security/vuxml: Add record for net/keycloak

CVE-2024-11736 Unrestricted admin use of system and environment variables
CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers

Security:	CVE-2024-11734
Security:	CVE-2024-11736
PR:		284058

security/vuxml: add asterisk{18,20} vulns

CVE-2024-53566: Path traversal

 * Base Score:	5.5 MEDIUM
 * Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

security/vuxml: Document two valnerabilities in redis and valkey

While here, update copyright year

security/vuxml: document gitlab vulnerabilities

security/vuxml: Fix sqlite range

PR:		283830
Reported by:	John Hein <jcfyecrayz@liamekaens.com>

security/vuxml: Update open-motif entry to reflect fix in 2004

Release notes states:

2.2.4 October 2004
a. Fixed vulnerabilities in libXpm code [CVE numbers CAN-2004-0687
   (integer overflows) and CAN-2004-0688 (stack overflows)].

security/vuxml: Note Xpm update in open-motif-devel

Upstream open-motif updated built-in Xpm to 3.5.12 in upstream commit
b100c321 making it no longer vulnerable.

security/vuxml: TOCTOU Vulnerability in www/apache*

CVE-2024-56337

security/vuxml: www/kanboard vulnerability

Insufficient session validation.

security/vuxml: Document Vaultwarden vulnerability

security/vuxml: add www/*chromium < 131.0.6778.204

Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_18.html

security/vuxml: Document liboqs vulnerability

security/vuxml: fix parse errors

Fix parse errors introduced in 96ddbb42b98fcb6022729ea28cd6725fcfdc4597.

security/vuxml: add records for www/gitea < 1.22.6

https://github.com/go-gitea/gitea/pull/32810
https://github.com/advisories/GHSA-v778-237x-gjrc
https://github.com/go-gitea/gitea/pull/32791
https://github.com/go-gitea/gitea/pull/32654
https://github.com/go-gitea/gitea/pull/32531
https://github.com/go-gitea/gitea/pull/32473

PR:	283389

security/vuxml: add records for www/forgejo < 9.0.3 and www/forgejo7 < 7.0.12

https://codeberg.org/forgejo/forgejo/pulls/5974
https://codeberg.org/forgejo/forgejo/pulls/6248
https://codeberg.org/forgejo/forgejo/pulls/6249

PR:	283388

security/vuxml: Document net-im/py-matrix-synapse vulnerability

Signed-off-by: Sascha Biberhofer <sascha.biberhofer@skyforge.at>

PR:		283350
Reviewed by:	ashish

security/vuxml: Fix range for thunderbird vulnerability

PR:		283357
Reported by:	John Hein <jcfyecrayz@liamekaens.com>

security/vuxml: Mark zeek < 7.0.5 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.5

This release fixes the following potential DoS vulnerability:

 - Large QUIC packets can cause Zeek to overflow memory and potentially
   crash. Due to the possibility of receiving these packets from
   remote hosts, this is a DoS risk.

Reported by:	Tim Wojtulewicz

textproc/halibut: update 1.2 → 1.3

PR:	282213

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 131.0.6778.139

Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html
Obtained
from:	https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html

security/vuxml: Add mozilla vulnerabilities

 * CVE-2024-11692
 * CVE-2024-11696
 * CVE-2024-11697
 * CVE-2024-11699

security/vuxml: Add www/qt6-webengine < 6.7.3_3

security/vuxml: Document gstreamer1-plugins* < 1.24.10

security/vuxml: Add zabbix-frontend vulnerability

 * Base Score:  9.9 CRITICAL
 * Vector:  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

security/vuxml: document electron33 inappropriate implementation in extensions

Obtained from:	https://github.com/electron/electron/releases/tag/v33.2.1

security/vuxml: security/vuxml: Document Jenkins Security Advisory 2024-11-27

Sponsored by:	The FreeBSD Foundation

net/keycloak: document multiple vulnerabilities

Security:	CVE-2024-9666 CVE-2024-10039 CVE-2024-10270
Security:	CVE-2024-10451 CVE-2024-10492
PR:		282983

security/vuxml: document gitlab vulnerabilities

security/vuxml: add www/*chromium < 131.0.6778.85

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html

security/vuxml: Add www/qt6-webengine < 6.7.3_2

security/vuxml: Add www/qt5-webengine < 5.15.18p5

security/vuxml: Add x11-servers/xorg-server, x11-servers/xwayland

PR:		282415

security/vuxml: Add vaultwarden

Vaultwarden -- Multiple vulnerabilities

PR:		282795
Reported by:	Bernard Spil

security/vuxml: Add mongodb vulnerability

Buffer over-read.

security/vuxml: Document vaultwarden vulnerabilities

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.5

security/vuxml: add www/*chromium < 131.0.6778.69

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.5

security/vuxml: Add CVEs for PostreSQL

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.4

security/vuxml: document gitlab vulnerabilities

security/vuxml: add FreeBSD SAs issued on 2024-10-29

FreeBSD-SA-24:17.bhyve affects all supported versions of FreeBSD
FreeBSD-SA-24:18.ctl affects all supported versions of FreeBSD
FreeBSD-SA-24:19.fetch affects all supported versions of FreeBSD

security/vuxml: Document element-web vulnerabilities

Security:	CVE-2024-51749
Security:	CVE-2024-51750

security/vuxml: Document matrix-js-sdk vulnerability

Security:	CVE-2024-50336

security/vuxml: Document icinga2 vulnerability

security/vuxml: Document new Intel CPU vulnerabilities

Intel has disclosed new CPU vulnerabilities in the release notes for
microcode-20241112.  This release also includes updates to previous
microcode updates for CVE-2024-24968 and CVE-2024-23984.

Reference:	https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20241112
Security:	CVE-2024-21820
Security:	CVE-2024-21853
Security:	CVE-2024-23918
Security:	CVE-2024-23984 (updated microcode)
Security:	CVE-2024-24968 (updated microcode)
Sponsored by:	The FreeBSD Foundation

security/vuxml: add CVE-2018-10195, CVE-2020-29074

security/vuxml: Document tnef vulnerabilities

PR:		282228

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.3

security/vuxml: Document gstreamer1-rtsp-server

Only affected if assertions are enabled, which we don't do by default.

security/vuxml: add www/*chromium < 130.0.6723.116

Obtained
from:	https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html

security/vuxml: Add record for devel/libqb < 2.0.8 CVE-2023-39976

log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long
log messages because the header size is not considered.
https://nvd.nist.gov/vuln/detail/CVE-2023-39976

PR:	282536

security/vuxml: add www/*chromium < 130.0.6723.91

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html

security/vuxml: Add www/qt5-webengine < 5.15.18p2

Fix indentation issues caught by `make validate` for previous entry.

security/vuxml: Add record for net/keycloak < 26.0.4 CVE-2021-44549

PR:	282419

security/vuxml: www/librewolf < 131.0.3 CVE-2024-9936

PR:	282423

security/vuxml: Add record for devel/hwloc2 < 2.9.2 CVE-2022-47022

PR:	282215

security/vuxml: add record for www/forgejo < 9.0.1 and www/forgejo7 < 7.0.10

https://codeberg.org/forgejo/forgejo/milestone/8544
https://codeberg.org/forgejo/forgejo/pulls/5719
https://codeberg.org/forgejo/forgejo/pulls/5718

PR:	282387

security/vuxml: add www/*chromium < 130.0.6723.{58,69}

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html
Obtained from: 
https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html

security/vuxml: document electron31 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.2

security/vuxml: document gitlab vulnerabilities

security/vuxml: document electron32 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v32.2.2

security/vuxml: document www/oauth2-proxy vulnerabilities

Reported by:	Matthias Wolf <freebsd@rheinwolf.de>
PR:		282004

security/vuxml: OpenSSL 3.4 not affected by CVE-2024-9143

security/vuxml: Fix and add OpenSSL versions

security/vuxml: Document OpenSSL low vulnerability

security/vuxml: document electron{31,32} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v31.7.1,
	 	https://github.com/electron/electron/releases/tag/v32.2.1

security/vuxml: Document element-web vulnerability

security/vuxml: document VSCode remote code execution vulnerability

Obtained from:	https://github.com/microsoft/vscode/issues/230824

security/vuxml: Fix typo in firefox entry

Reported by:	jbeich@

security/vuxml: Add firefox{-esr} use-after-free code execution

CVE-2024-9680

security/vuxml: document gitlab vulnerabilities

security/vuxml: Add record for www/gitea: Fix bug when a token is given public
only

PR:	281949

security/vuxml: Add record about CVE-2024-25590 in dns/powerdns-recursor

PowerDNS Recursor Security Advisory 2024-04:
https://blog.powerdns.com/2024/10/03/powerdns-recursor-4-9-9-5-0-9-5-1-2-released

PR:	281914

security/vuxml: add www/*chromium < 129.0.6668.{89,100}

Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html
Obtained
from:	https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html

security/vuxml: Fix Thunderbird version

PR:		281960
Reported by:	John Hein <jcfyecrayz@liamekaens.com>
Fixes:		86d1aa3caa24c97cdc63962d13fef16be12c84b7

security/vuxml: document unbound vulnerability

PR:		281894
Security:	CVE-2024-8508
Security:	2368755b-83f6-11ef-8d2e-a04a5edf46d9

security/vuxml: Mark zeek < 7.0.3 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.3

This release fixes the following potential DoS vulnerability:

 - Adding to the POP3 hardening in 7.0.2, the parser now simply
   discards too many pending commands, rather than any attempting
   to process them. Further, invalid server responses do not result
   in command completion anymore. Processing out-of-order commands
   or finishing commands based on invalid server responses could
   result in inconsistent analyzer state, potentially triggering
   null pointer references for crafted traffic.

Reported by:	Tim Wojtulewicz

security/vuxml: Fix name tag for textproc/expat2

Reported by:	Adam McDougall <mcdouga9@egr.msu.edu>
Fixes:		47955717fc53

security/vuxml: Add firefox{-esr}, thunderbird vulnerabilities

CVE-2024-9392
CVE-2024-9396
CVE-2024-9400
CVE-2024-9401
CVE-2024-9402
CVE-2024-9403

security/vuxml: Update range of redis in 8b20f21a-8113-11ef-b988-08002784c58d

In 2024Q3 branch databases/redis still stays in 7.2.x.

Fixes:		e44e4021e418

security/vuxml: Document Jenkins Security Advisory 2024-10-02

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document multiple valnerabilities in Redis and Valkey

security/vuxml: Document PHP vulnerabilities

  There were 4 vulnerabilities found and fixed in PHP.

PR:		281770
Reported by:	FiLis <freebsdbugs@filis.org>

security/vuxml: Update cups-filters entry

security/vuxml: Add CVE-2022-45197

security/vuxml: add www/*chromium < 129.0.6668.70

Obtained
from:	https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html

security/vuxml: Fix typos

Add linux-*-sqlite3 to last entry.
s/mozilla/firefox in an older entry

Reported by:	Edward Sanford Sutton, III (mirror176@hotmail.com)

security/vuxml: Add sqlite use after free vulnerability

CVE-2024-0232
  * Base Score:	5.5 MEDIUM
  * Vector:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

security/vuxml: Add cups-browsed RCE

security/vuxml: Add textproc/expat2 vulnerabilities

CVE-2024-45490
CVE-2024-45491
CVE-2024-45492

PR:		281738
Reported by:	FiLiS <freebsdbugs@filis.org>

security/vuxml: document gitlab vulnerabilities

security/vuxml: document frr vulnerabilities

security/vuxml: Update zeek range for 6.X

Really, it was silly of me to add the <ge> range since there were
no commited 6.X versions that were not vulnerable to the new issue.

security/vuxml: Mark zeek < 7.0.2 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v7.0.2

This release fixes the following potential DoS vulnerability:

 - The POP3 parser has been hardened to avoid unbounded state growth
   in the face of one-sided traffic capture or when enabled for
   non-POP3 traffic.

Reported by:	Tim Wojtulewicz

security/vuxml: belatedly add FreeBSD SAs issued on 2024-08-07

FreeBSD-SA-24:05.pf affects all supported versions of FreeBSD
FreeBSD-SA-24:06.ktrace affects all supported versions of FreeBSD
FreeBSD-SA-24:07.nfsclient affects all supported versions of FreeBSD

security/vuxml: complete FreeBSD reference for CVE-2024-7589

FreeBSD-SA-24:08.openssh was issued on 2024-08-07 to address
CVE-2024-7589.  All supported versions of FreeBSD were affected.

While here, correct minor markup nits in the vuxml entry.

security/vuxml: reference FreeBSD-SA-24:04.openssh in CVE-2024-6387

All supported versions of FreeBSD were affected by CVE-2024-6387,
announced on 2024-07-01.  Reference FreeBSD-SA-24:04.openssh in the
vuxml entry.

security/vuxml: add FreeBSD SAs issued on 2024-09-19

FreeBSD-SA-24:15.bhyve affects all supported versions of FreeBSD
FreeBSD-SA-24:16.libnv affects all supported versions of FreeBSD