Document gitlab-ce vulnerabilities.

Document consul issue

PR:		251418
Submitted by:	brd

Document new vulnerabilities in www/chromium < 87.0.4280.88

- Unbreak build after previous commit

security/vuxml: Add entry for gitea < 1.13.0

PR:		251577
Submitted by:	maintainer

security/vuxml: add FreeBSD SA-20:32.rtsold

security/vuxml: add FreeBSD SA-20:31.icmp6

vuxml: document xorg-server vulnerabilities

Document new vulnerabilities in xorg-server and sub ports:
CVE-2020-14360 and CVE-2020-25712

These issues can lead to privileges elevations for authorized clients
on systems where the X server is running privileged.

vuxml: Add entry for nomad < 0.12.6

vuxml: Add entry for gitea < 1.12.6

security/vuxml: document Node.js November 2020 Security Releases

https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/

Sponsored by:	Miles AS

Document CVE-2020-28896 for mutt 2.0.2.

PR:		251278
Submitted by:	dereks@lifeofadishwasher.com
Security:	CVE-2020-28896

VuXML: document mozjpeg and libjpeg-turbo recent vulnerabilities

PR:		250190
Submitted by:	daniel.engberg.lists@pyret.net

security/vuxml: add entries for databases/mantis

PR:		251141
Submitted by:	Zoltan Alexanderson Besse <zab@zltech.eu>

security/vuxml: Document lang/go vulnerabilities

security/vuxml: New entry for sysutils/py-salt vulnerabilities

There are three security vulnerabilities described for sysutils/py-salt
in version 3002[1]: CVE-2020-16846, CVE-2020-17490, and VE-2020-25592.

[1] https://docs.saltstack.com/en/latest/topics/releases/3002.1.html

It is planned to update the port sysutils/py-salt soon, see PR 251013

Reported by:	michael.glaus@hostpoint.ch (in PR 251013)
Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D27189

Document vulnerability in editors/openoffice-4 < 4.1.8 and openoffice-devel

CVE-2020-13958 Unrestricted actions leads to arbitrary code execution
in crafted documents

A vulnerability in Apache OpenOffice scripting events allows an
attacker to construct documents containing hyperlinks pointing to
an executable on the target users file system. These hyperlinks can
be triggered unconditionally. In fixed versions no internal protocol
may be called from the document event handler and other hyperlinks
require a control-click.

<https://www.openoffice.org/security/cves/CVE-2020-13958.html>

Prefer graphics/ligvrsvg2-rust over graphics/librsvg2

- switch to the more modern version of librsvg2 on architectures
  supporting rust
- this will fix some graphical issues on these architectures

PR:		250276
Exp-run by:	antoine
Submitted by:	tobik
Differential Revision:	https://reviews.freebsd.org/D18878

Fix CVE name for 07c7ae7a-224b-11eb-aa6e-e0d55e2a8bf9

Sponsored by:	The FreeBSD Foundation

Document vulnerability in textproc/raptor2

From [1], [2], [3]:
raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF
Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML
writer, leading to heap-based buffer overflows (sometimes seen in
raptor_qname_format_as_xml).

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18926
[2] https://www.debian.org/security/2020/dsa-4785
[3] https://www.openwall.com/lists/oss-security/2017/06/07/1

PR:		250971
Security:	CVE-2017-18926

security/vuxml: Document www/py-notebook issue

Fix open redirect vulnerability GHSA-c7vm-f5p4-8fqh (CVE to be assigned).

security/vuxml: Document addl. MariaDB vulns

Document asterisk vulnerabilities.

Document new vulnerabilities in www/chromium < 86.0.4240.183

Obtained
from:	https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html

Document gitlab vulnerabilities.

Add entry for wordpress

Sponsored by:	Netzkommune GmbH

Add an entry about recent Samba vulnerabilities

Security:	CVE-2020-14318
		CVE-2020-14323
		CVE-2020-14383

security/vuxml: Document stack overflow in tmux

PR:		250737

security/vuxml: Add entry for multimedia/motion

Follow up commit for 553525.

For some reason, "Use MHD function for url decoding" actually means fixing
CVE-2020-26566

PR:	250660

print/freetype2: document vulnerability

PR:		250375
Security:	CVE-2020-15999

security/vuxml: Document 2020Q4 MySQL vulnerabilities

Document new vulnerabilities in www/chromium < 86.0.4240.111

Obtained
from:	https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html

security/vuxml: add powerdns-recursor

PR:		250318
Submitted by:	Ralf van der Enden <tremere@cainites.net>
Reported by:	michael.glaus@hostpoint.ch
Sponsored by:	SkunkWerks, GmbH

security/vuxml: Document MariaDB vulnerabilities

security/vuxml: Update entry date for the last issue added (r552574)

security/vuxml: Document net-im/py-matrix-synapse issue

PR:		249948
Submitted by:	Sascha Biberhofer <ports@skyforge.at>
Security:	CVE-2020-26891

Add entry for drupal7

Sponsored by:	Netzkommune GmbH

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb20-58.html

Document rails vulnerability

security/vuxml: add CVEs for www/payara

- CVE-2020-6950 Eclipse Mojarra vulnerable to path trasversal flaw
  via either loc/con parameters
- CVE-2019-12086 A Polymorphic Typing issue was discovered in
  FasterXML jackson-databind 2.x before 2.9.9
- some more

PR:		250207
Submitted by:	Dmytro Bilokha <dmytro@posteo.net>

security/vuxml: Mark zeek < 3.0.11 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v3.0.11

A memory leak in multipart MIME code has potential for remote
exploitation and cause for Denial of Service via resource exhaustion.

While we're here fix missing cite for "zeek < 3.0.10" entry.

Document new vulnerabilities in www/chromium < 86.0.4240.75

Obtained
from:	https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html

Document libexif vulnerability

vuxml: fix version check in r551354

vuxml: document deskutils/kdeconnect-kde vulnerability

KDE Project Security Advisory
=============================

Title:           KDE Connect: packet manipulation can be exploited in a Denial
of Service attack
Risk Rating:     Important
CVE:             CVE-2020-26164
Versions:        kdeconnect <= 20.08.1
Author:          Albert Vaca Cintora <albertvaka@gmail.com>
Date:            2 October 2020

Overview
========

vuxml: document vulnerability in devel/upnp

Security:	CVE-2020-13848

Document gitlab vulnerabilities.

Add recent tt-rss issues.

PR:		249472
Submitted by:	Derek Schrock (tt-rss's maintainer)
MFC after:	1 day
Security:	https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799

security/vuxml: Add CVE-2020-1945: Apache Ant insecure temporary file
vulnerability

PR:		248098
Submitted by:	mikael

security/vuxml: add entry dns/powerdns below 4.3.1

- CVE-2020-17482

PR:		249560
Submitted by:	Ralf van der Enden <tremere@cainites.net>
Relnotes:	https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2020-05.html

vuxml: Update pango entry for CVE-2019-1010238

Update the pango entry for CVE-2019-1010238.
Since the fix to pango wasn't applied properly the first time around, the
pango version with the fix needed to be bumpt in the vuxml entry.

Document new vulnerabilities in www/chromium < 85.0.4183.121

Obtained
from:	https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html

security/vuxml: document libxml2 vulnerabilities

PR:		249386

security/vuxml: Document net-im/py-matrix-synapse issue

PR:		249375
Submitted by:	Denis Kasak <dkasak@termina.org.uk>
Submitted by:	Sascha Biberhofer <ports@skyforge.at> (earlier version)

- Document python35 multiple vulnerabilities

PR:		249187

Add an entry about CVE-2020-1472 - Unauthenticated domain takeover via netlogon
("ZeroLogon")

Security:	CVE-2020-1472

security/vuxml: Document Nextcloud 19.0.1 vuln

www/webkit2-gtk3: Multiple Vulnerabilities (vuxml entry)

PR:		247892
Submitted by:	rob2g2 <spam123@bitbert.com>
Security:	CVE-2020-9802
Security:	CVE-2020-9803
Security:	CVE-2020-9805
Security:	CVE-2020-9806
Security:	CVE-2020-9807
Security:	CVE-2020-9843
Security:	CVE-2020-9850
Security:	CVE-2020-13753

security/vuxml: document Node.js September 2020 Security Releases

https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/

Sponsored by:	Miles AS

security/vuxml: add FreeBSD SA-20:30.ftpd

security/vuxml: add FreeBSD SA-20:29.bhyve_svm

security/vuxml: add FreeBSD SA-20:28.bhyve_vmcs

security/vuxml: add FreeBSD SA-20:27.ure

Document rails vulnerability

security/vuxml: Mark zeek < 3.0.10 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v3.0.10

Memory leak has potential for remote DOS via resource exhaustion.

Document new vulnerabilities in www/chromium < 85.0.4183.102

Obtained
from:	https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop.html

Sigh, fix previous entry as it's already documented, combine the information
into previous entry.

Document mpd multiple vulnerabilities.

Document remotely exploitable crash in the mpd5.

Reported by:	chennan at SourceForge
Obtained from:	http://mpd.sourceforge.net/doc5/mpd4.html#4

Document Mbed TLS 2020-09-1 and 2020-09-2.

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-1
Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-09-2

Document GNUTLS-SA-2020-09-04.

Security:	https://gnutls.org/security-new.html#GNUTLS-SA-2020-09-04

Update jasper vulnerability

Document Django vulnerability

security/vuxml: Fix gnupg version range specification

Thanks to swills for pointing me to the error here.

PR:		249110
Reported by:	jjuanino gmail

Fix format

vuxml: Add entry for gnupg 2.2.21 - 2.2.22

security/vuxml: add FreeBSD SA-20:26.dhclient

security/vuxml: add FreeBSD SA-20:25.sctp

security/vuxml: add FreeBSD SA-20:24.ipv6

Document gitlab vulnerabilities.

security/vuxml: Document lang/go vulnerability

security/vuxml: document vulnerability in ark

security/vuxml: Mark php72, php73, and php74 vulnerable as per:

    https://www.php.net/ChangeLog-7.php#PHP_7_4
    https://www.php.net/ChangeLog-7.php#PHP_7_3
    https://www.php.net/ChangeLog-7.php#PHP_7_2

The phar_parse_zipfile function had [a] use-after-free vulnerability
because of [a] mishandling of the actual_alias variable.

Security:	CVE-2020-7068

Document new vulnerabilities in www/chromium < 85.0.4183.83

Document jasper vulnerability

vuxml: Document xorg-server and libX11 vulns

Document newly announced vulnerabilities in libX11 and xorg-server.

Updated entry for gitlab to clarify that the previously reported version does
not fix the problem.
Please also see this upstream issue:
https://gitlab.com/gitlab-org/gitlab/-/issues/233881

vuln.xml: add chrony < 3.5.1 pidfile symlink vulnerability

Security:	719f06af-e45e-11ea-95a1-c3b8167b8026
Security:	CVE-2020-14367

security/vuxml: Document sysutils/openzfs-kmod issues

PR:		248787
Reported by:	Andrew Walker
Reviewed by:	wg
Approved by:	wg (ports)
Sponsored by:	iXsystems, Inc.
Differential Revision:	https://reviews.freebsd.org/D26121

security/vuxml: Document textproc/elasticsearch6 vulnerability

PR:		248761
Submitted by:	Juraj Lutter <juraj@lutter.sk> (maintainer)

vuxml: Document dns/adns security issues

Document several securiy issues in dns/adns.
While here, fix whitespace in adjacent entries, as reported by make
validate.

Document icingaweb2 vulnerability

Document curl vulnerability

- Update a cvename entry

- Document python37 and python36 multiple vulnerabilities

PR:		248751
Submitted by:	mwalker@carbonhouse.com

vuxml: Document security/trousers issues

Reapply r545263, but do it properly this time.
Document security issues in security/trousers.

Revert r545263, which excludes the package name, version(s) affected,
and includes "INSERT BLOCKQUOTE URL HERE" for a URL, suggesting the
'make validate' target was clearly not executed.

vuxml: Document security issues in security/trousers

Document new vulnerability in www/chromium < 84.0.4147.135

Document ceph vulnerability

PR:		248673
Submitted by:	Willem Jan Withagen <wjw@digiware.nl>