13:44 brnrd 

security/vuxml: Bump PORTREV for openssl

 - Chase missing svn add for openssl

 

13:01 brnrd 

security/vuxml: Document today's OpenSSL vuln (low)

 

22:57 madpilot 

Document new asterisk vulnerabilities.

 

22:50 madpilot 

Fix error in old asterisk entry.

 

08:47 cpm 

Document new vulnerability in www/chromium < 67.0.3396.79

Obtained
from:	https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html

 

14:29 gjb 

Fix vuxml build.

Sponsored by:	The FreeBSD Foundation

 

14:20 adamw 

Add entry for gnupg CVE

 

07:52 jbeich 

security/vuxml: mark firefox < 60.0.2 as vulnerable

 

00:25 jkim 

Document the latest Flash Player vulnerabilities.

https://helpx.adobe.com/security/products/flash-player/apsb18-19.html

 

16:56 leres 

Mark bro < 2.5.4 as vulnerable as per:

    https://www.bro.org/download/NEWS.bro.html

Reviewed by:	ler (mentor)
Approved by:	ler (mentor)
Differential Revision:	https://reviews.freebsd.org/D15677

 

20:23 jrm 

security/vuxml/vuln.xml: Fix indentation (silences make validate)

Reported by:	mfechner

 

20:10 mfechner 

Document new vulnerabilities in www/gitlab < 10.8.2 or < 10.7.5 or < 10.6.6.

Reviewed by:	tz (mentor)
Approved by:	tz (mentor)
Differential Revision:	https://reviews.freebsd.org/D15635

 

00:37 jrm 

security/vuxml: Fix version ranges for latest Git vulnerabilities

Reported by:	jbeich

 

20:51 jrm 

security/vuxml: Document devel/git CVEs (2018-11233 and 2018-11235)

 

12:42 krion 

Document security/strongswan multiple vulnerabilities
((CVE-2018-10811, CVE-2018-5388)

PR:		228631
Submitted by:	strongswan@Nanoteq.com

 

21:47 cpm 

Document new vulnerabilities in www/chromium < 67.0.3396.62

Obtained
from:	https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html

 

03:12 delphij 

Document BIND multiple vulnerabilities.

 

13:14 zeising 

Update VuXML entry for xorg-server issues

Update VuXML entry for xorg-server issues related to CVE-2017-10971 and
CVE-2017-10972.  The version check was wrong missing the portepoch which
meant that the entry never matched anything.  It was also only added for
xorg-server 1.19, while we have 1.18 in base.

Fix formatting and edit the overly long lines.

 

23:56 sunpoet 

Document curl vulnerability

 

07:21 riggs 

Document vulnerabilities in wavpack 5.1.0 and earlier

PR:		228146
Submitted by:	yasu@utahime.org

 

06:01 riggs 

Bump copyright to 2018

 

06:00 riggs 

Document vulnerabilities in chromium before 66.0.3359.170

Reported by:	Tommi Pernila <tommi.pernila@iki.fi> via e-mail

 

14:47 swills 

Document jenkins security issues

 

20:32 jbeich 

security/vuxml: mark firefox < 60 as vulnerable

PR:		226476

 

16:32 pi 

security/vuxml: document kamailio CVE-2018-8828

PR:		227677
Submitted by:	Ben Hood <ben@relops.com>

 

16:15 vd 

Document ftp/wget's cookie injection vulnerability

Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>
MFH:		2018Q2
Security:	CVE-2018-0494

 

05:54 jkim 

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-16.html

 

20:21 feld 

Document FreeBSD-SA-18:06.debugreg

 

17:22 sunpoet 

Document python vulnerability

 

14:28 adridg 

Security notice regarding kwallet-pam (KDE Plasma5).

  https://www.kde.org/info/security/advisory-20180503-1.txt

The port is not built by default through the regular KDE packages,
and has been in the ports tree only a week; the impact is expected
to be low.

Approved by:	tcberner (mentor, implicit)

 

18:45 joneum 

Document multiple vulnerabilities in www/drupal7 and www/drupal8

 

10:39 mfechner 

Document vulnerabilities in gitlab for several versions.

Reviewed by:	eugen_grosbein.net, tz (mentor)
Approved by:	eugen_grosbein.net, tz (mentor)
Differential Revision:	https://reviews.freebsd.org/D15248

 

19:19 riggs 

Document free-after-use issue in chromium before 66.0.3359.139

Submitted by:	Tommi Pernila <tommi.pernila@iki.fi> via e-mail
Security:	CVE-2018-6118

 

11:00 woodsb02 

Document vulnerabilities in quassel before 0.12.5

Security:	https://vuxml.freebsd.org/freebsd/499f6b41-58db-4f98-b8e7-da8c18985eda.html

 

18:07 riggs 

Document vulnerabilities in chromium before 66.0.3359.117

Submitted by:	tommi.pernila@iki.fi (via mail to ports-secteam)
Reviewed by:	riggs

 

19:17 tijl 

Document mbed TLS vulnerabilities

Security:	https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released

 

09:07 brnrd 

security/vuxml: Document MySQL vulns from quarterly Oracle CPU

 

20:50 joneum 

Document wordpress issues

 

19:17 matthew 

Document the latest phpMyAdmin vulnerabilities

 

18:08 acm 

- Document drupal8 vulnerability

 

17:46 brnrd 

security/vuxml: Bump portrev for latest OpenSSL vuln

 

17:05 brnrd 

security/vuxml: Add OpenSSL vulnerability

 

07:32 joneum 

Add Blockquote

pointy hat to joneum

 

07:26 joneum 

Document multiple vulnerabilities in www/drupal7

Security:	CVE-2018-7600

 

20:04 sunpoet 

Document Perl vulnerability

 

19:12 sunpoet 

Update freeimage vulnerability

 

12:04 eugen 

ipsec-tools: document remotely exploitable computational-complexity attack.

PR:		225066
Security:	CVE-2016-10396

 

20:49 sunpoet 

Document nghttp2 vulnerability

 

07:18 ale 

Document roundcube IMAP command injection vulnerability.

 

17:54 swills 

Document Jenkins vulnerabilities

 

18:41 jkim 

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-08.html

 

13:55 mfechner 

Fixed a wrong version definition for gitlab that report 10.4.6 as affected.

PR:		227293
Reported by:	majo-bugs.freebsd.org@cerny.sk
Reviewed by:	dbaio, swills (mentor)
Approved by:	swills (mentor)
Differential Revision:	https://reviews.freebsd.org/D14999

 

09:17 mfechner 

Added information about security problems with port www/gitlab.

Reviewed by:	swills (mentor)
Approved by:	swills (mentor)
Differential Revision:	https://reviews.freebsd.org/D14974

 

14:15 feld 

Document FreeBSD-SA-18:05.ipsec

 

14:15 feld 

Document FreeBSD-SA-18:04.vt

 

00:06 jbeich 

security/vuxml: adjust thunderbird version for CVE-2018-5148 backport

 

00:00 jbeich 

security/vuxml: delist palemoon from CVE-2018-514[67]

Let upstream to decide if the browser is affected.
https://github.com/MoonchildProductions/Pale-Moon/commits/master/media/libvorbis/lib/vorbis_codebook.c
https://github.com/MoonchildProductions/Pale-Moon/commits/master/media/libtremor/lib/tremor_codebook.c

 

23:59 jbeich 

security/vuxml: libxul didn't share release branch with thunderbird

 

08:17 wen 

- Document Moodle vulnerability

 

20:16 sunpoet 

Fix space/tab to pet "make validate"

 

20:12 sunpoet 

Document Ruby vulnerability

 

19:47 bhughes 

security/vuxml: Document Node.js vulnerabilities

https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/

 

13:05 mfechner 

Document gitlab vulnerability.

Reviewed by:	tz (mentor)
Approved by:	tz (mentor)
Differential Revision:	https://reviews.freebsd.org/D14870

 

11:33 tobik 

Fix typos

 

11:22 tobik 

Document www/webkit2-gtk3 vulnerabilities

 

17:33 cpm 

Document new vulnerability in www/chromium < 65.0.3325.181

Obtained
from:	https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html

 

14:50 brnrd 

security/vuxml: Document OpenSSL vulnerabilities

 

13:27 gjb 

Attempt to fix vuxml build.

Sponsored by:	The FreeBSD Foundation

 

12:57 brnrd 

security/vuxml: Mark Apache 2.2 vulnerable

 - Upstream has removed all patches for 2.2.34

With hat:	apache

 

03:30 gjb 

Fix build after r465658.

Sponsored by:	The FreeBSD Foundation

 

01:13 jbeich 

security/vuxml: mark firefox < 59.0.2 as vulnerable

 

09:13 cmt 

thunderbird: fix affected versions for CVE-2018-5146

according to https://www.mozilla.org/en-US/security/advisories/mfsa2018-09/ ,
CVE-2018-5146 has been fixed in thunderbird 52.7.0 (and CVE-2018-5147
affects Android platforms as per it's description).
Add link to the thunderbird security advisory MFSA 2018-09, as this has
the info for thunderbird.

 

17:20 jhale 

Fix mythtv ranges. Forgot to factor in PORTEPOCH.

 

14:13 jhale 

Update entries for mythtv and mythtv-frontend

PR:		225652

 

21:12 sunpoet 

Document rubygem-rails-html-sanitizer vulnerability

 

14:39 brnrd 

security/vuxml: Document recent Apache httpd vulnerabilities

 

08:46 joneum 

Document vulnerability in www/mybb

 

05:02 yuri 

VulnXML record: CVE-2018-8740: SQLite -- Corrupt DB can cause a NULL pointer
dereference

Patched in r465275.

 

19:04 sunpoet 

Document rubygem-sanitize vulnerability

 

22:36 sunpoet 

Document rubygem-loofah vulnerability

 

15:14 sunpoet 

Document py-notebook vulnerability

 

07:34 riggs 

Document zero-day remote vulnerability in mail/squirrelmail

Reported by:	Roger Marquis <marquis@roble.com> via e-mail
Security:	CVE-2018-8741

 

17:51 jrm 

security/vuxml: mark slurm-wlm < 17.02.10 as vulnerable

Security:	CVE-2018-7033

 

21:07 jbeich 

security/vuxml: mark libvorbis < 1.3.6 as vulnerable

 

13:12 jbeich 

security/vuxml: bump waterfox version after r464679

 

23:38 mandree 

Mark e2fsprogs < 1.44.0 vulnerable.

 

14:54 feld 

Initial entry for the speculative execution vulnerability
(FreeBSD-SA-18:03.speculative_execution)

 

14:53 feld 

Update NTP entry to add the FreeBSD SA information (FreeBSD-SA-18:02.ntp)

 

14:49 feld 

Document FreeBSD-SA-18:01.ipsec

 

17:25 jkim 

Document the latest Flash Player vulnerability.

https://helpx.adobe.com/security/products/flash-player/apsb18-05.html

 

17:08 jbeich 

security/vuxml: mark firefox < 59 as vulnerable

 

10:51 timur 

Add an entry for Samba vulnerabilities CVE-2018-1050 and CVE-2018-1057

Security:	CVE-2018-1050
		CVE-2018-1057

 

19:08 tijl 

Document mbed TLS Security Advisory 2018-01.

Security:	https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
Security:	CVE-2018-0487
Security:	CVE-2018-0488

 

19:28 riggs 

Document vulnerabilities in www/chromium before 65.0.3325.146

Submitted by:	Tommi Pernila <tommi.pernila@iki.fi> (via e-mail)

 

22:40 cmt 

document vulnerabilities for net/wireshark{,-lite,qt5} and net/tshark{,-lite}

PR:		226355
Obtained from:	https://www.wireshark.org/security/

 

17:01 zi 

- Document vulnerabilities (CVE-2018-5732, CVE-2018-5733) in isc-dhcp ports

 

23:52 jhale 

Document additional vulnerabilities in audio/libsndfile

 

15:58 girgen 

Document PostgreSQL vulnerability

Security:	CVE-2018-1058

 

13:48 garga 

Document strongswan vulnerability

PR:		226043
Submitted by:	strongswan@Nanoteq.com
Security:	CVE-2018-6459
Sponsored by:	Rubicon Communications, LLC (Netgate)

 

06:49 jhale 

Document vulnerability in audio/libsndfile and audio/linux-c[6|7]-libsndfile