Document CVE-2014-4607 in net/krfb.

MFH:		2014Q3

- Document net/samba4* vulnerability: CVE-2014-3560

- Document vulnerability in security/gpgme (CVE-2014-3564)

Document x11/kdelibs4 vulnerability

tor -- traffic confirmation attack

Report serious i2p vulnerability

- document bugzilla Cross Site Request Forgery (CVE-2014-1546)

MFH:		2014Q3

- document apache22 CVE entries

MFH:		2014Q3

- Document vulnerabilities in www/tomcat*: CVE-2014-0096, CVE-2014-0099,
CVE-2014-0075

Document Mozilla multiple vulnerabilities.

Fix the recent Qt vulnerability entry again.

The CVE patch applies to -imageformats in Qt4 but -gui in Qt5. I always get
confused by the different port names...

Noted by antoine@.

MFH:		2014Q3
Security:	904d78b8-0f7e-11e4-8b71-5453ed2e2b49

security/vuxml: document security issue in mcollective

Update the latest phpMyAdmin entry with CVE numbers and descriptive
text from the security advisories, now that they have been published.

Security:	3f09ca29-0e48-11e4-b17a-6805ca0b3d42

Fix the list of packages affected by 904d78b8-0f7e-11e4-8b71-5453ed2e2b49.

Submitted by:	RyoTa SimaMoto <liangtai.s16@gmail.com>
MFH:		2014Q3

Document qt4-gui/qt5-gui vulnerability.

MFH:		2014Q3

- document apache24 CVE entries
  until now there is no official CHANGELOG and apache-2.4.10
  is not released, so take summary from upstream SVN.

Yet another tranche of phpMyAdmin security alerts.  In typical style
there has been a software release with warnings that it contains
security fixes, but the Security Advisories are not yet available and
CVE numbers have not yet been published.

Document new vulnerabilities in www/chromium < 36.0.1985.125

Submitted by:	Carlos Jacobo Puga Medina <cpm@fbsd.es> via freebsd-chromium
Obtained from:	http://googlechromereleases.blogspot.nl/
MFH:		2014Q3

Document x11/kdelibs4 vulnerability.

MFH:		2014Q3

Add entry for mail/postfixadmin.

PR:		189248
MFH:		2014Q3

- Add seamonkey to list of things affected by mozilla issue

Document more dbus vulnabilities.

Add vuln entries for mplayer and mencoder for CVE-2014-4610
(integer overflow in ffmpeg's lzo code)

Approved by:	mentors (implicit)
MFH:	2014Q2

Add a vulnerability entry for lzo2.

Add also gnupg-2.0.24.

Update vuln.xml now that advisories have been published.

Add about gnupg-1.4.17.

- Document recent samba vulnerabilities (CVE-2014-3493, CVE-2014-0244)

Document the latest phpMyAdmin vulnerabilities.  Very little
information has been published as yet.  What there is here has been
gleaned from the ChangeLog at
http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.2.4/phpMyAdmin-4.2.4-notes.html/view

Updates and CVE numbers to follow, as they are made available.

Add vuln entry for iodine.

Submitted by:	Kenta S.

Document asterisk vulnerabilities

Document dbus local dos

MFH:		2014Q2

Document new vulnerabilities in www/chromium < 35.0.1916.153

Submitted by:	Carlos Jacobo Puga Medina <cpm@fbsd.es>
Obtained from:	http://www.googlechromereleases.blogspot.nl/
MFH:		2014Q2

Document mozilla vulnerabilities

Document OpenSSL multiple vulnerabilities.

Fix extraneous <vuxml> open tag on line 88.

Fix build.

Document gnutls CVE-2014-3466 to prevent memory corruption due to server
hello parsing.

Security:       CVE-2014-3466

- Document vulnerability in security/gnutls3 (CVE-2014-3466)

Fixing range of affected versions of mumble 1.2.4 to cover all portrevisions

- Fix formating

audio/mumble vulnerabilities

My first foray into this dark, scary vuxml dungeon.

VuXML: cancel Exim's CVE-2014-2957

Current port isn't built with DMARC support and has no knobs to enable it.

- Document exim vulnerability (CVE-2014-2957)

Undo my poor merge conflict editing.

Reported by:	rene, mat

Report the latest flash security issue

Document a bunch of openjpeg vulnabilities.

MFH:		2014Q2

Document new vulnerabilities in www/chromium < 35.0.1916.114

Obtained from:	http://googlechromereleases.blogspot.nl/
MFH:		2014Q2

- Add STAGE support
- Add LICENSE
- Cleanup plist-related clever
- Pacify portlint(1)
- Bump PORTREVISION

With hat:	ports-secteam

Describe new vulnerabilities in www/chromium < 34.0.1847.137

Obtained from:	http://googlechromereleases.blogspot.nl/
MFH:		2014Q2

Record libXfont X Font Service Protocol and Font metadata file handling issues

MFH:	2014Q2

Document CVE-2013-2877 which affects textproc/libxml2.

Summary: Oops, the current version is affected, hence <le/> instead of <lt/>.

Summary: Fix a typo copied from the original report.

Document CVE-2014-0191 which affects textproc/libxml2.

Document OpenSSL vulnerability
Security: CVE-2014-0198

Document qt4-xml vulnerability (CVE-2013-4549).

- Document strongSwan vulnerability (CVE-2014-2338)
- Add additional reminder to document port variants

- fix some entries so they are really detected
  by old and new pkg audit tools

Approved by:	portmgr (bdrewery)

- Document vulnerabilities in www/mohawk

PR:		ports/189082
Submitted by:	mohawk <mohawk@bsdsx.fr>

Document new vulnerabilities in www/chromium < 34.0.1847.132

Obtained from:	http://googlechromereleases.blogspot.nl/

Document mozilla vulnerabilities

Add back pakcage ranges for people have ancient packages

Notified by:	mat

Fix Django package names

Submitted by:	mat

Document Django 2014-04-21 vulnerabilty

- This is not really a quote, I summarized it myself.

- Document OpenSSL CVE-2010-5298

- fix entries so issues for bugzilla40/42 are detected
  first version found only bugzilla44 issues (tested with pkg audit)

- document bugzilla issues

  CVE-2014-1517 is fixed in bugzilla-4.4.3
  therefore use two vuxml entries.

- Add multiple missing entries

PR:		ports/188512
Submitted by:	Pawel Biernacki <pawel.biernacki@gmail.com>

Fix typo.

Submitted by:	matthew@

Mention a vulnerability in japanese/chasen* which exists since 2011-11-08

Obtained from:	http://jvn.jp/en/jp/JVN16901583/index.html

- Correct version ranges for
7ccd4def-c1be-11e3-9d09-000c2980a9f3/5631ae98-be9e-11e3-b5e3-c80aa9043978

Reported by:	Tim Zingelman <tez@netbsd.org>

- Move CVE-2014-0076 to its own entry+add FreeBSD system information as the
affected list does not 100% line up with the vulnerability described in
CVE-2014-0160/5631ae98-be9e-11e3-b5e3-c80aa9043978

- Note FreeBSD system vulnerability information for
5631ae98-be9e-11e3-b5e3-c80aa9043978

- Mark linux-f10-openssl vulnerabilities

Reported by:	frogs on freenode

- Document recent vulnerability in net/openafs (CVE-2014-0159)

Document new vulnerabilities in www/chromium < 34.0.1847.116

Obtained from:	http://googlechromereleases.blogspot.nl/
MFH:		2014Q2

Add mingw32-openssl.

Add more information for OpenSSL bug

- Sort references
- Add link to heartbleed.com that has a lot of useful information

- Document Openssl vulnerabilities

Security:	CVE-2014-0160
Security:	CVE-2014-0076
Security:	https://www.openssl.org/news/secadv_20140407.txt
MFH:		2014Q2

New OTRS vulnerability

Security:	CVE-2014-2554

Add CVE-2014-2525 which affects libyaml.

Fix all mod_php entries.
Please don't use the range <range><ge>0</ge></range>.

Add an entry for CVE-2014-2386

Add an entry for CVE-2014-2270, and correct the indentation
in the entry for CVE-2014-1943

Fix mod_php5 entry.

Sort reference entries in 36f9ac43-b2ac-11e3-8752-080027ef73ec
mail/trojita information leak.

This should really be in the DTD or at least "make validate" if it's
official requirement...

Submitted by:	remko

- Document multiple vulnerabilities for Joomla! 2 and Joomla! 3

Add an entry for trojita mail leak across unencrypted connections
(CVE-2014-2567). Port update in PR#187370, pending commit.
MFH: yes

Split nginx and nginx-devel entries, update date.

Add CVE-2014-0133 entries for www/nginx and www/nginx-devel.

- document apache22 /apache24
  CVE-2014-0098, CVE-2013-6438

Please Note:
 apache-2.2.27 is not released until now,
 but this is exoected during the next days.

Attempt to fix latest mozilla entry for firefox-esr

Reported by:	plukky on #bsdports

Document mozilla vulnerabilities

Document new vulnerabilities in www/chromium < 33.0.1750.152

Obtained from:	http://googlechromereleases.blogspot.nl/
MFH:		2014Q1

Update (c) year to be 2014.

PS. all rumors that this commit is to shup up the grim reaper are wildly
exagurated.

- Fix ordering

- Document recent vulnerability in mail/mutt (CVE-2014-0467)