security/vuxml: Document CVE-2023-6152 for www/grafana*

PR:		277184

security/vuxml: Record dns/c-ares vulnerability

security/vuxml: Record security/suricata multiple vulnerabilities

No details for this CVEs yet.

CVE-2024-23839 – Critical severity
CVE-2024-23836 – Critical severity
CVE-2024-23835 – High severity
CVE-2024-24568 – Moderate severity
CVE-2024-23837 – Critical severity

PR:	277025
Reported by:	franco@opnsense.org
MFH:		2024Q1 (security fixes)

security/vuxml: document electron27 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.3.3

security/vuxml: document gitlab vulnerabilities

security/vuxml: Add lower bound on new www/nginx-devel vuln

security/vuxml: document dns/powerdns-recursor vulnerabilities

* CVE-2023-50387
* CVE-2023-50868

PR:		277048
Reported by:	Ralf van der Enden <tremere@cainites.net>

security/vuxml: document www/gitea vulnerability

Prevent anonymous container access if RequireSignInView is enabled

PR:	277066

security/vuxml: Document www/nginx-devel vulns: CVE-2024-24989, CVE-2024-24990

security/vuxml: Add sysutils/eza vulnerability

Include eza port in the Libgit2 entry.

Approved by:	dbaio (mentor), garga (mentor)
Differential Revision:	https://reviews.freebsd.org/D43868

security/vuxml: add FreeBSD SAs released on 2024-02-14

FreeBSD-SA-24:01.bhyveload affects all supported releases of FreeBSD.
FreeBSD-SA-24:02.tty affects all supported releases of FreeBSD.

security/vuxml: add www/*chromium < 121.0.6167.184

Obtained
from:	https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_13.html

security/vuxml: document dnssec validating resolver DoS vuln...

for Bind9, dnsmasq, PowerDNS, Unbound.

Security:	21a854cc-cac1-11ee-b7a7-353f1e043d9a
Security:	CVE-2023-50387
Security:	CVE-2023-50868

security/vuxml: add phpmyfaq < 3.2.5

security/vuxml: fix NS tag on body of Gitlab vuln entry

This fixes a vxquery warning (line number may vary):

| Parsing failed @ line 4442:
| Expected element in XHTML namespace.

Security:	6e0ebb4a-5e75-11ee-a365-001b217b3468

security/vuxml: Add openexr<3.2.2 (<3.1.12) heap overflow

Security:	CVE-2023-5841
Security:	f161a5ad-c9bd-11ee-b7a7-353f1e043d9a

security/vuxml: Document vulnerability in readstat

security/vuxml: add vulnerability for p5-Spreadsheet-ParseExcel

https://nvd.nist.gov/vuln/detail/CVE-2023-7101

security/vuxml: Add qt[56]-webengine

qt5-webengine and qt6-webengine are also vulnerable to:
dc9e5237-c197-11ee-86bb-a8a1599412c6
19047673-c680-11ee-86bb-a8a1599412c6

qt5-webengine is also vulnerable to:
bbcb1584-c068-11ee-bdd6-4ccc6adda413

vuxml: fix cve name for postgres

This was breaking the build of the vuxml website

security/vuxml: add issue for PostgreSQL

https://www.postgresql.org/support/security/CVE-2024-0985/

security/vuxml: document gitlab vulnerabilities

security/vuxml: Add new php-composer vulnerability.

security/vuxml: document a libgit2 vulnerability

security/vuxml: add www/*chromium < 121.0.6167.160

Obtained
from:	https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop.html

security/vuxml: Document multiple vulnerabilities in clamav

security/vuxml: Document django multiple vulnerabilities

security/vuxml: add www/*chromium < 121.0.6167.{85,139}

Obtained
from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_23.html
Obtained
from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html

security/vuxml: document electron{26,27,28} use after free in Web Audio

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.8,
		https://github.com/electron/electron/releases/tag/v27.3.1,
		https://github.com/electron/electron/releases/tag/v28.2.1

security/vuxml: Document qt6-webengine vulnerabilities

security/vuxml: Register OpenSSL vulnerabilities

security/vuxml: document lizard memory corruption

Obtained from:	https://nvd.nist.gov/vuln/detail/CVE-2018-11498

security/vuxml: Document qt(5|6)-webengine vulnerabilities

security/vuxml: Fix krb5-devel version number

security/vuxml: document rclone vulnerabilities

CVE-2023-48795:	Base Score:  5.9 MEDIUM
		Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2023-45286:	Base Score:  5.9 MEDIUM
		Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

PR:	276515

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document Jenkins Security Advisory 2024-01-24

Sponsored by:	The FreeBSD Foundation

security/vuxml: Document TinyMCE vulnerability

 * Note that www/tinymce is not affected
 * Document supply-chain vuln in Roundcube

security/vuxml: Mark zeek < 6.0.3 as vulnerable as per:

    https://github.com/zeek/zeek/releases/tag/v6.0.3

This release fixes the following potential DoS vulnerability:

 - A specially-crafted series of packets containing nested MIME
   entities can cause Zeek to spend large amounts of time parsing
   the entities.

Reported by:	Tim Wojtulewicz

security/vuxml: document electron26 uut of bounds memory access in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.7

security/vuxml: mark electron26 < 26.6.6, electron27 < 27.2.4 as vulnerable

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.6,
		https://github.com/electron/electron/releases/tag/v27.2.4

security/vuxml: document electron27 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.2.3

security/vuxml: add www/*chromium < 120.0.6099.224

Obtained
from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html

(cherry picked from commit 105eebecb78a6fcd68b0477fb8ec502a9df29ef2)

security/vuxml: add xwayland-devel to 62bb32d7090f list

security/vuxml: Document xorg-server and xwayland recent vulnerabilities

Sponsored by:	Beckhoff Automation GmbH & Co. KG

security/vuxml: document electron{26,27} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.5,
		https://github.com/electron/electron/releases/tag/v27.2.2

security/vuxml: document gitlab vulnerabilities

security/vuxml: Document OpenSSL ppc vulnerability

security/vuxml: add www/*chromium < 120.0.6099.216

Obtained
from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html

security/vuxml: Fix copypasta typo

security/vuxml: Document QtNetwork buffer overflow

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17,
6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before
6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer
overflow check.

Base Score:	9.8 CRITICAL
Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

security/vuxml: add databases/mantis-php* < 2.25.8

Obtained from https://mantisbt.org/bugs/changelog_page.php?version_id=370

PR:		276146

security/vuxml: add www/*chromium < 120.0.6099.199

Obtained
from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html

security/vuxml: document electron27 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.2.1

security/vuxml: document electron26 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.4

security/vuxml: add FreeBSD SA released on 2023-12-19

FreeBSD-SA-23:19.openssl affects all supported releases of FreeBSD.

FreeBSD 12.4 reached its end of life at the end of December 2023.  Users
are encouraged to either implement the documented workaround or leverage
an up to date version of OpenSSH from the ports/pkg collection.

security/vuxml: add 2024 entity

security/vuxml: unexpand spaces for gitea 482bb980-99a3-11ee-b5f7-6bd56600d90c

security/vuxml: extend openvpn vuln entry to openvpn-devel < g20231109,1

Security:	2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security:	CVE-2023-46849
Security:	CVE-2023-46850

security/vuxml: Add www/qt5-webengine

qt5-webengine < 5.15.16.p5_2 is also affected by the following VuXML
IDs:

- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6

security/vuxml: Add www/qt6-webengine

qt6-webengine < 6.6.1_1 is also affected by the following VuXML IDs:

- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6

devel/zookeeper: Update version 3.8.1=>3.8.3

- Fixes critical security vulnerability
- Return to pool
- Add entry in vuxml

PR:		275999
Approved by:	submitter is maintainer

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.3,
		https://github.com/electron/electron/releases/tag/v27.2.0

www/gitea: Update version 1.21.0=>1.21.3

- Add relevant vuxml entry
- Move pkg-message to SUB_FILES as we are using PREFIX

Changelog: https://blog.gitea.com/release-of-1.21.3/

PR:		275742
Approved by:	submitter is maintainer

security/vuxml: document nebula vulnerability

security/vuxml: add www/*chromium < 120.0.6099.129

Obtained
from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html

security/vuxml: add security/putty[-nogtk] < 0.80 'Terrapin' vulnerability

Security:	91955195-9ebb-11ee-bc14-a703705db3a6
Security:	CVE-2023-48795

security/vuxml: add an entry for slurm-wlm

security/vuxml: add CouchDB CVE details

Security:	CVE-2023-26268
Sponsored by:	SkunkWerks, GmbH

security/vuxml: document gitlab vulnerabilities

security/vuxml: adjust 12.4 range of FreeBSD SA-23:17.pf

Similar to what I did in 4826396e5d1555b9eebf58cac290490b24bf1243,
adjust the 12.4 releases affected by FreeBSD SA-23:17.pf.

There is no 100% correct way to encode this issue in vuxml.  Since the
issue only affects pf.ko, freebsd-update does not rebuild the kernel.

PR:		275743
Reported by:	martin@lispworks.com

security/vuxml: add www/*chromium < 120.0.6099.109

Obtained
from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html

security/vuxml: add FreeBSD SA released on 2023-12-12

FreeBSD-SA-23:18.nfsclient affects FreeBSD 14.0 and 13.2.

security/vuxml: mark xorg-server < 21.1.10,1 as vulnerable

security/vuxml: add www/*chromium < 120.0.6099.62

Obtained
from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html

secuirty/vuxml: Remove duplicate entry

A previous entry for CVE-2023-41913 was added in
8c6ee1a1c2df0d7a769c1fd50f0366ded3798e86

PR:		275620
Reported by:	eugen@
Fixes:		eea55ca7b5c621fd4f032b1f256b8472fbae2b15

security/vuxml: Record kafka vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Apache
ZooKeeper.

Note that this only affects SASL Quorum Peer authentication which is
not enabled by default.

 Base Score:	9.1 CRITICAL
 Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

PR:	275611

security/vuxml: Record strongswan buffer overflow

strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated
remote code execution via a DH public value that exceeds the internal buffer in
charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can
occur via a crafted IKE_SA_INIT message.

NVD score not yet provided.

PR:	275620

security/vuxml: document electron25 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.8

security/vuxml: correct last SA's affected range

FreeBSD-SA-23:17.pf only affects the kernel, not userland.  The first
patch level of the kernel without the vulnerability is 13.2_4, not
13.2_7.

Reported by:	dvl

security/vuxml: add FreeBSD SA released on 2023-12-05

FreeBSD-SA-23:17.pf affects all supported releases (12.4, 13.2, 14.0).

security/vuxml: Add Varnish Cache vulnerability

security/vuxml: Add www/qt6-webengine

qt6-webengine < 6.6.1 is also affected by the following VuXML IDs:
- 6d9c6aae-5eb1-11ee-8290-a8a1599412c6
- 07ee8c14-68f1-11ee-8290-a8a1599412c6
- a1e27775-7a61-11ee-8290-a8a1599412c6
- 0da4db89-84bf-11ee-8290-a8a1599412c6

security/vuxml: document gitlab vulnerabilities

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.7,
		https://github.com/electron/electron/releases/tag/v26.6.2

security/vuxml: add www/*chromium < 119.0.6045.199

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html

security/vuxml: Add devel/cmake-core

VuXML ID d6c19e8c-6806-11ee-9464-b42e991fc52e also affects the bundled
libcurl in devel/cmake-core < 3.27.8.

security/vuxml: Document MariaDB vulnerability

security/vuxml: Add www/qt5-webengine

VuXML ID 0da4db89-84bf-11ee-8290-a8a1599412c6 also affects
www/qt5-webengine < 5.15.16.p5

security/vuxml: document strongSwan vulnerability CVE-2023-41913

Security:	a62c0c50-8aa0-11ee-ac0d-00e0670f2660
Security:	CVE-2023-41913

security/vuxml: document electron use after free in Garbage Collection

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.6,
		https://github.com/electron/electron/releases/tag/v26.6.1

security/vuxml: add www/*chromium < 119.0.6045.159

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_14.html

security/vuxml: document electron use after free in WebAudio

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.5,
		https://github.com/electron/electron/releases/tag/v26.6.0

security/vuxml: 2.6.0 <= openvpn < 2.6.7 vulnerabilities

Related to:

PR:		275055
Security:	2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security:	CVE-2023-46849
Security:	CVE-2023-46850

This specifically documents < 2.6.7_1 in order to collect the
regression fix for https://github.com/OpenVPN/openvpn/issues/449
which was a bug newly introduced into 2.6.7.

security/vuxml: Record typo3-1{12} vulnerabilities

PR: 275073 275074

security/vuxml: add issues for PostgreSQL

https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/

security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.4,
		https://github.com/electron/electron/releases/tag/v26.5.0

security/vuxml: Document libsndfile vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2022-33065

security/vuxml: add www/*chromium < 119.0.6045.123

Obtained
from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop.html

security/vuxml: Document OpenSSL vulnerability