can't confirm if the updates to perl5.18 and perl5.20 also solve the
XSLoader bug or not but by inspection of the source code, I don't
believe that to be the case.

Correct the syntax for the <freebsdsa> entries.

They should not be prefixed with FreeBSD-

Correct old vuxml entries for FreeBSD that use <ge>0</ge> or a <ge> without an <le>

One entry has been cancelled in preference of a much newer entry referring to
the same CVE as it has more detail.