security/vuxml 1.1_6

Document mozilla vulnerabilities

Document vulnerablities in php for CVE-2015-0235 and CVE-2015-0273.

Approved by:	zi (mentor)

Document bugs fixed in krb5 1.11.6.

* Handle certain invalid RFC 1964 GSS tokens correctly to avoid
  invalid memory reference vulnerabilities.  [CVE-2014-4341
  CVE-2014-4342]

* Fix memory management vulnerabilities in GSSAPI SPNEGO.
  [CVE-2014-4343 CVE-2014-4344]

* Fix buffer overflow vulnerability in LDAP KDB back end.
  [CVE-2014-4345]

* Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354 CVE-2014-5353]

* Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-9421 CVE-2014-9422
  CVE-2014-9423]

Security:	CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344
		CVE-2014-4345, CVE-2014-5354, CVE-2014-5353, CVE-2014-5352
		CVE-2014-9421, CVE-2014-9422, CVE-2014-9423

Document Samba remote code execution vulnerability.

Record two e2fsprogs vulnerabilities.CVE-2015-0247     <URL:http://vuxml.freebsd.org/0f488b7b-bbb9-11e4-903c-080027ef73ec.html>

Topic: e2fsprogs -- potential buffer overflow in closefs()
    Affects:
        e2fsprogs < 1.42.12_2
	References:
	    url:http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73
	        cvename:CVE-2015-1572
		<URL:http://vuxml.freebsd.org/2a4bcd7d-bbb8-11e4-903c-080027ef73ec.html>

Security:	CVE-2015-0247
Security:	CVE-2015-1572
Security:	0f488b7b-bbb9-11e4-903c-080027ef73ec
Security:	2a4bcd7d-bbb8-11e4-903c-080027ef73ec.html

Document BIND DoS issue with trust anchor management.

Kerberos Version 5, Release 1.12.3 is released affecting security/krb5-112. This fixes multiple vulnerabilities, some previously committed by point patches and others newly fixed in this release.

* Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354] [CVE-2014-5353]

* Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421
  CVE-2014-9422 CVE-2014-9423]

Security:	CVE-2014-5354, CVE-2014-5353
Security:	CVE-2014-5352, CVE-2014-5352, CVE-2014-9421
Security:	CVE-2014-9422, CVE-2014-9423

Document unzip heap based buffer overflow in iconv patch.

PR:		ports/197772

Add modified date to entries I touched recently.

Noticed by:	kwm (thanks)

Add CVE number to asterisk advisory.

Backported patches for CVE-2014-5353 and CVE-2014-5354 received from MIT for krb5-111 and krb5-112.

Obtained from:	Greg Hudson <ghudson@mit.edu>
Security:	CVE-2014-5353, CVE-2014-5354

- Additional fixes from the krb5 commit

- Correct errors in previous commit to resolve build

Document new krb5 vulnerabilities.

Security:	CVE-2014-5353, CVE-2014-5354

The xorg-server entry in commit 378888, also mention portepoch for the other version we want to check.

Document xorg-server CVE-2015-0255.

Information leak in the XkbSetGeometry request of X servers

In r378499, PostgreSQL package names where not version-suffixed. Fixed this. Submitted by:	kuriyama@

Fix CVE name for www/chromium entry

Submitted by:	bz via bot

Document two recent OpenLDAP DoS issues.

Document new vulnerabilities in www/chromium < 40.0.2214.111

Submitted by:	Carlos Jacobo Puga Medina
Obtained from:	http://googlechromereleases.blogspot.nl/

Update PostgreSQL-9.x to latests versions.

This update fixes multiple security issues reported in PostgreSQL over the past
few months. All of these issues require prior authentication, and some require
additional conditions, and as such are not considered generally urgent.
However, users should examine the list of security holes patched below in case
they are particularly vulnerable.

Security:	CVE-2015-0241,CVE-2015-0242,CVE-2015-0243,
		CVE-2015-0244,CVE-2014-8161

Remove 734bcd49-aae6-11e4-a0c1-c485083ca99c because Adobe Flash Player 11.x isn't affected.  See February 2 revision of https://helpx.adobe.com/security/products/flash-player/apsa15-02.html

Add the following KRB5 CVEs.

CVE-2014-5352: gss_process_context_token() incorrectly frees context

CVE-2014-9421: kadmind doubly frees partial deserialization results

CVE-2014-9422: kadmind incorrectly validates server principal name

CVE-2014-9423: libgssrpc server applications leak uninitialized bytes

Security:	CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423

Document unzip out of boundary access issues in test_compr_eb.

PR:		ports/197300

Add linux-f10-devtools (any version) and linux-c6-devtools (prior to 6.6_3) to the CVE-2015-0235 entry from 2015-01-28.

Approved by:	swills (mentor)

Add net-mgmt/xymon-server CVE-2015-1430

www/linux-*-flashplugin11: Add CVE-2015-0313

Spotted by:	kwm
Approved by:	swills (mentor)

Add CVE-2015-0862 for net/rabbitmq.

- document apache24 issues

Document asterisk security issues.

While here, add CVE number to a previous asterisk entry.

Add CVE-2015-0235.

- Affects linux_base-*

Approved by:	so@ (des)

Document critical Adobe Flash Player vulnerability (CVE-2015-0311)

- document bugzilla security issues

- Fix description of 9c7b6c20-a324-11e4-879c-00e0814cab4e

Document Django 2014-01-13 vulnerabilty

Add a note about the just-fixed vulnerability of applications using net/libutp.

PR:		196351
Differential Revision:	D1575
Submitted by:	Jan Beich
Approved by:	bapt

Amend linux-c6-openssl version in OpenSSL entry from 2015-01-08.

Approved by:	swills (mentor)

Add CVE-2015-0206 description for LibreSSL port.

Document Adobe Flash Player vulnerabilities

Document new vulnerabilities in www/chromium < 40.0.2214.91

Also affects FFmpeg, ICU, DOM but the links on the webpage all result in a 403.

Obtained from:	http://googlechromereleases.blogspot.nl

security/vuxml: - Document security/polarssl and security/polarssl13 crafted certificates   vulnerability (CVE-2015-1182)

Document multiple archivers/unzip vulnerabilities (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141).

PR:		196777 (based on)
Submitted by:	rsimmons0@gmail.com

Add description of CVE-2014-8143 in net/samba4 and net/samba41

Add entry for CVE-2013-7252 in x11/kde4-runtime.

Document mozilla vulnerabilities

Add vuln.xml entry for libevent CVE-2014-6272

PR:	ports/199640

- Fix more typo

- Fix typo

- Document cURL URL request injection vulnerability (CVE-2014-8150)

Document webkit-gtk[23] vulnabilities.