Use correct end tag.

Submitted by:	dvl@

Add iojs as affected package

Security:	864e6f75-2372-11e5-86ff-14dae9d210b8

Correct bitcoin range for CVE-2015-3641

Document ansible vulnerabilities

PR:		201359

Document bitcoin CVE-2015-3641

add node-devel as affected package
confirmed source code of node 0.11.16 is also vulnerable

add www/node denial of service vulnerability
no known CVE has been assigned

cups-filters CVE-2015-3279

Fix range for linux-c6-openssl

Record libxml2 vulnability

Security:	CVE-2015-1819

Correct version range for netpbm CVE-2015-3885

Document games/wesnoth authentication information disclosure vulnerability.

PR:		201105
Submitted by:	Jason Unovitch

- Document CVE-2015-3258 (cups-filters buffer overflow vulnerability)

PR:		201134
Submitted by:	cyberbotx@cyberbotx.com
Differential Revision:

Document ntp remote control message DoS vulnerability.

Document qemu pcnet guest to host escape vulnerability - CVE-2015-3209

PR:		201064
Submitted by:	koobs
Security:	https://vuxml.FreeBSD.org/freebsd/acd5d037-1c33-11e5-be9c-6805ca1d3bb1.html

Document CVE-2014-3120, CVE-2014-6439, CVE-2015-1427, CVE-2015-3337,
and CVE-2015-4165 (various Elasticsearch vulnerabilities).

PR:		ports/201008
Submitted by:	Jason Unovitch

Split CVE-2015-4152 to its own entry as the affected port is logstash only.

While there also document CVE-2014-4326 (already fixed) for logstash.

PR:		ports/201001
Submitted by:	Jason Unovitch

Add entry for logstash-forwarder/logstash.

PR:		ports/201065
Submitted by:	Jason Unovitch

Aggressively mark more consumers of bundled dcraw as vulnerable

ljpeg_start() originates from dcraw, no need to list every package with
copy of it at the expense of readability.

Document linux-*-flashplugin11 CVE.

Reported by:	kwm
Reviewed by:	kwm
Security:	d02f6b01-1a3f-11e5-8bd6-c485083ca99c
Security:	CVE-2015-3113
Sponsored by:	Perceivon Hosting Inc.

Fix entry date.

Document rubygem-bson DoS and possible injection vulnerability.

PR:		201061
Submitted by:	Jason Unovitch

Document 3 vulnerabilities with PHP that affected 4 extensions.

PR:		200926
Submitted by:	Jason Unovitch

Reflect version range change after r390340.  While I'm there, also fix
the CVE-2015-4556 entry because it's not yet fixed in the ports tree and
add a reference to the PR while there.

PR:		200980
Submitted by:	Vitaly Magerya (with changes suggested by Jason Unovitch)

Document vulnerabilities in devel/ipython < 3.2.0.

Document new vulnerabilities in www/chromium < 43.0.2357.130

Obtained
from:	http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html

Document rubygem-paperclip validation bypass vulnerabilitiy.

PR:		200979
Submitted by:	Jason Unovitch

Document lang/chicken vulnerabilities CVE-2014-9651 and CVE-2015-4556.

PR:		200980
Submitted by:	Jason Unovitch

Document cacti multiple vulnerabilities (affects < 0.8.8c) and
multiple XSS/SQL injection vulnerabilities (affects < 0.8.8d).

PR:		200963
Submitted by:	Jason Unovitch

Add p5-Dancer vuln.

Document Drupal multiple vulnerabilities.

Document two vulnerabilities of cURL.

- Make it compatible with Python 3.x

Approved by:	delphij

- Document Ruby on Rails multiple vulnerabilities

Modify a5f160fa-deee-11e4-99f8-080027ef73ec so it covers ja-mailman too.

Submitted by:	Yasuhito FUTATSUKI

Document testdisk multiple vulnerabilities.

PR:		ports/200250
Submitted by:	Jason Unovitch

Document Tomcat multiple vulnerabilities.

Add ossec-hids-* vulnerabilities.

PR:		200801
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
Approved by:	swills (mentor)

- Add vulnerability information for additional ports affected by openssl CVEs in
8305e215-1080-11e5-8ba2-000c2980a9f3

- Document recent vulnerabilities in security/openssl

Document 13 Flash vulnerabilities.
Affected: www/linux-*-flashplugin11.

Document libzmq4 V3 protocol handler protocol downgrade vulnerability.

PR:		200502
Submitted by:	Jason Unovitch

Document pgbouncer remote denial of service vulnerability.

PR:		200537
Submitted by:	Jason Unovitch

Document cups multiple vulnerabilities.

Document two strongswan vulnerabilities.

PR:		200721
Submitted by:	Jason Unovitch (with changes: wrapped long line and changed
		CVE-2015-3991's coverage to cover only < 5.3.1 to reflect
		the reality).

Document redis EVAL Lua sandbox escape vulnerability.

Add an entry for www/tidy-* heap-buffer-overflow.

PR:		ports/200631
Submitted by:	Walter Hop

Fix typo and remove PHP from pcre vulnerabilities, as the bundled pcre
is not used.

Document fixed version of pcre in e69af246-0ae2-11e5-90e4-d050996490d0.

- Update VuXML

PR:		200196
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>

- Re-add PHP removed in previous commit
- Update pcre to use lt instead of gt

- Make version matching on the pcre vuln a little more sane
- Remove PHP as the vulnerability appears to be in devel/pcre, not php

Document two recent pcre vulnerabilities that can be triggered by
specifically crafted *patterns* and would lead to stack or heap
overflow.

Update information for graphics/libraw.

PR:	200194

security/vuxml: multiple vulnerabilities of wpa_supplicant and hostapd

Security:	CVE-2015-4141
Security:	CVE-2015-4142
Security:	CVE-2015-4143
Security:	CVE-2015-4144
Security:	CVE-2015-4145
Security:	CVE-2015-4146
PR:		200568

Document recent ffmpeg0 vulnerabilities

Add entry for vulnerable versions of avidemux2 and avidemux26

PR:		200507
Submitted by:	venture37@geeklan.co.uk

security/vuxml: add www/rubygem-rest-client vulnerabilities

PR:		200504
Differential Revision:	https://reviews.freebsd.org/D2699
Submitted by:	Sevan Janiyan <venture37@geeklan.co.uk>
Approved by:	ports-secteam (delphij, eadler)
Security:	CVE-2015-1820
Security:	CVE-2015-3448

 - Add kodi to 57325ecf-facc-11e4-968f-b888e347c638 [1]
 - Update entry dates for newly added entry.

PR:		200200 [1]
Submitted by:	Jason Unovitch [1]

Reflect CVE-2015-2060 and CVE-2014-9556.

PR:		ports/198955
Submitted by:	Jason Unovitch

- Document django vulnerability CVE-2015-3982

Extend 57325ecf-facc-11e4-968f-b888e347c638 to cover rawstudio as well.

PR:		200199
Submitted by:	Jason Unovitch

Document the issue with proxychains-ng which uses current directory when
searching for its own shared library (CVE-2015-3887).

PR:		200511
Submitted by:	Jason Unovitch

Document wireshark multiple vulnerabilities.

Document krb5 requires_preauth bypass in PKINIT-enabled KDC.

Retrofit document cURL multiple vulnerabilities.

Document cassandra remote code execution vulnerability.

PR:		199091
Submitted by:	Jason Unovitch <jason unovitch gmail com>

Fix version range for previous commit.

Extend CVE-2015-3456 to cover xen-tools (4.5.0-4.5.0_5: we didn't supported
the feature in earlier version of this port) and VirtualBox cases as well.

PR:		200311

document possible vulnerabilities in sysutils/py-salt

PR:		200172
Submitted by:	Sevan Janiyan <venture37@geeklan.co.uk>

Add entry for mail/davmail.

PR:		198297
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
Approved by:	<john.c.prather@gmail.com> (maintainer (timeout))

Document dnsmasq and -devel vulnerabilities (CVE-2015-3294 and one other in rc).

Document PCRE and PHP multiple vulnerabilities.

Correct PR number.

Submitted by:	jason.unovitch gmail.com

Record some minor PostgreSQL sercurity problems.

"This update fixes three security vulnerabilities reported in PostgreSQL over
the past few months. Nether of these issues is seen as particularly urgent.
However, users should examine them in case their installations are vulnerable."

URL:	http://www.postgresql.org/about/news/1587/

Pass full path to the vuln.xml file to extra-validation.py.  Without this,
if .OBJDIR differs from .CURDIR, the validation would fail.

PR:		193923
Reported by:	jbeich

Document CVE-2015-3306 proftpd mod_copy unauthenticated copying of files
vulnerability.

Document vulnerability in security/ipsec-tools.

PR:		200334
Approved by:	bdrewery (mentor)

Document new vulnerabilities in www/chromium < 43.0.2357.65

Obtained
from:	http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html

Document ClamAV multiple vulnerabilities.

security/vuxml: Add CVE-2015-3900 entry for devel/ruby-gems

PR:		200264
Differential Revision:	https://reviews.freebsd.org/D2572
Approved by:	mat (mentor)
Security:	CVE-2015-3900

Document qemu "VENOM" vulnerability - CVE-2015-3456

PR:		200255
PR:		200256
PR:		200257
Submitted by:	venture37@geeklan.co.uk
Security:	http://vuxml.FreeBSD.org/freebsd/2780e442-fc59-11e4-b18b-6805ca1d3bb1.html

Document Quassel IRC vulnerability CVE-2015-3427

Correct entry for apache-openoffice-* / libreoffice CVE-2015-1774 so
that apache-openoffice-4.1.1_9 is not incorrectly flagged as vulnerable.

Approved by:	mat (mentor, implicit)

security/vuxml: document vulnerability in rubygem-redcarpet <3.2.3

PR:		200195
Differential Revision:	https://reviews.freebsd.org/D2548
Submitted by:	Sevan Janiyan <venture37@geeklan.co.uk>
Approved by:	mat (mentor)

security/vuxml: Add CVE-2015-3885 entry for graphics/ufraw

PR:		200197

Record two new phpMyAdmin security vulnerabilities

Document multiple vulnerabilities in www/linux-*-flashplugin11.

Security:	CVE-2015-3044
Security:	CVE-2015-3077
Security:	CVE-2015-3078
Security:	CVE-2015-3079
Security:	CVE-2015-3080
Security:	CVE-2015-3081
Security:	CVE-2015-3082
Security:	CVE-2015-3083
Security:	CVE-2015-3084
Security:	CVE-2015-3085
Security:	CVE-2015-3086
Security:	CVE-2015-3087
Security:	CVE-2015-3088
Security:	CVE-2015-3089
Security:	CVE-2015-3090
Security:	CVE-2015-3091
Security:	CVE-2015-3092
Security:	CVE-2015-3093

VuXML: document recent mozilla vulnerabilities

security/vuxml: Add CVE-2015-0971 entry for security/suricata

Revert r385940,r385932,r385864:

The usage of * is actually valid, as pointed out at the FreeBSD porter's
handbook:

https://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html

Which denotes "the smallest version number" (in other words, * < 0).

Requested by:	many
Pointy hat to:	delphij

Add entry for CVE-2015-3146 in security/libssh.

- fix a second postfix entry

PR:			200089 (followup)

Correct version range.

PR:		200089

* is not valid for version number, replace all instances with 0 and bump
modification date.

Submitted by:	Chris Nehren <cnehren tenable com> (version number part)

VuXML: update sqlite3 entry with verbose descriptions. CVE-2015-341[4-6]

PR:		199483

Document HWP filter vulnerability in editors/libreoffice < 4.3.7 and
editors/openoffice < 4.1.2, CVE-2015-1774.

Approved by:	mat (mentor)
Differential Revision:	https://reviews.freebsd.org/D2475

Document current and previous wordpress vulnabilities.

Fix version range of two ancient items.

Submitted by:	Chris Nehren <cnehren tenable com>

Add entry for powerdns and powerdns-recursor.

Approved by:	bdrewery (mentor)