security/vuxml: Document CVE-2021-33896 in net-im/dino port

security/vuxml: Document CVE-2021-3515 for databases/pglogical

A shell injection flaw was found in pglogical in versions before 2.3.4
and before 3.6.26. An attacker with CREATEDB privileges on a
PostgreSQL server can craft a database name that allows execution of
shell commands as the postgresql user when calling
pglogical.create_subscription().

security/vuxml: add www/drupal7 CVE

security/vuxml: document vulnerability in sysutils/polkit

Cedric Buissart reports:

	The function `polkit_system_bus_name_get_creds_sync` is used to get the
	uid and pid of the process requesting the action. It does this by
	sending the unique bus name of the requesting process, which is
	typically something like ":1.96", to `dbus-daemon`. These unique names
	are assigned and managed by `dbus-daemon` and cannot be forged, so this
	is a good way to check the privileges of the requesting process.

	The vulnerability happens when the requesting process disconnects from
	`dbus-daemon` just before the call to
	`polkit_system_bus_name_get_creds_sync` starts. In this scenario, the
	unique bus name is no longer valid, so `dbus-daemon` sends back an error

security/vuxml: Document CVE-2021-33054 for www/sogo*.

PR:		256374
Reported by:	rob2g2 <spam123@bitbert.com>

security/vuxml: Add CVE-2020-8492 for lang/tauthon

PR: 256387
Reported by:	olivier.freebsd@free.fr

security/vuxml: Document CVE-2021-28091 for security/lasso.

PR:		256373
Reported by:	spam123@bitbert.com

security/vuxml: Document lang/go vulnerabilities

security/vuxml: document aiohttp CVE-2021-21330

security/vuxml: Mark zeek < 4.0.2 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v4.0.2

 - Fix potential Undefined Behavior in decode_netbios_name() and
   decode_netbios_name_type() BIFs. The latter has a possibility
   of a remote heap-buffer-overread, making this a potential DoS
   vulnerability.

 - Add some extra length checking when parsing mobile ipv6 packets.
   Due to the possibility of reading invalid headers from remote
   sources, this is a potential DoS vulnerability.

security/vuxml: add entry for PyYAML CVE-2020-14343

PR:		256220

security/vuxml: Fix overly large entry that violates 'make validate'

security/vuxml: Document isc-dhcp44-* vulnerability

PR:		256377

security/vuxml: Document gitlab vulnerabilities.

security/vuxml: Correct CVE entry for the x11/libX11 vulnerability

security/vuxml: document vulnerability in databases/redis

Security:	CVE-2021-32625

security/vuxml: Document vulnerability in x11/libX11

PR:		256034
Security:	CVE-2021-31535

security/vuxml: Document vulnerability in net-mgmt/prometheus2

PR:		255976
Security:	CVE-2021-29622
Approved by:	lwhsu (mentor)

security/vuxml: Document graphics/wayland <= 1.19.0

security/vuxml: add FreeBSD SA-21:12.libradius

security/vuxml: add FreeBSD SA-21:11.smap

vuln.xml: Document chromium < 91.0.4472.77

Obtained
from:	https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html

security/vuxml: Document net/libzmq4 issues

PR:		255102
Reported by:	Thomas Petig <thomas@petig.eu>
Security:	CVE-2019-13132
Security:	CVE-2020-15166

security/vuxml: document vulnerability in www/nginx and www/nginx-devel

Security:	CVE-2021-23017

databases/pg_partman: arbitrary code execution

Security:	CVE-2021-33204

security/vuxml: document vulnerability in texptroc/expat2

Security:	CVE-2013-0340
PR: 		256121

security/vuxml: document vulnerability in texptroc/libxml2

PR:		256093
Security:	CVE-2021-3541

security/vuxml: Add example cvename tag to template

Reviewed by:	riggs
Approved by:	riggs (ports secteam)
Differential Revision:  https://reviews.freebsd.org/D30231

databases/postgresql??-server: multiple security issues

security/vuxml: Add entry for net-im/prosody

PR:	255845, 255849

security/vuxml: declare vulnerabilities for ImageMagick6

PR:		255818

security/vuxml: declare vulnerabilities for ImageMagick7

PR:		255802

security/vuxml: add vunerabilities fixed in 8.2.0

PR:		255361

Document vulnerabilities in Chromium < 90.0.4430.212

Obtained
from:	https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop.html

security/vuxml: Add entry for net-im/py-matrix-synapse

security/vuxml: cyrus-imapd -- Remote authenticated users could bypass intended
access restrictions on c\ertain server annotations.

security/vuxml: Document FLAC out-of-bounds read

security/vuxml: add CVE #s for OpenEXR 2.5.4 fixes

security/vuxml: Document rails vulnerability

security/vuxml: Document lang/go vulnerability

security/vuxml: Document Ansible vulnerability

security/vuxml : Document django's multiple vulnerabilities

Document Python's multiple vulnerabilities

security/vuxml: Update latest MySQL vuln entry

 * Adds CVE numbers
 * Mark MariaDB partially affected

security/vuxml: document recent vulnerabilities with redis ports.
PR:	255580

security/vuxml: Document command injection vulnerability in RDoc

PR:		255552
Reported by:	Yasuhiro Kimura <yasu@utahime.org>
Security:	CVE-2021-31799

security/vuxml: add mail/sympa CVE

PR:		252464

Add an entry about Samba vulnerability CVE-2021-20254:

Negative idmap cache entries can cause incorrect group entries in the Samba file
server process token.

PR:
Submitted by:
Reported by:
Reviewed by:
Approved by:
Obtained from:
MFC after:
MFH:
Relnotes:
Security:	CVE-2021-20254
Sponsored by:
Differential Revision:

security/vuxml: Update fixed version of openoffice-devel.

CVE-2021-30245 is fixed in version 1619649022 of
editors/openoffice-devel.

Document gitlab-ce vulnerabilities.

Document vulnerabilities for www/rubygem-carrierwave.

mail/sympa: add vuxml entry

PR:		255455
Submitted by:	Geoffroy Desvernay <dgeo@centrale-marseille.fr> (maintainer)

Document new vulns, www/chromium < 90.0.4430.93

Obtained
from:	https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html

security/shibboleth.sp: add more information to security advisory

security/shibboleth-sp: add entry for upcoming vulnerability

The details are not yet disclosed.

security/vuxml: Mark zeek < 4.0.1 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v4.0.1

Fix null-pointer dereference when encountering an invalid enum name
in a config/input file that tries to read it into a set[enum]. For
those that have such an input feed whose contents may come from
external/remote sources, this is a potential DoS vulnerability.

security/vuxml: add devel/openvpn < 2.5.2 entry

Security:	CVE-2020-15078
Security:	efb965be-a2c0-11eb-8956-1951a8617e30

Document new vulnerabilities in www/chromium < 90.0.4430.85

Obtained
from:	https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html

Another openssh version fix for CVE-2021-28041.

Reported by:	leres

Document Jenkins Security Advisory 2021-04-20

Sponsored by:	The FreeBSD Foundation

Fix openssh version in entry for CVE-2021-28041

Reported by:	leres

security/vuxml: Add MySQL vulns

security/vuxml: Document OpenOffice vulnerability CVE-2021-30245

devel/maven: update to 3.8.1

This is not just a bugfix as it contains three features that cause a change of
default behavior (external HTTP insecure URLs are now blocked by default): your
builds may fail when using this new Maven release, if you use now blocked
repositories. Please check and eventually fix before upgrading.

Changes http://maven.apache.org/docs/3.8.1/release-notes.html

PR:		255161
Approved by:	Jonathan Chen <jonc@chen.org.nz> (maintainer)
Security:	CVE-2021-26291
		CVE-2020-13956

Document sysutils/consul vulnerabilities

Document accountsservice vulnerability

Document textproc/mdbook vulnerability

Document gitlab vulnerabilities.

Document new vulnerabilities in www/chromium < 90.0.4430.72

Document new vulnerabilities in www/chromium < 89.0.4389.128

Obtained
from:	https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop.html

security/vuxml: Document xorg-server vuln

security/vuxml: Add entry for gitea < 1.14.0

PR:		254976
Submitted by:	Stefan Bethke

security/vuxml: Document syncthing issue

security/vuxml: Document information disclosure vulnerability in python.
PR:		254780
Reported by:	yasu@utahime.org
Security:	CVE-2021-3426

security/vuxml: Document 2 vulnerabilities in ftp/curl
Security:	CVE-2021-22876
		CVE-2021-22890

PR:		254772
Reported by:	yasu@utahime.org

security/vuxml: Add entry for gitea < 1.13.7

PR:	254930
Submitted by:	Stefan Bethke

Document multiple vulnerabilities in security/clamav

PR:		254861
Submitted by:	Yasuhiro Kimura <yasu AT utahime DOT org>

Document Jenkins Security Advisory 2021-04-07

Sponsored by:	The FreeBSD Foundation

security/vuxml: document Node.js April 2021 Security Releases

https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/

security/vuxml: Document upnp stack overflow vulnerability

Approved by:		fernape (mentor)
Differential Revision:	https://reviews.freebsd.org/D29618

security/vuxml: add FreeBSD SA-21:10.jail_mount

security/vuxml: add FreeBSD SA-21:09.accept_filter

security/vuxml: add FreeBSD SA-21:08.vm

security/vuxml: add FreeBSD SA to CVE-2021-3449/50

Note that FreeBSD 12.2 prior to FreeBSD 12.2-RELEASE-p5 was vulnerable
to CVE-2021-3449 and CVE-2021-3450.  Reference FreeBSD-SA-21:07.openssl.

all: Remove all other $FreeBSD keywords.

Remove # $FreeBSD$ from Makefiles.

security/vuxml: Document XML round-trip vulnerability of REXML in Ruby

Document XML round-trip vulnerability of REXML in Ruby.

PR:		254793
Reported by:	Yasuhiro Kimura <yasu@utahime.org>
Security:	CVE-2021-28965

Add vuln-flat.xml to the ignore list and remove the one committed by accident

Document new vulnerabilities in www/chromium < 89.0.4389.114

Obtained from: 
https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html

Document gitlab-ce vulnerabilities.

security/linux-c7-nettle: mark vulnerable, too

See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254355#c14

PR:		254355
Reported by:	Graham Perrin <grahamperrin@gmail.com>

Add entry about recent Samba4* vulnerabilities:

CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by
sending easily crafted DNs as part of a bind request. More serious heap
corruption is likely also possible.
CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP
server may crash the LDAP server.

Security:	CVE-2020-27840
		CVE-2021-20277

vuln.xml: mention nettle < 3.7.2 ECDSA verify bugs

Security:	80f9dbd3-8eec-11eb-b9e8-3525f51429a0

security/vuxml: Document High OpenSSL vulnerabilities

 * While here, fix incorrect year in ec04f3d0-8cd9-11eb-bb9f-206a8a720317

security/vuxml: Document spamassassin CVE-2020-1946

PR:		254526
Security:	https://s.apache.org/ng9u9
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1946

security/vuxml: Add entry for gitea < 1.13.6

PR:		254515
Submitted by:	maintainer

security/vuxml: Add entry for gitea < 1.13.5

PR:		254468
Submitted by:	maintainer

OpenSSH CVE-2021-28041 fixed in 8.4.p1_4,1.

Also add flavored package names.

Document OpenSSH CVE-2021-28041

PR:	254258
Submitted by:	Yasuhiro Kimura

Document gitlab vulnerability.