Commit graph

2889 commits

Author SHA1 Message Date
Ruslan Makhmatkhanov
25b9c14558 - update to 7.16 [1]
while here:
- trim Makefile header
- remove indefinite article in COMMENT
- remove IGNORE_WITH_PHP and IGNORE_WITH_PGSQL since
  we have not this versions in the tree anymore
- fix pkg-plist
- add vuxml entry

PR:		173211
Submitted by:	Rick van der Zwet <info at rickvanderzwet dot nl> [1]
Approved by:	Nick Hilliard <nick at foobar dot org> (maintainer)
Security:	2adc3e78-22d1-11e2-b9f0-d0df9acfd7e5
Feature safe:   yes
2012-10-30 21:01:16 +00:00
Florian Smeets
912a7b12e4 - Update www/firefox{,-i18n} to 16.0.2
- Update seamonkey to 2.13.2
- Update ESR ports and libxul to 10.0.10
- Update nspr to 4.9.3
- Update nss to 3.14
- with GNOMEVFS2 option build its extension, too [1]
- make heap-committed and heap-dirty reporters work in about:memory
- properly mark QT4 as experimental (needs love upstream)
- *miscellaneous cleanups and fixups*

mail/thunderbird will be updated once the tarballs are available.

PR:		ports/173052 [1]
Security:	6b3b1b97-207c-11e2-a03f-c8600054b392
Feature safe:	yes
In collaboration with:	Jan Beich <jbeich@tormail.org>
2012-10-28 17:03:28 +00:00
Eygene Ryabinkin
98cf8cbd46 mail/exim: upgrade to 4.80.1
This is bugfix-only release, it eliminates remote code execution
in the DKIM code.

Security: http://www.vuxml.org/freebsd/b0f3ab1f-1f3b-11e2-8fe9-0022156e8794.html
QA page: http://codelabs.ru/fbsd/ports/qa/mail/exim/4.80.1
Feature safe: yes
2012-10-26 08:46:40 +00:00
Ruslan Makhmatkhanov
339aa6e578 - add CVE reference (still in reserved state) for recent django vulnerabilty
Feature safe:	yes
2012-10-25 19:31:50 +00:00
Ruslan Makhmatkhanov
600314693a - update django ports to 1.3.4 and 1.4.2, that fixing couple of security issues.
All users are encouraged to upgrade immediately.
- add vuxml entry

changes common for both ports:
- trim Makefile header
- strict python version to 2.x only
- utilize options framework multiple choice feature to let user to choose
  database backends needed. Make SQLITE option default
- shorten description of HTMLDOCS_DESC to make it fit into dialog screen
- SITELIBDIR -> PKGNAMEPREFIX change in dependencies
- convert NOPORTDOCS condition to optionsng
- tab -> space change in pkg-descr

PR:		173017
Submitted by:	rm (myself)
Approved by:	lwhsu (maintainer, by mail)
Security:	5f326d75-1db9-11e2-bc8f-d0df9acfd7e5
Feature safe:   yes
2012-10-25 10:12:42 +00:00
Wesley Shields
1f75ec0a67 Document multiple wireshark vulnerabilities.
Feature safe:	yes
2012-10-22 02:37:07 +00:00
Jason Helfman
bbcfa83bf7 - clarify end-user impact for 57652765-18aa-11e2-8382-00a0d181e71d
Suggested by:	simon@
Feature safe:	yes
2012-10-18 04:13:27 +00:00
Jason Helfman
3e1fd09f4a - document xlockmore issue, 57652765-18aa-11e2-8382-00a0d181e71d, CVE-2012-4524
Feature safe:	yes
2012-10-17 23:47:27 +00:00
Sergey Matveychuk
2ae50166b4 - xinetd vulnerability
Feature safe:	yes
2012-10-17 17:22:51 +00:00
Greg Larkin
1aba59f53d - Updated ZF advisory to include similar XEE vulnerability
Feature safe:	yes
2012-10-16 14:37:50 +00:00
Greg Larkin
fc2b1f04c7 - Document Zend Framework XXE injection vulnerability
Feature safe:	yes
2012-10-16 14:26:07 +00:00
Eitan Adler
478a532c8f Update the distinfo as upstream has changed.
I verfied this to be same content as the old version modulo the copyright.

Approved by:	secteam (implicit)
Feature safe:	yes
2012-10-15 22:31:39 +00:00
Eitan Adler
8baf6a3603 Add the CVE for the gitolite vuln.
Feature safe:	yes
2012-10-15 16:31:39 +00:00
Steve Wills
e106672073 - Actually commit the VuXML entry
PR:		ports/172565
Feature safe:	yes
Pointyhat to:	swills
2012-10-15 16:02:12 +00:00
Matthew Seaman
36d4653ed4 Document the latest security vulnerabilities for phpMyAdmin.
Fix was already committed to the port 6 days ago.

Feature safe:	yes
2012-10-14 21:05:33 +00:00
Ryan Steinmetz
8547d1b97b - Add in additional package names for recent bind vulnerability
Feature safe:	yes
2012-10-14 15:30:47 +00:00
Florian Smeets
809698066e - update to 16.0.1
- update vuln.xml entry

Feature safe:   yes
2012-10-11 19:15:12 +00:00
Rene Ladan
f789f9d2e3 Document a new vulnerability in www/chromium < 22.0.1229.94
Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
Feature safe:	yes
2012-10-10 22:06:59 +00:00
Florian Smeets
98ff1f74fb - Update firefox-esr, thunderbird-esr, linux-firefox and linux-thunderbird to 10.0.8
- Update firefox and thunderbird to 16.0
- Update seamonkey to 2.13
- Update all -i18n ports respectively
- switch firefox 16.0 and seamonkey 2.13 to ALSA by default for better
  latency during pause and seeking with HTML5 video
- remove fedisableexcept() hacks, obsolete since FreeBSD 4.0
- support system hunspell dictionaries [1]
- unbreak -esr ports with clang3.2 [2]
- unbreak nss build when CC contains full path [3]
- remove GNOME option grouping [4]
- integrate enigmail into thunderbird/seamonkey as an option [5]
- remove mail/enigmail* [6]
- enable ENIGMAIL, LIGHTNING and GIO options by default
- add more reporters in about:memory: page-faults-hard, page-faults-soft,
  resident, vsize
- use bundled jemalloc 3.0.0 on FreeBSD < 10.0 for gecko 16.0,
  only heap-allocated reporter works in about:memory (see bug 762445)
- use lrintf() instead of slow C cast in bundled libopus
- use libjpeg-turbo's faster color conversion if available during build
- record startup time for telemetry
- use -z origin instead of hardcoding path to gecko runtime
- fail early if incompatible libxul version is installed (in USE_GECKO)
- *miscellaneous cleanups and fixups*

PR:		ports/171534 [1]
PR:		ports/171566 [2]
PR:		ports/172164 [3]
PR:		ports/172201 [4]
Discussed with:	ale, beat, Jan Beich [5]
Approved by:	ale [6]
In collaboration with:	Jan Beich <jbeich@tormail.org>
Security:	6e5a9afd-12d3-11e2-b47d-c8600054b392
Feature safe:	yes
Approved by:	portmgr (beat)
2012-10-10 21:13:06 +00:00
Erwin Lansing
b6095ca45c Upgrade to the latest BIND patch level:
A deliberately constructed combination of records could cause named
to hang while populating the additional section of a response.

Security:	  http://www.vuxml.org/freebsd/57a700f9-12c0-11e2-9f86-001d923933b6.html
2012-10-10 11:54:44 +00:00
Rene Ladan
f7c717bc10 Document new vulnerabilities in www/chromium < 22.0.1229.92
Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
2012-10-08 20:45:52 +00:00
Ruslan Makhmatkhanov
4841bb2ab4 - correct the range in last entry (le/lt typo) 2012-10-03 12:51:11 +00:00
Ruslan Makhmatkhanov
db8657349b - update to 2.8.10
- add vuxml entry

This release fixes SQL injection vulnerability.

PR:		172114
Submitted by:	rm (myself)
Approved by:	ports-secteam (eadler)
Security:	dee44ba9-08ab-11e2-a044-d0df9acfd7e5
2012-10-03 12:33:38 +00:00
Alexey Dokuchaev
1b2184a6e2 Mark nvidia-driver-173.14.35_1 as not vulnerable. 2012-09-27 17:01:15 +00:00
Rene Ladan
33d8b6f06a Document vulnerabilities in www/chromium < 22.0.1229.79
Obtained from:	http://googlechromereleases.blogspot.nl/search/label/Stable%20updates
2012-09-26 21:49:34 +00:00
Greg Larkin
7e63d892dd - Document remote code execution in ePerl (all versions)
- Deprecate and schedule removal in month - no upstream fix available and
  no active development since 1998

Security:	73efb1b7-07ec-11e2-a391-000c29033c32
Security:	CVE-2001-0733
Security:	http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml
2012-09-26 15:37:58 +00:00
Greg Larkin
48491c1b2f - Documented PNG file DoS vulnerability in ImageMagick and GraphicsMagick
- Added -nox11 suffixes to various ImageMagick entries
2012-09-25 21:41:50 +00:00
Eitan Adler
8482c96c94 Update vuxml to indicate which versions are vulnerable. 2012-09-23 12:27:22 +00:00
Bryan Drewery
8405f4c7b3 - Update php52 backports patch to 20120911
- Add and update relevant vuxml entries

Changes:
  - CVE-2011-1398 - The sapi_header_op function in main/SAPI.c in PHP
    before 5.3.11 does not properly handle %0D sequences
  - CVE-2012-0789 - Memory leak in the timezone functionality in PHP
    before 5.3.9 allows remote attackers to cause a denial of service
    (memory consumption) by triggering many strtotime function calls,
    which are not properly handled by the php_date_parse_tzfile cache.
  - CVE-2012-3365 - The SQLite functionality in PHP before 5.3.15 allows
    remote attackers to bypass the open_basedir protection mechanism via
     unspecified vectors
  - Timezone database updated to version 2012.5 (2012e) (from 2011.13 (2011m))
  - Minor improvements (CVE-2012-2688, compilation issues with old GCC)

PR:		ports/171583
Submitted by:	Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Approved by:	Alex Keda <admin@lissyara.su> (maintainer)
2012-09-20 03:02:43 +00:00
Bryan Drewery
cb9439dac1 - CVE-2012-2688 was addressed by php52-5.2.17_10
PR:		ports/170063
PR:		ports/171583
Reported by:	Svyatoslav Lempert <svyatoslav.lempert@gmail.com>
Security:	bdab0acd-d4cd-11e1-8a1c-14dae9ebcf89
2012-09-20 01:09:57 +00:00
Doug Barton
ece74c7d62 Upgrade to the latest BIND patch level:
Prevents a crash when queried for a record whose RDATA exceeds
65535 bytes.

Prevents a crash when validating caused by using "Bad cache" data
before it has been initialized.

ISC_QUEUE handling for recursive clients was updated to address
a race condition that could cause a memory leak. This rarely
occurred with UDP clients, but could be a significant problem
for a server handling a steady rate of TCP queries.

A condition has been corrected where improper handling of
zero-length RDATA could cause undesirable behavior, including
termination of the named process.

For more information: https://kb.isc.org/article/AA-00788
2012-09-19 03:46:35 +00:00
Li-Wen Hsu
2b149bbcd7 Document Jenkins Security Advisory 2012-09-17 2012-09-17 18:46:51 +00:00
Eitan Adler
74a323cda4 include newly 'awarded' CVE 2012-09-15 21:25:33 +00:00
Juergen Lock
330cfa01e9 Add vuxml for older versions of multimedia/vlc .
PR:		ports/169985
Submitted by:	"Anders N." <wicked@baot.se>
2012-09-15 17:22:33 +00:00
Eitan Adler
a6f4bf3ddc Tell the world about the recent bacula vuln 2012-09-15 02:19:37 +00:00
Steve Wills
78877f2e04 - Update to 0.10.22.6 which fixes two security issues
- Document security issues in vuxml [1]

Reviewed by:	bdrewery [1]
Security:	178ba4ea-fd40-11e1-b2ae-001fd0af1a4c
2012-09-13 03:35:09 +00:00
Alexey Dokuchaev
208dfd5a20 Update NVIDIA arbitrary memory access vulnerability with CVE-2012-4225. 2012-09-12 07:31:22 +00:00
Ryan Steinmetz
b846243bc3 - Update entry for net/freeradius2 to reflect local patch to address cve-2012-3547 2012-09-11 11:38:53 +00:00
Eygene Ryabinkin
4e88ce38dd VuXML: document remote code execution in freeRADIUS 2012-09-11 08:46:31 +00:00
Eygene Ryabinkin
91e9022623 www/moinmoin: fix CVE-2012-4404, wrong processing of group ACLs
Using upstream patch from
  http://hg.moinmo.in/moin/1.9/raw-rev/7b9f39289e16

PR:		171346
QA page:	http://codelabs.ru/fbsd/ports/qa/www/moinmoin/1.9.4_1
Approved by:	khsing.cn@gmail.com (maintainer)
Security:	http://www.vuxml.org/freebsd/4f99e2ef-f725-11e1-8bd8-0022156e8794.html
2012-09-11 07:51:07 +00:00
Eitan Adler
74ddbe2d42 Add vim specific modeline to help users write correct vuxml
Submitted by:	bdrewery
2012-09-08 02:37:32 +00:00
Raphael Kubo da Costa
7b558f1217 Document the vulnerability that led to emacs 24.2 2012-09-07 23:07:14 +00:00
Eitan Adler
26ceb56d8b Add a sanity check to ensure vuxml is actually installed prior to performing
the tidy step in validate. This step actually requires just the dependancies
but the full validate requires that vuxml be installed.

Reviewed by:	simon
Approved by:	secteam (implicit)
2012-09-07 21:34:03 +00:00
Steve Wills
0b61befb1c - Update to 3.4.2 [1] [2] [3]
- Document security issue [4]

PR:		ports/171397 [1]
PR:		ports/171404 [2]
PR:		ports/171405 [3]
Submitted by:	Yuan-Chung Hsiao <ychsiao@ychsiao.org> (maintainer) [1]
Submitted by:	Joe Horn <joehorn@gmail.com> (maintainer) [2] [3]
Reviewed by:	eadler [4]
Security:	30149157-f926-11e1-95cd-001fd0af1a4c
2012-09-07 20:25:41 +00:00
Eygene Ryabinkin
2fdbfc0e43 VuXML: add <modified> tag for Wireshark's entry for CVE-2012-3548 2012-09-06 06:10:41 +00:00
Joe Marcus Clarke
a075d031b2 Change the wireshark version for the DRDA fix. 2012-09-05 16:02:11 +00:00
Eygene Ryabinkin
1213e0634b VuXML: document XSS in MoinMoin before 1.9.4 via RST parser 2012-09-05 10:42:38 +00:00
Eygene Ryabinkin
bf6426a1fb VuXML: document wrong group ACL processing in MoinMoin 2012-09-05 09:47:35 +00:00
Eygene Ryabinkin
1b3ec36058 PHP 5.x: document header splitting vulnerability
There is a related CVE number (CVE-2012-4388), but there is no current
consensus about it:
  http://article.gmane.org/gmane.comp.security.oss.general/8303
2012-09-05 06:29:38 +00:00
Matthias Andree
84f7423f73 Modify fetchmail vuln' URLs to established site.
While at it, adjust the two oldest topics to current format, for uniformity,
on, for instance, http://www.vuxml.org/freebsd/pkg-fetchmail.html.
2012-09-04 21:05:15 +00:00