Update to reflect the fixed version of id3lib.

Document id3lib insecure temporary file creation vulnerability

- modify mediawiki entry (add missing mediawiki18)

Reviewed by:    remko

Some PHP 5.x vulnerabilities is also found in PHP 4.x series,
unfortunately it seems that there is no newer PHP release to
fix these issue for 4.x series, so mark it as so.

While I'm there add a new CVE that was not mentioned in
previous revision of entry.

Document mediawiki -- cross site scripting vulnerability, our port versions
had not been updated yet, 1.8.x is not vulnerable by default unless you are
using the $wgEnableAPI = true; statement, in that case please set it to
$wgEnableAPI = false; (where possible ofcourse, else upgrade to 1.8.5).

Document wordpress -- remote sql injection vulnerability, our versions are
already up to date for this vulnerability.

samba -- nss_info plugin privilege escalation vulnerability, the FreeBSD
port had already been fixed for this.

Document bugzilla -- multiple vulnerabilities

PR:             ports/116060
Submitted by:   Nick Barkas <snb at threerings dot net>, minor nits from me

Document clamav CVE-2007-4510 issue (Remote DoS).

Document coppermine -- multiple vulnerabilities, the FreeBSD
port is already up to date.

Document openoffice -- arbitrary command execution vulnerability,
all current versions marked vulnerable, everything as of 2.3 is
believed to be fixed, but we do not have that yet ( I am also not
sure whether the -devel version has the correct fix or not ) so
lets be on the safe side till we know what version will be fixed
in our repro.

Document bugzilla -- "createmailregexp" security bypass vulnerability,
marking all versions as vulnerable till we know what version is the
one fixed in our CVS repository.

Spell Ulf Harnhammar (ASCII version of name) using UTF-8 instead of HTML
entities which can't be assumed is available to a paser by default.

This fixes a warning from packaudit.

Document kdm -- passwordless login vulnerability
Document konquerer -- address bar spoofing

Inspired by:    lofi's cvs commits

Document flyspray -- authentication bypass

Submitted by:   Nick Hilliard <nick at foobar dot org>

Document mozilla -- code execution via Quicktime media-link files,
The Mozilla advisory talks somewhat about Windows for this matter,
but better be safe then sorry (An updated firefox is available already).

Update the PHP vulnerability entry:

 - Use php5 to cover php 5.x as the port did.
 - Add more information about the vulnerability.

Submitted by:   Nick Barkas <snb threerings net>
PR:             ports/116182

Correct a style nit and bump modification date.
Bump modification date for "xpdf -- stack based buffer overflow"
which was forgotten by Jeremy (mezz) :-)

Document Apache 2.0.x, 2.2.x series' vulnerabilities as well
as security related improvements in php 5.2.4.

There is no code of CVE-2007-3387 vulnerability in evince, therefore remove
it from the database. It only merely depends on poppler and poppler has been
patched (marked as safe in database).

- lighttpd -- FastCGI header overrun in mod_fastcgi

Fix mod_jk's version since PORTEPOCH came into play.

PR:             116115
Reported by:    Klavs Klavsen <klavs at EnableIT dot dk>

rkhunter -- insecure temporary file creation

Reviewed by:    remko

lsh -- multiple vulnerabilities

Reviewed by:    remko

Document fetchmail -- denial of service on reject of local
warning message.

Submitted by:   Matthias Andree <matthias.andree@gmx.de>
PR:             ports/??? (Not received by GNATS yet)

Document gtar directory traversal vulnerability.

PR:             115914
Submitted by:   Nick Barkas <snb@threerings.net>

- Marked sylpheed2 as safe.

Reviewed by:    remko

- Fix a typo.

- Document Sylpheed / Sylpheed-Claws POP3 Format String Vulnerability

Reviewed by:    simon

From latest Opera entry:
- Remove redundant information.
- Bump modified date for recent changes to the entry.

linux-opera and (for the moment defunct) opera-devel are also affected by
df4a7d21-4b17-11dc-9fc2-001372ae3ab9 - Vulnerability in javascript handling so
addd them to the entry.

Submitted by:   sat@

Update vuln.xml for rsync 2.6.9_1 which fixed CVE-2007-4091

Document rsync off-by-one stack overflow vulnerability.

- Update the wordpress -- unmoderated comments disclosure entry. Is safe with
the 2.2.2 Release.

Approved by:    simon

Add info about www/opera's JavaScript vulnerability

PR:             ports/115543
Submitted by:   Arjan van Leeuwen (maintainer)
Reviewed by:    simon@

Fix the flac entry by specificing the correct fixed version.
Bump modification date to reflect the above change.

Submitted by:   Stefan Ehmann

- Document fsplib -- multiple vulnerabilities

Reviewed by:    remko

Document joomla -- multiple vulnerabilities

Approved by:    simon/remko

Use the superseded attribute in the cancelled tcpdump entry.

Requested by:   simon

Document FreeBSD -- Buffer overflow in tcpdump(1).

See: FreeBSD-SA-07:06.tcpdump

This commit also takes over the older tcpdump entry that was specific
to ports, I merged that into this entry and I retired the old one.

Bump modification date for: SA-07:04.file
Which I just touched.

Correct the fixed version for the jail advisory which was revised yesterday.

Also correct the <freebsdsa>FreeBSD-SA* tags which should not have FreeBSD
in between.

Document FreeBSD -- Predictable query ids in named(8)

See: FreeBSD-SA-07:07.bind

- Marked phpSysInfo as safe

Reviewed by:    remko

Update phpSysInfo entry: the current version (2.5.3) is affected.

Update mozilla entry
- Marked seamonkey as safe

Submitted by:   John E. Hein <jhein@timing.com>
Reviewed by:    simon

Update the xpdf entry
- Marked poppler as save

Update xpdf entry
- Marked cups-base as safe
- Add poppler as affected port

Reviewed by:    simon

- Fix tcpdump entry

Document xpdf -- stack based buffer overflow

Reviewed by:    simon/remko

- Fix a typo

Submitted by:   shaun

- Document tcpdump -- remote integer underflow vulnerability

Reviewed by:    remko

- Document mutt -- buffer overflow vulnerability

Reviewed by:    remko

- Document p5-Net-DNS -- multiple Vulnerabilities

Reviewed by:    remko

- Document phpsysinfo -- url Cross-Site Scripting

- Document drupal -- Cross site request forgeries
- Document drupal -- Multiple cross-site scripting vulnerabilities

Submitted by:   nick@foobar.org
Reviewed by:    simon

- Document vim -- Command Format String Vulnerability

Approved by:    simon

- Document libvorbis - Multiple memory corruption flaws

Submitted by:   lx@
Reviewed by:    simon

Document XSS vulnerabilities in several tomcat versions;
update affected tomcat versions for CVE-2005-2090.

The previous vuxml entry applies to jakarta-tomcat 4.0.x as well, so mark
it as affected as well.  Since there is no newer release I have used 4.1.0
as the "fixed" version.

Document multiple vulnerabilities found in www/tomcat41

Document dokuwiki spellchecker XSS vulnerabilities

Fix last commit: the name tag was empty.

Reported by:    FreshPorts via Dan Langille
Pointyhat to:   delphij

Document lighttpd multiple vulnerabilities

Add another reference to mozilla -- multiple vulnerabilities.

- Document opera -- multiple vulnerabilities.
- Correct and sort a few links in the latest mozilla entry.

Document mozilla -- multiple vulnerabilities.

Document linuxflashplugin critical vulnerabilities.

Reported by:    jamie at bishopston net

- Fix the versions number of typespeed from 4.1.0 to 0.4.1

PR:             114441
Submitted by:   Tor Halvard Furulund <squat@squat.no>

- Fix the latest wireshark entries by correcting a typo and adding
  more package names

- Document wireshark - Multiple problems

Reviewed by:    simon@

- Document typespeed arbitrary code execution

Reviewed by:    remko

- Fix a typo vcl -> vlc

Noticed by:     lx@

- Document vlc - format string vulnerability and integer overflow

- Document flac123 - stack overflow in comment parsing

Reviewed by:    simon@

Document gd -- multiple vulnerabilities

PR:             ports/114115
Submitted by:   Nick Barkas <snb at threerings dot net> (minor modifications by
me).

Document that CVE-2007-3257 was fixed with evolution-data-server
1.10.2_1.

- Fix modified date in mod_perl entry

Mark www/mod_perl2 fixed in version 2.0.3_2,3

Document evolution-data-server remote arbitrary code execution
vulnerability.

Fix at: Evolution SVN changeset 7817 (#447414)

The XMLRPC SQL Injection issue with wordpress was addressed in the
latest release.

Document xpcd buffer overflow vulnerability.

Revieved by:    remko

Document clamav -- multiple vulnerabilities.

Document SpamAssassin vulnerability CVE-2007-2873, a local
DoS issue.

- Document cups -- Incomplete SSL Negotiation Denial of Service.

Reviewed by:    simon@

- Fix other duplicate entry.

Reviewed by:    simon

- Document c-ares -- DNS Cache Poisoning Vulnerability

Reviewed by:    simon@

- Fix duplicate entry de-wordpress -> zh-wordpress.

Add zh-wordpress as affected by the last two wordpress entries.

wordpress -- XMLRPC SQL Injection
wordpress -- unmoderated comments disclosure

Reviewed by:    simon

- Document webmin -- cross site scripting

Reviewed by:    simon@

- The fixed mplayer version number is 0.99.10_10, mark it as such. [1]
- Add older mplayer package names.
- Break long lines.

Noticed by:     Henrik Brix Andersen <henrik@brixandersen.dk>

- Fix mplayer portversion.

- Document mplayer -- cddb stack overflow.

Reviewed by:    simon@

- Note that plone is also affected by 34414a1e-e377-11db-b8ab-000c76189c4c
  prior to version 2.5.3

Reviewed by:    simon

- gzip 1.3.12 has been patched and is not affected by
  11a84092-8f9f-11db-ab33-000e0c2e438a any more

Reviewed by:    simon

Document an information disclosure vulnerability in mod_jk < 1.2.23.

Reviewed by:    simon

Add an entry for an email header injection vulnerability in
www/typo3 from February.

Reviewed by:    remko
Persuaded by:   cperciva and simon by setting up the
                ports-security team

- Document phppgadmin - Cross Site Scripting Vulnerability.

Reviewed by:    mnag@
Reported by:    dinoex@

- Add entry for findutils -- GNU locate heap buffer overrun.

Revieved by:    simon (secteam)
Approved by:    miwi (mentor)