security/vuxml: Document vulnerability in editors/libreoffice

Security:	CVE-2018-6871

PR:		225797
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>

security/vuxml: Document vulnerabilities in www/squid

Security:	CVE-2018-1000024
Security:	CVE-2018-1000027

PR:		226138
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>

security/vuxml: Fix freebsdpr entry (r462310)

Document new asterisk and pjsip vulnerabilities.

Document the latest phpMyAdmin security advisory PMASA-2018-1

Document GitLab Vulnerability

Security:
https://vuxml.FreeBSD.org/freebsd/86291013-16e6-11e8-ae9f-d43d7e971a1b.html

security/vuxml: Document multiple vulnerabilities in irc/irssi

Security:	CVE-2018-7054
Security:	CVE-2018-7053
Security:	CVE-2018-7052
Security:	CVE-2018-7051
Security:	CVE-2018-7050

PR:		226001
Reported by:	tj@mrsk.me (email)
Reported by:	David O'Rourke <dor.bsd@xm0.uk>

Add Mojolicious vulnerability, for which there is very little
information about the actual issue.

- document bugzilla44 and bugzilla50 CVE issue

Mark bro < 2.5.3 as vulnerable as per:

    http://blog.bro.org/2018/02/bro-253-released-security-update.html

Reviewed by:	matthew (mentor)
Approved by:	matthew (mentor)
Differential Revision:	https://reviews.freebsd.org/D14395

Fix typo

Document consul issue

Mark bro < 2.5.2 as vulnerable as per:

    http://blog.bro.org/2017/10/bro-252-242-release-security-update.html

Reviewed by:	ler (mentor)
Approved by:	ler (mentor)
Security:	CVE-2017-1000458
Differential Revision:	https://reviews.freebsd.org/D14394

security/vuxml: 4 CVEs for net/quagga

Document vulnerabilities in graphics/libraw

VulnXML: Bitmessage vulnerability

No CVE is available. CVE is requested.
The bitmessage port will be updated shortly.

Approved by:	tcberner

Document Jenkins vulnerability

VulnXML records for vulnerabilities of sysutils/bchunk fixed in the upcoming
update to 1.2.2 (bug#225772)

Approved by:	tcberner (mentor, implicit)

- Document www/uwsgi vulnerability

- Fix URL in blockquote

Reported by:	remko via private email

Correct affected version of Mpv

Document python vulnerability

Document vulnerability in finance/electrum and finance/electrum2.

PR:		225056
Submitted by:	pete@nomadlogic.org, vermaden@interia.pl (via mail)
Security:	CVE-2018-6353

security/vuxml: Document vulnerability in net-p2p/libtorrent

PR:		224664
Reported by:	Henry David Bartholomew <PopularMoment@protonmail.com>

- Document CVE-2018-6789 in mail/exim

Security:	316b3c3e-0e98-11e8-8d41-97657151f8c2

Add entries for CVE-2017-17969 and CVE-2018-5996 in p7zip

Security:	CVE-2017-17969
Security:	CVE-2018-5996

Document vulnerability in Mpv

PR:		225783
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Obtained from:	https://nvd.nist.gov/vuln/detail/CVE-2018-6360
Security:	CVE-2018-6360

Extend mailman CVE-2018-5950 vuln entry to mailman-with-htdig

Security:	3d0eeef8-0cf9-11e8-99b0-d017c2987f9a
Security:	CVE-2018-5950

Document Mailman vulnerability

PR:		225767
Submitted by:	Vladimir Krstulja
Reviewed by:	Matthias Andree
Security:	CVE-2018-5950
Security:	3d0eeef8-0cf9-11e8-99b0-d017c2987f9a

Add security notice for PostgreSQL

Security:	CVE-2018-1052
Security:	CVE-2018-1053

security/vuxml: Document recent tiff CVEs

PR:		225545
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-03.html

Mark mini_httpd < 1.28 and thttpd < 2.28 as vulnerable as per:

    http://acme.com/updates/archive/199.html

While we're here, fix whitespace in vuln.xml that "make validate"
flagged.

Reviewed by:	ler (mentor)
Approved by:	ler (mentor)
Security:	CVE-2017-17663
Differential Revision:	D14217

Adding VuXML record for vulnerability CVE-2017-15924 in net/shadowsocks-libev.

D14200 (part I).

The next commit will update net/shadowsocks-libev and fix this
vulnerability.

PR:		225442
Submitted by:	myself
Approved by:	adamw (mentor)
Differential Revision:	https://reviews.freebsd.org/D14200

Add modification date for the entry of w3m vulnerabilities.

Spotted by:	 dbaio

Update entry of w3m vulnerabilities.

PR:		225611
Submitted by:	D. Ebdrup <debdrup@gmail.com>

Document www/palemoon vulnerabilities

PR:		225644
Security:	CVE-2018-5102
Security:	CVE-2018-5122

Document django vulnerability

Document vulns in www/w3m.

PR:		225611
Submitted by:	D. Ebdrup <debdrup@gmail.com>

Update range for dovecot vulnerability.

security/vuxml: mark waterfox < 56.0.3.65 as vulnerable

Add modified date, forgotten in r460325

security/vuxml: mark firefox < 58.0.1 as vulnerable

security/vuxml: bump min waterfox version with FF58 fixes

Update range for linux-*-nss.

PR:		225541
Submitted by:	dbn
Security:	https://access.redhat.com/errata/RHSA-2017:2832

FIx range for dovecot

2.2.33.2_2 is vulnerable.

Document gcab stack overflow.

Security:	CVE-2018-5345

Document dovecot issue

Submitted by:	Roger Marquis <marquis@roble.com>

Document curl issue

Submitted by:	Roger Marquis <marquis@roble.com>

document recent clamav vulnerabilities

See: http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html

Fix wordpress entries in vuxml

- Fix incorrect package names
- Fix epoch in older entry which makes it incorrectly report fresh ports as
vulnerable

With hat:	ports-secteam

security/vuxml: seamonkey 2.49.2 will use firefox-esr 52.6 engine

security/vuxml: mark firefox < 58 as vulnerable

Fix typo.

Document new vulnerability in dns/powerdns-recursor < 4.1.1

Obtained
from:	https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html
Security:	CVE-2018-1000003

Document new vulnerabilities in www/chromium < 63.0.3239.108

Obtained
from:	https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html
Security:	CVE-2017-15429

Document new vulnerabilities in www/chromium < 63.0.3239.84

Obtained
from:	https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Document new vulnerability in www/chromium < 62.0.3202.94

Obtained
from:	https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html
Security:	CVE-2017-15428

Add missing entry for www/chromium

Security:	CVE-2017-15406

Add more information about the recents security notice for shibboleth2-sp

security/vuxml: Document vulnerability in dns/unbound

Security:	CVE-2017-15105

PR:		225313
Reported by:	jaap@NLnetLabs.nl

Document phpbb3 issues

Approved by:	tz (mentor)
Differential Revision:	https://reviews.freebsd.org/D13983

security/vuxml: Fix tabs and spaces settings

security/vuxml: Document 2018Q1 Oracle MySQL vulns

Document wordpress issues

Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D13954

Document GitLab issue

Document DNS rebinding vulnerabilities in net-p2p/transmission-daemon

PR:		225150
Security:	https://www.vuxml.org/freebsd/3e5b8bd3-0c32-452f-a60e-beab7b762351.html

Document vulnerability of devel/xmltooling

security/shibboleth2-sp depends on the xmltooling port

Security:	CVE-2018-0486

Add vim-console instead of replacing vim-list.

Reported by:	ohauer

Chase the vim-lite -> vim-console rename

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-01.html

security/vuxml: Document vulnerability in www/awstats

Security:	CVE-2017-1000501

PR:		225007
Reported by:	Vidar Karlsen <vidar@karlsen.tech>

security/vuxml: Document multiple vulnerabilities in irc/irssi

Security:	CVE-2018-5205
Security:	CVE-2018-5206
Security:	CVE-2018-5207
Security:	CVE-2018-5208

PR:		224954
Reported by:	tj@mrsk.me (email)
Reported by:	David O'Rourke <dor.bsd@xm0.uk>

security/vuxml: mark firefox < 57.0.4 as vulnerable

* Add modified date to for libevhtp vulnerable
Thank you dbaio for catching this.

* Add libevhtp to list of vulnerable ports.

Libevhtp prior to 1.2.14 uses oniguruma 5.9.2 and is
vulnerable if using the REGEX option, which is the
default.

security/vuxml: Fix FreeBSD PR bugs references

security/vuxml: Document vulnerabilities in www/otrs

Security:	CVE-2017-16664
Security:	CVE-2017-16854
Security:	CVE-2017-16921

PR:		224729
Reported by:	Vidar Karlsen <vidar@karlsen.tech>

Fix cut-n-paste error in the previous addition for bouncycastle15
(6a131fbf-ec76-11e7-aa65-001b216d295b).

Document security defect in the Bouncy Castle Crypto APIs: CVE-2017-13098
("ROBOT")

Obtained from:  https://www.bouncycastle.org/releasenotes.html
Security:      
https://vuxml.FreeBSD.org/freebsd/6a131fbf-ec76-11e7-aa65-001b216d295b

security/vuxml: mark thunderbird < 52.5.2 as vulnerable

Document phpMyAdmin PMSA-2017-9: Critical XSRF/CSRF vulnerability.

security/vuxml: Fix typo in CVE number of latest Oracle CPU entry

Document new asterisk vulnerability.

security/vuxml: Document new MariaDB vuln

 - This is likely to also affect MySQL and other versions
   see https://security-tracker.debian.org/tracker/CVE-2017-15365

Document multiple vulnerabilities in rsync.

PR:		224478
Submitted by:	yasu@utahime.org

Document ruby issue

Add vuxml entry for CVE-2017-16355 to rubygem-passenger

The vulnerable version was already replaced by r452356

Reviewed by:	brd
Approved by:	brd (ports)
Sponsored by:	Spectra Logic Corp
Differential Revision:	https://reviews.freebsd.org/D13482

Document multiple vulnerabilities in libXfont and libXfont2.

The first two vulnerabilities are memory leaks when reading past valid
memory.

The last vulnerability is the possibility for an unprivileged X client to
read privileged files through symlinks

CVE-2017-13720
CVE-2017-13722
CVE-2017-16611

Add CVE to references.

Document x11/libXcursor -- integer overflow that can lead to heap buffer
overflow.

CVE-2017-16612

Document global vulnerability

Document Jenkins vulnerabilities.

security/vuxml: document Node.js vulnerabilities, December 2017

Approved by:	mat (co-mentor)
Differential Revision:	https://reviews.freebsd.org/D13489

Document GitLab Vulnerability

Security:
https://vuxml.FreeBSD.org/freebsd/e72a8864-e0bc-11e7-b627-d43d7e971a1b.html

Add entry for CVE-2017-8819.

Requested by:	Roger Marquis
Hat:		FreeBSD Security Team

- Add CVE names for old asterisk13 vulnerabilities
- Fix typo

Document asterisk13 vulnerability.

Document libxml2 issue

Fix version range in latest curl entry.