Document Jenkins Security Advisory 2020-08-17

Sponsored by:	The FreeBSD Foundation

security/vuxml: Update rsync issues with zlib

Document py-ecdsa issue

security/vuxml: Document net-mgmt/snmptt issue

PR:		248162
Reported by:	nistor@snickers.org

security/vuxml: mail/dovecot multiple vulnerabilities.

graphics/ilmbase, graphics/openexr: mention security fixes in v2.5.3

No CVE numbers available at this time.

Security:	b1d6b383-dd51-11ea-a688-7b12871ef3ad

Document Jenkins Security Advisory 2020-08-12

Sponsored by:	The FreeBSD Foundation

Document new vulnerabilities in www/chromium < 84.0.4147.125

Document puppetdb5 vulnerability

- Document ftp/bftpd vulnerabilities

security/vuxml: add www/trafficserver entry for CVE-2020-9494

PR:		247713
Submitted by:	spam123@bitbert.com

security/vuxml: www/mod_http2 also vulnerable to latest Apache httpd vulns

security/vuxml: Add Apache httpd vulnerabilities

security/vuxml: Document lang/go vulnerability

Document gitlab-ce vulnerabilities.

security/vuxml: correct a typo in SA-20:22.sqlite

Pointy hat to:  philip

security/vuxml: add FreeBSD SA-20:23.sendmsg

security/vuxml: add FreeBSD SA-20:21.usb_net

security/vuxml: add FreeBSD SA to sqlite3 entry

Reference FreeBSD-SA-20:22.sqlite and correct the fixed patch releases
in the recent sqlite3 entry.

add entry for typo3-9 and typo3-10

PR:		248430 248429
Sponsored by:	Netzkommune GmbH

vuxml: Document vulns in xorg-server and libX11

Document two vulnerabilities, one in xorg-server and one in libX11.
The one in libX11 is a heap corruption vulnerability. [1]
The one in xorg-server (and slave ports) is a uninitialized memory
disclosure.  [2]

Security:	CVE-2020-14344[1], CVE-2020-14347 [2]

- Document python38 multiple vulnerabilities

security/vuxml: fix randomly introduced typo

Pointy hat:	tcberner
Reported by:	kevans

Document vulnerability in archivers/ark

- fixed in r543704 (head), r543705 (2020Q3)

Document new vulnerabilities in www/chromium < 84.0.4147.105

Obtained
from:	https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html

Document out-of-bounds-read in libsndfile (CVE-2019-3832).

PR:		248268

security/vuxml: document new vulnerability in net/freerdp < 2.2.0

PR:		248198

security/vuxml: Mark zeek < 3.0.8 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v3.0.8

Two potential stack overflows.

Add entry for Cacti

PR:		248140
Sponsored by:	Netzkommune GmbH

Document wagtail vulnerability

Fix typo

Reported by:	cmt
Sponsored by:	Netzkommune GmbH

Add entry for pango

Sponsored by:	Netzkommune GmbH

Fix typo

Sponsored by:	Netzkommune GmbH

modified the tomcat entry and add CVE-2020-11996

PR:		247555
Sponsored by:	Netzkommune GmbH

Add entry for www/tomcat{7,85,9,-devel}

PR:		247975
Sponsored by:	Netzkommune GmbH

Fixup affected versions, imprecisely.

Reported by:	mat

- Document multiple vulnerabilities of python38
- Fix 2 typos in my last commit

Document multiple vulnerabilities in VirtualBox>

PR:		244212
Submitted by:	Nikita Stepanov <nikitastepan0v@bk.ru>

security/vuxml: Document multiple vulnerabilities in clamav

- CVE-2020-3350, CVE-2020-3327, CVE-2020-3481

PR:		248027
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>

vuln db: record OpenEXR/ilmbase < 2.5.2 vulnerabilities

Security:	714e6c35-c75b-11ea-aa29-d74973d1f9f3

Document new vulnerabilities in www/chromium < 84.0.4147.89

Obtained
from:	https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html

Document Jenkins Security Advisory 2020-07-15

Sponsored by:	The FreeBSD Foundation

security/vuxml: Add MySQL vulns from pre-announce

security/vuxml: update CVE-2020-1266[23] entry

Note vulnerable FreeBSD releases and add a reference to
FreeBSD-SA-20:19.unbound.

security/vuxml: add FreeBSD SA-20:20.ipv6

security/vuxml: add FreeBSD SA-20:18.posix_spawnp

Add entry for www/mybb

Sponsored by:	Netzkommune GmbH

Correct FreeBSD versions vulnerable to the latest sqlite3
vulnerabilities. This will be updated by so@ at a future date.

PR:		247865
Submitted by:	Yasuhiro KIMURA <yasu at utahime.org>
Reported by:	Yasuhiro KIMURA <yasu at utahime.org>
Approved by:	ports-secteam (jonenum)

Document rubygem-kramdown vulnerability

Document Mbed TLS security advisory 2020-07.

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2020-07

Document gitlab vulnerability.

- Document python37 multiple vulnerabilities

Add entry about Samba vulnerabilities CVE-2020-10730, CVE-2020-10745,
CVE-2020-10760, CVE-2020-14303

PR:		247725
Security:	CVE-2020-10730
		CVE-2020-10745
		CVE-2020-10760
		CVE-2020-14303

Add entry for anydesk

PR:		247406
Sponsored by:	Netzkommune GmbH

Document net-im/py-matrix-synapse security issue before 1.15.2

PR:		247720
Submitted by:	Sascha Biberhofer <ports@skyforge.at>

Document vulnerability in dbus < 2.12.18

* See [1] for details.
* The port is already updated to 2.12.18.

[1] https://gitlab.freedesktop.org/dbus/dbus/-/issues/294

PR:		247340
Submitted by:	rob2g2 <spam123@bitbert.com>
Security:	CVE-2020-12049

Document gitlab vulnerabilities.

security/vuxml update: coturn CVE-2020-4067 for net/coturn

Add entrx for dns/powerdns-recursor

PR:		247707
Submitted by:	Ralf van der Enden <tremere@cainites.net>
Sponsored by:	Netzkommune GmbH

Add entry for Drupal 7

Sponsored by:	Netzkommune GmbH

Document xrdp CVE-2020-4044 vulnerability

security/vuxml: add mongodb CVE entry

- See also: https://jira.mongodb.org/browse/SERVER-45472

PR:		247392
Submitted by:	Ronald Klop <ronald-lists@klop.ws>

Document libvorbis vulnerabilities CVE-2017-14160 and CVE-2018-10392.

security/putty: two security vulnerabilities in versions < 0.74

Security:	6190c0cd-b945-11ea-9401-2dcf562daa69
Security:	CVE-2020-14002
Security:	FZI-2020-5

vuln.xml: Adjust sqlite version in sqlite entry

Update the sqlite versions affected in the latest sqlite entry.  The entry
failed to take PORTEPOCH into account, and without this fix pkg audit fails
to mark sqlite as vulnerable when it's not updated to the latest version,
since any version with PORTEPOCH set will always be greater than any version
without.

PR:		247149

Fix build, again...

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Document new vulnerablities in www/chromium < 83.0.4103.116

Update VuXML with security issues in mail/mutt

PR:		247399
Submitted by:	Derek Schrock

Document curl vulnerability

Attempt to fix build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

Document CUPS CVE-2019-8842 and CVE-2020-3898.

PR:		246011
Security:	https://github.com/apple/cups/releases/tag/v2.3.3

Clean up unnecessary "<p>.</p>" in blockquote section

Document rails vulnerability

security/vuxml: Document multimedia/vlc Vulnerability

PR:		247341
Security:	CVE-2020-13428

security/vuxml:

Document CVE-2020-13882 and CVE-2019-13033 for security/lynis.

security/vuxml: CVE-2020-8618 and CVE-2020-8619

ISC published CVE-2020-8618 affecting dns/bind916 and CVE-2020-8619
affecting dns/bind911 and dns/bind916.  Both ports were updated.

security/vuxml: Update CVE-2019-18348 and CVE-2020-8492 entries

Python 3.6 and 3.7 are not vulnerable in the ports tree anymore.
Change range for python35 to <le>, suggested by swills.

PR:		246984, 246738

security/vuxml: document libreoffice <6.4.4 security issues

PR:		247196
Submitted by:	rob2g2 <spam123@bitbert.com>

Document multiple sqlite3 vulnerabilities with CVSS scores ranging
from 5.5 (medium) to 7.5 (high).

PR:		247149

security/vuxml: document Node.js June 2020 Security Releases

https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/

Sponsored by:	Miles AS

Document net-mgmt/tcpreplay vulnerabilities

security/vuxml: Document irc/znc issue

Security:	CVE-2020-13775

Document npm vulnerabilities.

Document the audio/libadplug vulnerabilities:

https://github.com/adplug/adplug/releases/tag/adplug-2.3.3

security/vuxml: Mark zeek < 3.0.7 as vulnerable as per:

    https://raw.githubusercontent.com/zeek/zeek/v3.0.7/NEWS

Various issues including stack overflows and memory leaks.

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb20-30.html

Add FreeBSD-SA-20:17.usb.

Approved by:	so

Unbreak vuxmlbuild

Parsing VuXML ...Application exception:
bad CVE name for vid 669f3fe8-a07a-11ea-b83e-f0def1f5c5a2: GHSL-2020-100 @ho:215
*** Error code 1

Sponsored by:	Netzkommune GmbH

security/vuxml: document new vulnerabilities in net/freerdp < 2.1.0

PR:		246931, 245517
Obtained from:	https://github.com/FreeRDP/FreeRDP/blob/2.1.0/ChangeLog
Approved by:	koobs (mentor)

security/vuxml: Update CVE-2019-18348 and CVE-2020-8492 entries

CVE-2019-18348:	Add missing Python packages range
CVE-2020-8492:	Fix Python 3.7 entrie, it's currently affected.

After committing fixes, we'll need to change ranges again.

PR:		246984

Document new vulnerabilities in www/chromium < 83.0.4103.97

Obtained
from:	https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-desktop.html

- Fix the name of py-django30 in my previous commit

Spotted by:	dan@langille.org

Attempt to fix build.

Sponsored by:	Rubicon Communications, LLC (netgate.com)

- Update c5ec57a9-9c2b-11ea-82b8-4c72b94353b5 entry. Add drupal 8.8.6

Document gitlab-ce vulnerabilities.

- Document Django multiple vulnerabilities

vuxml: Document git vulnerability CVE-2020-5260

PR:		245821
Submitted by:	rob2g2 <spam123@bitbert.com>
Sponsored by:	Rubicon Communications, LLC (Netgate)

vuxml: Document git vulnerability CVE-2020-11008

PR:		245822
Submitted by:	rob2g2 <spam123@bitbert.com>
Sponsored by:	Rubicon Communications, LLC (Netgate)

Add entry for GNUTLS-SA-2020-06-03 (flaw in TLS).
Add CVE reference to previous GnuTLS entry.

Document rubygem-websocket-extensions vulnerability