Document new vulnerabilities in www/chromium < 57.0.2987.133

Obtained
from:	https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html

Document Xen Security Advisory (XSA 206)

CVE lists none (yet) assigned

While here, fix a typo on my last Xen entry

Security:	https://vuxml.FreeBSD.org/freebsd/47873d72-14eb-11e7-970f-002590263bf5.html

Actually, let's refer to the original entries for these hostapd CVEs

Reflect CVE-2016-4476 / VID 967b852b-1e28-11e6-8dd3-002590263bf5 in cancelled

CVE-2015-5314 is in VID 976567f6-05c5-11e6-94fa-002590263bf5

PR:		217906
Security:	https://vuxml.FreeBSD.org/freebsd/976567f6-05c5-11e6-94fa-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/967b852b-1e28-11e6-8dd3-002590263bf5.html

phpMyAdmin: document PMASA-2017-8 -- bypass restrictions on 'no
password' accounts.

Document hostapd vulnerabilities

PR:		217906

Add entry about Samba vulnerability CVE-2017-2619

Security:	CVE-2017-2619

Document Xen Security Advisory (XSA 211)

Security:	CVE-2016-9603
Security:	https://vuxml.FreeBSD.org/freebsd/af19ecd0-0f6a-11e7-970f-002590263bf5.html

Add CVE ID for recent irssi vulnerability

PR:		217878
Submitted by:	dor.bsd@xm0.uk (irssi mainainer)

Update hostapd on two older entries.

Fixes were not backported prior. Recent update is v2.6 as noted in advisory.

Security:	CVE-2015-5310
Security:	CVE-2015-5315
Security:	CVE-2015-5316
Security:	CVE-2016-4476
Security:	CVE-2016-4477
Security:	https://vuxml.FreeBSD.org/freebsd/967b852b-1e28-11e6-8dd3-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/976567f6-05c5-11e6-94fa-002590263bf5.html

Document use-after-free vulnerability in irc/irssi

PR:		217878

security/vuxml: Add DoS vuln for mysql-client

 - Fix typo in 5f453b69-abab-4e76-b6e5-2ed0bafcaee3 while here

security/vuxml: mark firefox < 52.0.1 as vulnerable

Note, sandboxing isn't implemented on FreeBSD.

Document Moodle security advisories from January (MSA-17-0001 - MSF-17-0004)
and March releases (details not yet released).

Security:	CVE-2017-2576
Security:	CVE-2017-2578
Security:	CVE-2016-10045
Security:	https://vuxml.FreeBSD.org/freebsd/f72d98d1-0b7e-11e7-970f-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/df45b4bd-0b7f-11e7-970f-002590263bf5.html

Fix incorrect PKGNAME in www/tomcat6 entries. It's been tomcat since r238618.

Pointy hat to:	junovitch (for most of them)

- Document multiple vulnerabilities in www/drupal8

Security:	CVE-2017-6377
Security:	CVE-2017-6379
Security:	CVE-2017-6381
Security:	2730c668-0b1c-11e7-8d52-6cf0497db129

Document PuTTY < 0.68 agent forwarding vuln.

Security:	CVE-2017-6542
Security:	9b973e97-0a99-11e7-ace7-080027ef73ec

Document latest Flash Player vulnerabilities.

Security:	https://helpx.adobe.com/security/products/flash-player/apsb17-07.html

Attempt to fix vuxml build.

Sponsored by:	The FreeBSD Foundation

security/vuxml: modify most recent mariadb entries

 - ChangeLog of 10.0.30 and 10.1.22 refer to CVE-2017-3313

Security:	4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf
Security:	CVE-2017-3313

Document mbed TLS Security Advisory 2017-01

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01

Document new vulnerabilities in www/chromium < 57.0.2987.98

Obtained
from:	https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html

Document several security defects in the Bouncy Castle Crypto APIs

PR:		215507
Approved by:    vsevolod (mentor)
Obtained from:  https://www.bouncycastle.org/releasenotes.html
Security:      
https://vuxml.FreeBSD.org/freebsd/89cf8cd2-0698-11e7-aa3f-001b216d295b

Add entry for CVE-2016-7787 in x11/kde4-runtime.

Security announcement:
https://www.kde.org/info/security/advisory-20160621-1.txt

Add entry for KTNEF directory traversal issue in deskutils/kdepimlibs4.

There is no CVE assigned at the moment.
More information: https://www.kde.org/info/security/advisory-20170227-1.txt

Adress CVE-2017-6410 in devel/kf5-kio and x11/kdelibs4

Using a malicious PAC file, and then using exfiltration methods in the PAC
function FindProxyForURL() enables the attacker to expose full https URLs.

This is a security issue since https URLs may contain sensitive
information in the URL authentication part (user:password@host), and in the
path and the query (e.g. access tokens).

This attack can be carried out remotely (over the LAN) since proxy settings
allow ``Detect Proxy Configuration Automatically''
This setting uses WPAD to retrieve the PAC file, and an attacker who has access
to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
and inject his/her own malicious PAC instead of the legitimate one.

Reviewed by:	mat, rakuco
Approved by:	rakuco (mentor), mat (mentor)
Obtained from:	https://marc.info/?l=kde-announce&m=148831226706885&w=2
MFH:		2017Q1
Security:	CVE-2017-6410
Differential Revision:	https://reviews.freebsd.org/D9908

Document wordpress security issues

PR:       217608, 217598
Security:
https://vuxml.FreeBSD.org/freebsd/82752070-0349-11e7-b48d-00e04c1ea73d.html

security/vuxml: mark firefox < 52 as vulnerable

Document security issues fixed in CodeIgniter 3.1.3

Security:	https://vuxml.FreeBSD.org/freebsd/71ebbc50-01c1-11e7-ae1b-002590263bf5.html

Fix PORTEPOCH on Chicken VuXML entry; also additional CVE affecting Chicken

PR:		216661
Reported by:	sevan, Vitaly Magerya
Security:	CVE-2016-9954
Security:	https://vuxml.FreeBSD.org/freebsd/c6932dd4-eaff-11e6-9ac1-a4badb2f4699.html

Add missing reference to last commit for ikiwiki vulnerabilities

PR:		216665
Reported by:	sevan
Security:	CVE-2016-9646
Security:	https://vuxml.FreeBSD.org/freebsd/5ed094a0-0150-11e7-ae1b-002590263bf5.html

Document ikiwiki vulnerabilities

PR:		216665
Reported by:	sevan
Security:	CVE-2016-9645
Security:	CVE-2016-10026
Security:	CVE-2017-0356
Security:	https://vuxml.FreeBSD.org/freebsd/5ed094a0-0150-11e7-ae1b-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/7b35a77a-0151-11e7-ae1b-002590263bf5.html

Document multiple memory failure in potrace

PR:		217347
Reported by:	lightside

Document buffer overflows in audio/musicpd http output module

Add linux-*-openssl to recent openssl vulnerabilities.

Security:	https://rhn.redhat.com/errata/RHSA-2017-0286.html

security/vuxml: curl only vulnerable >= 7.52.0

security/vuxml: Document cURL vulnerability

Document Xen Security Advisory (XSA 209)

Reported by:	royger
Security:	CVE-2017-2620
Security:	https://vuxml.FreeBSD.org/freebsd/8cbd9c08-f8b9-11e6-ae1b-002590263bf5.html

Document information disclosure vulnerability on fbsdmon

PR:             217099
Submitted by:   asomers

security/vuxml: chase r434427

$ svn ci -F libevent-rename.msg
[...]
svn: E165001: Commit failed (details follow):
svn: E165001: Commit blocked by pre-commit hook (exit code 1) with output:
Commit to security/vuxml/vuln.xml first, and then other files

PR:		216777

Document multiple vulnerabilities in audio/wavpack

PR:		216847
Submitted by:	pkubaj@anongoth.pl

Document multiple vulnerabilities in optipng.

PR:		216955
Submitted by:   Thomas Hurst <tom@hur.st> (affected port maintainer)

Complete PKGNAMEPREFIX of py-diffoscope

security/vuxml: Document openssl-devel vulnerability

 - While here fix whitespace on 077bbadf-f2f4-11e6-92a7-902b34361349

Document arbitrary file write in diffoscope < 76

Reported by:	koobs (via Debian bug report)
Reviewed by:	delphij
Approved by:	delphij
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D9598

Document heap overflow in multimedia/ffmpeg < 3.2.4

Document gtk-vnc bounds checking vulnabilities

Security:	CVE-2017-5884, CVE-2017-5885

Document Xen Security Advisory (XSA 208)

Reported by:	royger
Security:	CVE-2017-2615
Security:	https://vuxml.FreeBSD.org/freebsd/a73aba9a-effe-11e6-ae1b-002590263bf5.html

List all linux package names in latest libtiff vulnerability.

Undocument a linux-*-curl vulnerability that has low impact and Red Hat
"will not fix".

Security:	https://access.redhat.com/security/cve/CVE-2016-0755

Document libtiff vulnerabilities.

Security:	http://simplesystems.org/libtiff/v4.0.7.html

Document mantis vulnerability

PR:		216662
Security:	CVE-2016-6837

Document vulnerabilities in guile2

PR:		216663
Security:	CVE-2016-8605 CVE-2016-8606

Document vulnerabilities in chicken

PR:		216661
Security:	CVE-2016-6830 CVE-2016-6831

Document libebml vulnerabilities

PR:		216659
Security:	CVE-2015-8789
Security:	CVE-2015-8790
Security:	CVE-2015-8791

Document freeimage vulnerability

PR:		216657
Security:	CVE-2016-5684

Add additional vulnerability for wordpress 4.7.1 that was initially kept
quiet by the wordpress team [1].

[1]
https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/

Security:	https://vuxml.FreeBSD.org/freebsd/54e50cd9-c1a8-11e6-ae1b-002590263bf5.html

document shotwell vulnerability

Document Jenkins Security Advisory 2017-02-01

Fix openssl vuxml entry

PR:		216524

Document Wordpress security issues in 4.7.1.

PR:		216540
PR:		216515
Reported by:	Jochen Neumeister <joneum@bsdproject.de>
Reported by:	Mikhail Timofeev <9267096@gmail.com>
Security:	CVE-2017-5610
Security:	CVE-2017-5611
Security:	CVE-2017-5612
Security:	https://vuxml.FreeBSD.org/freebsd/14ea4458-e5cd-11e6-b56d-38d547003487.html

Document vulnerability in net-mgmt/nfsen

Document new vulnerabilities in www/chromium < 56.0.2924.76

Obtained
from:	https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html

security/vuxml: Document new OpenSSL vulnerabilities

security/vuxml: mark Gecko < 51.0/45.7esr as vulnerable

Document security vulnerabilities fixed in phpMyAdmin 4.6.6

Document nvmupdate security issue

Submitted by:	kozlov.sergey.404@gmail.com (maintainer)
Reviewed by:	sbruno
Sponsored by:	Intel
Differential Revision:	https://reviews.freebsd.org/D9121

Update OpenSSL impacted version

The reference cites 1.0.1u and prior as impacted. security/openssl would
have resolved in r381789. security/openssl-devel would have not have been
impacted as that port had been the newer 1.1.x branch since inception.

Reported by:	Thomas Schemme (via email)
Security:	CVE-2016-7056
Security:	https://vuxml.FreeBSD.org/freebsd/7caebe30-d7f1-11e6-a9a5-b499baebfeaf.html

Include php56 in today's PHP vulnerability

Security:	https://vuxml.FreeBSD.org/freebsd/709e025a-de8b-11e6-a9a5-b499baebfeaf.html

security/vuxml: Document PHP vulnerabilities

Document graphics/icoutils vulnerabilities

security/vuxml: Document mysql vulnerabilities

  - Documented in Oracle Critical Patch Update
  - MariaDB ChangeLogs refer to the same CVE IDs

Document mulitiple PowerDNS vulnerabilities

PR:		216135
PR:		216136
Reported by:	Dani <i.dani@outlook.com>
Security:	CVE-2016-2120
Security:	CVE-2016-7068
Security:	CVE-2016-7072
Security:	CVE-2016-7073
Security:	CVE-2016-7074
Security:	https://vuxml.FreeBSD.org/freebsd/e3200958-dd6c-11e6-ae1b-002590263bf5.html

Adding www/tt-rss to the phpmailer 5.2.22 vulnerability.

Document groovy remote execution of untrusted code/DoS vulnerability

Security:	CVE-2016-6814
Security:	https://vuxml.FreeBSD.org/freebsd/4af92a40-db33-11e6-ae1b-002590263bf5.html

Document RabbitMQ Authentication vulnerability

PR:		216026
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	CVE-2016-9877
Security:	https://vuxml.FreeBSD.org/freebsd/6aa956fb-d97f-11e6-a071-001e67f15f5a.html

Amend Irssi 0.8.21 entry. Another CVE was assigned.

PR:		216020
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:       CVE-2017-5356
Security:      
https://vuxml.FreeBSD.org/freebsd/3d6be69b-d365-11e6-a071-001e67f15f5a.html

Follow up on r431476's MySQL documentation; cite a source

Mention later OpenSSH VuXML entry supercedes the duplicate

Document Wordpress security issues in 4.7.1.

Note per upstream PHPMailer was updated but "No specific issue appears
to affect WordPress or any of the major plugins we investigated". As such
leave the PHPMailer entry as is at this time.

PR:		216059
Reported by:	Jochen Neumeister <joneum@bsdproject.de>
Security:	CVE-2017-5487
Security:	CVE-2017-5488
Security:	CVE-2017-5489
Security:	CVE-2017-5490
Security:	CVE-2017-5491
Security:	CVE-2017-5492
Security:	CVE-2017-5493
Security:	https://vuxml.FreeBSD.org/freebsd/b180d1fb-dac6-11e6-ae1b-002590263bf5.html

security/vuxml: Document multiple MySQL vulnerabilities

OpenSSH 7.3.p1_4,1 had SCTP on by default by accident. Suggest fixed rev 5.

Fix OpenSSH entry as a patch was missed.

OpenSSH 7.3_2 covers CVE-2016-10009 and CVE-2016-10010

Consolidate duplicate openssh vuxml entries

replace wildcard in range with a specific version

Reported by:	matthew
Reviewed by:	matthew
Approved by:	matthew (mentor)
Differential Revision:	https://reviews.freebsd.org/D9158

document ansible vulnerabilities

Reviewed by:	matthew
Approved by:	matthew (mentor)
Security:	CVE-2016-9587
Security:	https://vuxml.FreeBSD.org/freebsd/a93c3287-d8fd-11e6-be5c-001fbc0f280f.html
Differential Revision:	https://reviews.freebsd.org/D9158

Document phpmailer vulnerabilities.

Security: CVE-2017-5223
Security:
https://vuxml.FreeBSD.org/freebsd/7ae0be99-d8bb-11e6-9b7f-d43d7e971a1b.html

Fixup bind9-devel's version for last vuln.

Sponsored by:	Absolight

Document BIND multiple vulnerabilities.

Document FreeBSD-SA-17:01.openssh

security/vuxml: Fix version number of libressl-devel

security/vuxml: Document OpenSSL ECDSA P-256 vulnerability

  - Affects libressl as well

Security:	CVE-2016-7056

Document Flash vulnerabilities in Adobe Security Bulletin APSB17-02

Security:	CVE-2017-2925
Security:	CVE-2017-2926
Security:	CVE-2017-2927
Security:	CVE-2017-2928
Security:	CVE-2017-2930
Security:	CVE-2017-2931
Security:	CVE-2017-2932
Security:	CVE-2017-2933
Security:	CVE-2017-2934
Security:	CVE-2017-2935
Security:	CVE-2017-2936
Security:	CVE-2017-2937
Security:	CVE-2017-2938
Security:	https://vuxml.FreeBSD.org/freebsd/2a7bdc56-d7a3-11e6-ae1b-002590263bf5.html

Mention pcsc-lite CVE (it was in next message in cited URL)

While here, fix spacing

PR:		215834

Document moinmoin vulnerabilities

PR:		214937
Security:	CVE-2016-7146 CVE-2016-7148 CVE-2016-9119

Fix openssh-portable version

Document libvncserver vulnerabilities

PR:		215805
Security:	CVE-2016-9941 CVE-2016-9942

Document libdwarf vulnerabilities

Security:	CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030
Security:	CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5035
Security:	CVE-2016-5037 CVE-2016-5040 CVE-2016-5041 CVE-2016-5043
Security:	CVE-2016-5044 CVE-2016-7510 CVE-2016-7511 CVE-2016-8679
Security:	CVE-2016-8680 CVE-2016-8681 CVE-2016-9275 CVE-2016-9276
Security:	CVE-2016-9480 CVE-2016-9558

PR:		215085

Document lynx vulnerabilities

PR:		215464
Security:	CVE-2014-3566
Security:	CVE-2016-9179

Document hdf5 CVEs

PR:		214938
Security:	CVE-2016-4330
SecuritY:	CVE-2016-4331
Security:	CVE-2016-4332
Security:	CVE-2016-4333