Make the rubygem-rails -- JSON XSS vulnerability entry valid UTF-8 (at
least the special chars doesn't look like UTF-8 as per emacs or
freshports).

Reported by:    freshports via dvl
Approved by:    portmgr (secteam blanket)

Also cover rubygem-activesupport which is part of rails and is
affected by CVE-2007-3227 as well.

Approved by:    portmgr (ports-security blanket)

Document recent Ruby On Rails vulnerabilities.

Approved by:    portmgr (ports-security blanket)

Document ikiwiki improper symlink verification vulnerability.

Reviewed by:    remko
Approved by:    portmgr (erwin), erwin (mentor)

Document firefox multiple unspecified memory corruption vulnerabilities.

Approved by:    portmgr (ports-security blanket)

- Document phpmyadmin -- Cross Site Scripting

Reviewed by:    remko
Approved by:    portmgr (ports-security blanket

- Update last Samba entry,
        * Add reference to the samba advisories
        * Fix the PORTVERSION/PORTEPOCH

Reviewed by:    simon
Approved by:    portmgr (ports-security blanket)

 Document samba - multiple vulnerabilities

Reviewed by:    remko
Approved by:    portmgr (ports-security blanket)

postnuke 0.763 is not vulnerable to 35f2679f-52d7-11db-8f1a-000a48049292
so mark it as not vulnerable.

Approved by:    portmgr (ports-security blanket)

Improve JDK version coverage.  We should consider PORTEPOCH'ed version
separately, so restruct the range.

Approved by:    portmgr (ports-security blanket)

Document PHP multiple vulnerabilities that are fixed by php 5.2.5.

Approved by:    portmgr (ports-security blanket)

- Fix c93e4d41-75c5-11dc-b903-0016179b2dd5 entry

Submitted by:   glewis
Reviewed by:    remko
Approved by:    portmgr (ports-security blanket)

print/cups-base is vulnerable for all previous versions to
1.3.3_2, not all coming ones.

Submitted by:   Andrew Daugherity <ADaugherity@vprmail.tamu.edu>
Approved by:    portmgr (self)

Document mt-daapd -- denial of service vulnerability, also
correct the previous entry style wise.

Submitted by:   Mark D. Foster <mark at foster dot cc> with minor
                modifications by me.

Approved by:    portmgr (secteam blanket)

- Update xpdf -- multiple remote Stream.CC vulnerabilities
         * Mark cups-base as safe

Approved by:    portmgr (ports-security blanket)

o Add a patch for CVE-2007-5846, and add an entry for vuxml.

Approved by:  portmgr (marcus)

- Document flac -- media file processing integer overflow vulnerabilities

Reviewed by:    simon
Approved by:    portsmgr (ports-security blanket)
Thanks to:      naddy

Unbreak file by closing </li> tag.

Approved by:    portmgr (secteam blanket)

Document xpdf arbitrary code execution vulnerability, as documented in
CVE-2007-4352, CVE-2007-5392, CVE-2007-5393.

Approved by:    portmgr (ports-security blanket)

dinoex@ has choosen to apply a vendor patch that has resolved CVE-2007-4351
instead of upgrading to 1.3.4.  Mark this updated version as not vulnerable.

Approved by:    portmgr (ports-security blanket)

Document plone arbitrary code execution vulnerability.

Approved by:    portmgr (ports-security blanket)

- Updated the last gftp entry (we have 2.0.18_6 in the portstree not 2.10.18_6)

Submitted by:   Fabian Keil (via private mail)
Approved by:    portmgr (ports-security blanket)

- Document phpmyadmin -- cross-site scripting vulnerability

Reviewed by:    simon
Approved by:    portmgr (ports-security blanket)

Document gallery2 multiple vulnerabilities.

Approved by:    portmgr (ports-security blanket)

- Document tikiwiki -- multiple vulnerabilities

Reviewed by:    simon
Approved by:    portmgr (ports-security blanket)

Document cups-base remote buffer overflow vulnerability.

Approved by:    portmgr (ports-security blanket)

Make perl entry to cover perl-threaded as well.

Reported by:    Andy Greenwood <greenwood.andy gmail com>
Approved by:    portmgr (ports-security blanket)

- Document perl --  regular expressions unicode data buffer overflow

Reviewed by:    simon/tobez
Approved by:    portmgr (blanket) (ports-security blanket)

Document pcre arbitrary code execution vulnerability.

Approved by:    portmgr (ports-security blanket)

- perdition entry - correct range

Approved by:    portmgr (pav) linimon (mentor)

- Add entry for mail/perdition

PR:             ports/117796
Approved by:    portmgr (pav), linimon (mentor)

- gftp -- multiple vulnerabilities

Reviewed by:    simom
Approved by:    portmgr (blanket) (ports-security blanket)

- Update dirproxy -- remote denial of service
         * Add net/dirproxy with the same affect
         * Update net/dirproxy-devel as safe

Reviewed by:    simon
Approved by:    portmgr (blanket) (ports-security blanket)

- dirproxy -- remote denial of service

Reviewed by:    remko
Approved by:    portmgr (blanket) (ports-security blanket)

- Fix discovery date on my previous commit

Approved by:    portmgr (ports-security blanket)

- document wordpress -- cross-site scripting

Reviewed by:    simon
Approved by:    portmgr (ports-security blanket)

Extend coverage to OpenLDAP 2.4.x series which is affected according
to CVS history.

Approved by:    portmgr (ports-security blanket)

Document openldap multiple vulnerabilities.

Approved by:    portmgr (ports-security blanket)

Bump modified date for entry updated in last commit.

Approved by:    portmgr (secteam blanket)

Update vuxml to reflect that mod_jk and mod_jk-ap2 have
different portepochs.

Approved by:    portmgr (pav)

- Update mozilla -- code execution via Quicktime media-link files

PR:             117704
Submitted by:   John Hein <jhein@timing.com>
Reviewed by:    simon
Approved by:    portmgr (blanket) secteam (blanket via simon)

Document django DoS issue.

- Fix day entry for 498a8731-7cfc-11dc-96e6-0012f06707f0

Reviewed by:    simon

- Document opera -- multiple vulnerabilities

Reviewed by:    remko

- Document drupal --- multiple vulnerabilities

Reviewed by:    simon

- Document ldapscripts -- Command Line User Credentials Disclosure

PR:             117152
Submitted by:   Ganael Laplanche <ganael.laplanche at martymac.com>
(maintainer/author)
                rafan@
Reviewed by:    simon@

Modify firefox entry to cover linux-* variants.

Document firefox JavaScript Entrapment vulnerabilities.

- Fix year entry in 498a8731-7cfc-11dc-96e6-0012f06707f0

Submitted by:   freshports
Thanks to:      Dan Langille

- Add new line between entries.

- Add entry about recent phpMyAdmin XSS server_status.php vulnerability
- Fix URL in my previous entry while I'm here.

- Fix package name in 51b51d4a-7c0f-11dc-9e47-0011d861d5e2 and
  229577a8-0936-11db-bf72-00046151137e entries (phpmyadmin->phpMyAdmin).

- Add entry about phpMyAdmin XSS vulnerability.

nagios-plugins -- Long Location Header Buffer Overflow Vulnerability

Reviewed by:    simon

Document png -- multiple vulnerabilities

Reviewed by:    simon

Document ImageMagick - Multiple vulnerabilities

Submitted by:           Nick Barkas

Correct mediawiki package names.

Spotted by:     Nick Barkas

- Dokument jdk/jre -- Applet Caching May Allow Network Access Restrictions to be
Circumvented

Reviewed by:    remko

Document xfs -- multiple vulnerabilities.

- Document tcl/tk -- buffer overflow in ReadImage function

PR:             116881
Submitted by:   Nick Barkas <snb@threerings.net>
Reviewed by:    simon

Document firebird multiple remote buffer overflow vulnerabilities

Update the bugzilla and mediawiki entries to properly match their corrected
versions.

Prodded by:     Nick Barkas (and a few others)

Update to reflect the fixed version of id3lib.

Document id3lib insecure temporary file creation vulnerability

- modify mediawiki entry (add missing mediawiki18)

Reviewed by:    remko

Some PHP 5.x vulnerabilities is also found in PHP 4.x series,
unfortunately it seems that there is no newer PHP release to
fix these issue for 4.x series, so mark it as so.

While I'm there add a new CVE that was not mentioned in
previous revision of entry.

Document mediawiki -- cross site scripting vulnerability, our port versions
had not been updated yet, 1.8.x is not vulnerable by default unless you are
using the $wgEnableAPI = true; statement, in that case please set it to
$wgEnableAPI = false; (where possible ofcourse, else upgrade to 1.8.5).

Document wordpress -- remote sql injection vulnerability, our versions are
already up to date for this vulnerability.

samba -- nss_info plugin privilege escalation vulnerability, the FreeBSD
port had already been fixed for this.

Document bugzilla -- multiple vulnerabilities

PR:             ports/116060
Submitted by:   Nick Barkas <snb at threerings dot net>, minor nits from me

Document clamav CVE-2007-4510 issue (Remote DoS).

Document coppermine -- multiple vulnerabilities, the FreeBSD
port is already up to date.

Document openoffice -- arbitrary command execution vulnerability,
all current versions marked vulnerable, everything as of 2.3 is
believed to be fixed, but we do not have that yet ( I am also not
sure whether the -devel version has the correct fix or not ) so
lets be on the safe side till we know what version will be fixed
in our repro.

Document bugzilla -- "createmailregexp" security bypass vulnerability,
marking all versions as vulnerable till we know what version is the
one fixed in our CVS repository.

Spell Ulf Harnhammar (ASCII version of name) using UTF-8 instead of HTML
entities which can't be assumed is available to a paser by default.

This fixes a warning from packaudit.

Document kdm -- passwordless login vulnerability
Document konquerer -- address bar spoofing

Inspired by:    lofi's cvs commits

Document flyspray -- authentication bypass

Submitted by:   Nick Hilliard <nick at foobar dot org>

Document mozilla -- code execution via Quicktime media-link files,
The Mozilla advisory talks somewhat about Windows for this matter,
but better be safe then sorry (An updated firefox is available already).

Update the PHP vulnerability entry:

 - Use php5 to cover php 5.x as the port did.
 - Add more information about the vulnerability.

Submitted by:   Nick Barkas <snb threerings net>
PR:             ports/116182

Correct a style nit and bump modification date.
Bump modification date for "xpdf -- stack based buffer overflow"
which was forgotten by Jeremy (mezz) :-)

Document Apache 2.0.x, 2.2.x series' vulnerabilities as well
as security related improvements in php 5.2.4.

There is no code of CVE-2007-3387 vulnerability in evince, therefore remove
it from the database. It only merely depends on poppler and poppler has been
patched (marked as safe in database).

- lighttpd -- FastCGI header overrun in mod_fastcgi

Fix mod_jk's version since PORTEPOCH came into play.

PR:             116115
Reported by:    Klavs Klavsen <klavs at EnableIT dot dk>

rkhunter -- insecure temporary file creation

Reviewed by:    remko

lsh -- multiple vulnerabilities

Reviewed by:    remko

Document fetchmail -- denial of service on reject of local
warning message.

Submitted by:   Matthias Andree <matthias.andree@gmx.de>
PR:             ports/??? (Not received by GNATS yet)

Document gtar directory traversal vulnerability.

PR:             115914
Submitted by:   Nick Barkas <snb@threerings.net>

- Marked sylpheed2 as safe.

Reviewed by:    remko

- Fix a typo.

- Document Sylpheed / Sylpheed-Claws POP3 Format String Vulnerability

Reviewed by:    simon

From latest Opera entry:
- Remove redundant information.
- Bump modified date for recent changes to the entry.

linux-opera and (for the moment defunct) opera-devel are also affected by
df4a7d21-4b17-11dc-9fc2-001372ae3ab9 - Vulnerability in javascript handling so
addd them to the entry.

Submitted by:   sat@

Update vuln.xml for rsync 2.6.9_1 which fixed CVE-2007-4091

Document rsync off-by-one stack overflow vulnerability.

- Update the wordpress -- unmoderated comments disclosure entry. Is safe with
the 2.2.2 Release.

Approved by:    simon

Add info about www/opera's JavaScript vulnerability

PR:             ports/115543
Submitted by:   Arjan van Leeuwen (maintainer)
Reviewed by:    simon@

Fix the flac entry by specificing the correct fixed version.
Bump modification date to reflect the above change.

Submitted by:   Stefan Ehmann

- Document fsplib -- multiple vulnerabilities

Reviewed by:    remko

Document joomla -- multiple vulnerabilities

Approved by:    simon/remko