Perl 5.x: fix CVE-2013-1667

Feature safe:	wholeheartedly hope so

- Fix previous entry

Belatedly add an entry for libpurple's recent vulnerabilities.

- update thunderbird, firefox-esr, linux-thunderbird and linux-firefox to
  17.0.4
- update firefox to 19.0.2
- add vuln.xml entry

Security:	630c8c08-880f-11e2-807f-d43d7e0c7c02

Document a vulnerability in chromium < 25.0.1364.160

Obtained from:	http://googlechromereleases.blogspot.nl/search/Stable%20Updates

- Document vulnerabilities in typo3.

Security:       b9a347ac-8671-11e2-b73c-0019d18c446a
Obtained from: 
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/

Document vulnerabilities in www/chromium < 25.0.1364.152

Obtained from:	http://googlechromereleases.blogspot.nl/search/Stable%20Updates

- Document recent vulerability in security/stunnel (CVE-2013-1762)
Security:	c97219b6-843d-11e2-b131-000c299b62e1

- document apache22 issues
- tim trailing tabs

Document two sudo problems.

- Update to 0.9.14 to fix CVE-2013-1756

Security:	aa7764af-0b5e-4ddc-bc65-38ad697a484f

Update to 11.2r202.273

Security:	http://www.vuxml.org/freebsd/dbdac023-80e1-11e2-9a29-001060e06fd4.html

- Update affected ettercap versions: CVE-2012-0722 was fixed in
0.7.5.2-Assimilation

- Document 3 OTRS vulnerabilities from 2012
 - CVE-2012-4751
 - CVE-2012-4600
 - CVE-2012-2582

- Document Ruby REXML DoS

- Document rubygem-ruby_parser issue

- Document Django 2013-02-21 vulnerabilty

Approved by:	araujo (mentor)

Document vulnerabilities in www/chromium < 25.0.1364.97

Obtained from:	http://googlechromereleases.blogspot.nl/search/Stable%20Updates

Document security/krb5 1.11 and prior null pointer dereference in the
KDC PKINIT code [CVE-2013-1415].

Security:	CVE-2013-1415

Convert the ! back into a 1.

Noticed by:	crees

Add the latest two FreeBSD Security Advisories.

Document drupal7 Denial of service

- add an entry for net/nss-pam-ldapd stack-based buffer overflow

According to advisory, vulnerability exists in nss-pam-ldapd < 0.8.11,
but since we never had this version in the ports tree, mark everything
< 0.8.12 as vulnerable.

PR:		176293
Submitted by:	pluknet

Fix up the latest gecko update by:
- reapplying the workaround for svn:eol-style and svn:keywords
- fixing version matching in vuln.xml, 17.0.3 is NOT vulnerable

- update bugzilla ports to latest version

  Bugzilla 4.0.10 and 3.6.13 are security updates for the 4.0
  branch and the 3.6 branch, respectively. 4.0.10 contains several
  useful bug fixes and 3.6.13 contains only security fixes.

Security:	CVE-2013-0785
		CVE-2013-0786

- update firefox to 19.0
- update firefox-esr, thunderbird, linux-firefox, linux-thunderbird to 17.0.3
- update linux-seamonkey to 2.16
- update nspr to 4.9.5
- update nss to 3.14.3
- add DuckDuckGo search plugin to firefox [1]
- mark kompozer deprecated
- clang fixes for www/libxul19 [2]

Security:	http://www.vuxml.org/freebsd/e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02.html
Submitted by:	DuckDuckGo [1], dim [2]
In collaboration with:	Jan Beich <jbeich@tormail.org>

- Fix version range for recent ruby vulnerabilities
(d3e96508-056b-4259-88ad-50dc8d1978a6 and c79eb109-a754-45d7-b552-a42099eb2265)
due to missing port epoch in package range

Submitted by:	Matthias Andree <mandree@FreeBSD.org>

Combine ranges into one entry to prevent false positives

- Document rubygem-rack issue

- Document activemodel issue

Document Jenkins Security Advisory 2013-02-16

- add entry for dns/poweradmin

PR:		175704
Submitted by:	Edmondas Girkantas <eg@fbsd.lt> (maintainer of dns/poweradmin)

- Document ruby json issue

- Document vulnerability in rdoc

Update flash to the latest version

PR:		ports/175159
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp>

- Fix whitespaces

Fix vuxml build

- report openssl vulnerabilities

- update databases/mariadb-server to 5.3.12 [1]
- update databases/mariadb55-server 5.5.29 [2]

PR:		ports/175764 [1]
PR:		ports/175767 [2]
Submitted by:	Geoffroy Desvernay <dgeo@centrale-marseille.fr> (maintainer) [1]
Submitted by:	Alexandr Kovalenko <never@nevermind.kiev.ua> (maintainer) [2]
Security:	8c773d7f-6cbb-11e2-b242-c8600054b392

- report opera 12.12 vulnerabilities

Document devel/upnp vulnerabilities

Document wordpress multiple vulnerabilities.

Fix last entry: version 2.3.4 is also affected

Fix whitespace in previous commit.

XSS vulnerability in py-django-cms

Document vulnerabilities in www/chromium < 24.0.1312.56

Obtained
from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- update www/drupal6 to 6.28
- update www/drupal7 to 7.19

Security:	http://www.vuxml.org/freebsd/1827f213-633e-11e2-8d93-c8600054b392.html
Approved by:	portmgr (beat)

VuXML: add newly-allocated CVE for SQUID-2012:1

New CVE was allocated for the underfixed DoS and added possible
infinite loop in Squid 3.2 and 3.1.

VuXML: document buffer overflow in ettercap (CVE-2013-0722)
Reviewed by:	simon@

VuXML: document recent security manager bypass in Java 7.x
Reviewed by:	glewis@, simon@

Properly limit the match for PHP 5.3.x and 5.2.x versions.

Noticed by:	remko

Apply version ranges of php53 and php52 to php5 as well.

- Fix discovery date on nagios vulnerability  	(CVE-2012-6096)

www/squid3x: upgrade to 3.1.23 and 3.2.6

Squid 3.1.23 is effectively Squid 3.1.22_2 with the final fix for
CVE-2012-5643 applied.

Squid 3.2.6 also received that abovementioned fix, but in comparison
with 3.2.5 from ports it has another change that fixes handling the
"tcp_outgoing_tos" directive for BSD-like systems, including FreeBSD,
  http://bugs.squid-cache.org/show_bug.cgi?id=3731

VuXML entry for SQUID:2012-1 (aka CVE-2012-5643) was also updated to
reflect the proper version specifications from the updated advisory,
  http://www.squid-cache.org/Advisories/SQUID-2012_1.txt

Approved by:	Thomas-Martin Seck <tmseck@web.de>
Security:	http://portaudit.freebsd.org/c37de843-488e-11e2-a5c9-0019996bc1f7.html
QA page:	http://codelabs.ru/fbsd/ports/qa/www/squid31/3.1.23
QA page:	http://codelabs.ru/fbsd/ports/qa/www/squid32/3.2.6

- Document vulnerability in net-mgmt/nagios (CVE-2012-6096)

Document vulnerabilities in www/chromium < 24.0.1312.52

Obtained
from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- update firefox, thunderbird, linux-firefox and linux-thunderbird to 17.0.2
- update firefox-esr, thunderbird-esr and libxul to 10.0.12
- update linux-seamonkey to 2.15

Security:	http://www.vuxml.org/freebsd/a4ed6632-5aa9-11e2-8fcb-c8600054b392.html

Fix <topic> style: common dash style, remove softvare versions

- Update rubygem-rails to 3.2.11
- Update ports require by rubygem-rails
- Add vuxml entry for rails security issues

Security:	ca5d3272-59e3-11e2-853b-00262d5ed8ee
Security:	b4051b52-58fa-11e2-853b-00262d5ed8ee

- Properly copy namespace attributes/resolve make validate issues

Reviewed by:	simon@, eadler@
Approved by:	zi (with ports-secteam hat)

Document Jenkins 2013-01-04 Security Advisory

VuXML: extend entry for MoinMoin vulnerabilities fixed in 1.9.6

Use more verbose descriptions from CVE entries and trim citation
from CHANGES to the relevant parts.

Document Django 2012-12-10 vulnerabilty

VuXML: fix r309982

Use proper tags for CVE identifiers.  I should run 'make validate'
_every_ time before committing.
Pointyhat to:	rea

VuXML for MoinMoin issues: add CVE references

Freetype 2.4.8 vulnerabilities were already documented.

While here, correct pkgname

Noticed by:	kwm

Mark moinmoin vulnerable

Security:	http://www.debian.org/security/2012/dsa-2593

document freetype vulnerabilities

Security:	CVE-2012-(1126-1144)

Bump copyright to 2013.

Add correct version numbers to the recent asterisk entry

Pointy hat to:	flo

- update net/asterisk to 1.8.19.1
- update net/asterisk10 to 10.11.1
- update net/asterisk11 to 10.1.2
- add vuln.xml entry

Security:	f7c87a8a-55d5-11e2-a255-c8600054b392

Note charybdis and ircd-ratbox vulnerabilities

PR:		ports/174878
Security:	http://www.ratbox.org/ASA-2012-12-31.txt

Separate entries for Puppet 2.6 and 2.7.

Add OTRS vulnerabilities

VuXML entries for Tomcat: split into three distinct ones

They affect different Tomcat versions from 7.x branch, so don't let
users of VuXML be fooled on the affected software for each vulnerability.

Feature safe:	yes

VuXML: add entry for DoS in Squid's cachemgr.cgi

Feature safe:	yes
Submitted by:	Thomas-Martin Seck <tmseck@web.de>

Remove invalid entry

- add entry for opera 12.11

Fix typo.

Noticed by:	mandree

- add url block in references for 1657a3e6-4585-11e2-a396-10bf48230856

Update linux-f10-flashpulgin11 to 11.2r202.258 to address multiple
vulnerabilities that could cause a crash and potentially allow an
attacker to take control of the affected system.

Submitted by:	Tsurutani Naoki <turutani scphys kyoto-u ac jp>

Document vulnerabilities in www/chromium < 23.0.1271.97

Obtained
from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates

- Fix recent vulnerability entry for www/tomcat[67]

Reported by:	Victor Balada Diaz <victor@bsdes.net>
Feature safe:	yes

- Document recent vulnerabilities in www/tomcat6 and www/tomcat7

Requested by:	Victor Balada Diaz <victor@bsdes.net>
Feature safe:	yes

Update to the latest patch level from ISC:

  BIND 9 nameservers using the DNS64 IPv6 transition mechanism are
  vulnerable to a software defect that allows a crafted query to
  crash the server with a REQUIRE assertion failure.  Remote
  exploitation of this defect can be achieved without extensive
  effort, resulting in a denial-of-service (DoS) vector against
  affected servers.

Security:	2892a8e2-3d68-11e2-8e01-0800273fe665
		CVE-2012-5688
Feature safe:	yes

Add URL for recent bogofilter heap vuln', CVE-2012-5468, aka. vuln vid=
f524d8e0-3d83-11e2-807a-080027ef73ec

Feature safe: yes

Update bogofilter to new upstream release 1.2.3.
Security update to fix a heap corruption bug with invalid base64 input,
reported and fixed by Julius Plenz, FU Berlin, Germany.

Feature safe:   yes
Security:       CVE-2012-5468
Security:       f524d8e0-3d83-11e2-807a-080027ef73ec

Document vulnerabilities in www/chromium < 23.0.1271.95

Obtained
from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
Feature safe:	yes

www/yahoo-ui
 - fix CVE-2012-5881

security/vuxml
 - adjust version (we have only 2.8.2 in the tree)

Feature safe: yes

Approved by:	glarkin (maintainer) explicit

Fix date in yahoo-ui entry.

Noticed by:	dvl@
Feature safe:	yes

- document www/yahoo-ui security issue and mark port forbidden [1]
  pet portlint (maintainer is already notified)

- adjust CVE entries for bugzilla (CVE-2012-5475 was rejected) [2]

Feature safe: yes

Security:	CVE-2012-5881 [1][2]
		CVE-2012-5882 [1][2]
		CVE-2012-5883 [2]

Approved by:	glarkin (implicit) [1]

Describe new vulnerabilities in www/chromium < 23.0.1271.91

Obtained
from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
Feature safe:	yes

- Update backports patch to 20121114
- Bump PORTREVISION

Changes:
- CVE-2006-7243
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow
context-dependent attackers to bypass intended access restrictions by placing a
safe file extension after this character, as demonstrated by .php\0.jpg at the
end of the argument to the file_exists function

Secuity 3761df02-0f9c-11e0-becc-0022156e8794 fixed by check in fopen functions
for strlen(filename) != filename_len

- CVE-2012-4388
The sapi_header_op function in main/SAPI.c does not properly determine a pointer

Add entries for the following advisories:

FreeBSD-SA-12:08.linux
FreeBSD-SA-12:07.hostapd
FreeBSD-SA-12:06.bind

Feature safe:	yes

- opera -- execution of arbitrary code
Feature safe: yes

Document new vulnerability in www/lighttpd 1.4.31

Feature safe:	yes

- Update firefox and thunderbird to 17.0
- Update seamonkey to 2.14
- Update ESR ports and libxul to 10.0.11
- support more h264 codecs when using GSTREAMER with YouTube
- Unbreak firefox-esr, thunderbird-esr and libxul on head >= 1000024 [1]
- Buildsystem is not python 3 aware, use python up to 2.7 [2]

PR:		ports/173679 [1]
Submitted by:	swills [1], demon [2]
In collaboration with:	Jan Beich <jbeich@tormail.org>
Security:	d23119df-335d-11e2-b64c-c8600054b392
Approved by:	portmgr (beat)
Feature safe:	yes

- Fix copy and paste error in latest weechat entry
  (81826d12-317a-11e2-9186-406186f3d89d)

Feature safe:	yes

- Document new vulnerability in irc/weechat and irc/weechat-devel

Feature safe:	yes

- bugzilla security updates to version(s)
  3.6.11, 4.0.8, 4.2.4

Summary
=======

The following security issues have been discovered in Bugzilla:

* Confidential product and component names can be disclosed to
  unauthorized users if they are used to control the visibility of
  a custom field.

* When calling the 'User.get' WebService method with a 'groups'
  argument, it is possible to check if the given group names exist
  or not.

- Update recent weechat entry (e02c572f-2af0-11e2-bb44-003067b2972c)

- Document assigned CVE Identifier
- Document workaround for vulnerable versions

Feature safe:	yes