Add Bugtraq ID for evolution issue.

Add CVE name for squid WCCP issue.

Add a <modified> tag to the perl File::Path issue since the affected
versions were changed.

Forgotten by: tobez

Narrow perl File::Path vulnerability version range a bit.

Documented vulnerabilities found in the newspost, newsfetch and newsgrab ports.

http://people.freebsd.org/~niels/issues/newspost-20050114.txt
http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt
http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt

Approved by:    nectar (mentor)

The latest xpdf buffer overflow has been repaired in an update
to pdftohtml.

Submitted by:   erwin

Add CVE names for recent squid vulnerabilities.

squid -- buffer overflow in WCCP recvfrom() call

PR:             ports/76827
Submitted by:   squid maintainer

Mark cups-base as fixed wrt. to "makeFileKey2() buffer overflow
vulnerability".

Document "makeFileKey2()" buffer overflow vulnerability in xpdf (and
programs embedding xpdf).

pdflib has been corrected.

Noticed by:     Hilko Meyer <Hilko.Meyer@gmx.de>

Document a vulnerability in zhcon.

Fix last YAMT entry update to actually make sense... Greater than and
less than are not the same...

Pointy hat to:  simon

Mark latest YAMT port version as fixed.

Document arbitrary code execution vulnerability in evolution.

The previous commit was

Submitted by:   Thomas-Martin Seck <tmseck@netcologne.de>

Correct the entry date for 4e4bd2c2-6bd5-11d9-9e1e-c296ac722cb3
``squid -- HTTP response splitting cache pollution attack''.

Document a local vulnerability in mod_dosevasive.

Document a possible cache-poisoning issue affecting squid.

Submitted by:   Thomas-Martin Seck <tmseck@netcologne.de>

Document Bugzilla XSS issue.

Oops, forgot to set <discovery> date.

Document window injection vulnerabilities affecting several web browsers.

Cancel duplicate phpbb entry e8c6ade2-6bcc-11d9-8e6f-000a95bc6fae.  It
was already documented as e3cf89f0-53da-11d9-92b7-ceadd4ac2edd.
Useful references and descriptions were merged.

Noticed by:     simon

Document a vulnerability in YAMT.

Add squid security advisories for two recent squid entries.

Submitted by:   Thomas-Martin Seck <tmseck@netcologne.de>

squid bug #1200:

        squid -- HTTP response splitting cache pollution attack

PR:             ports/76550
Submitted by:   Thomas-Martin Seck <tmseck@netcologne.de>

Fix typo in last commit.

Document XSS in Horde.

Oops, I accidently changed an <entry> date when I should have
added a <modified> date.

Document vulnerabilities in older versions of Midnight Commander.

Document a race condition in Perl's File::Path module.

Document phpBB vulnerabilities.

Document vulnerabilities in the Opera web browser's Java implementation.

Document that older versions of sudo lack CDPATH environmental variable
handling.

Document vulnerabilities in fcron.

Document vulnerabilities in RealPlayer.

Add CVE name and iDEFENSE advisory references to xzgv issue.

Grr, get the imlib version number right!

Oops, imlib 1.9.15 is still affected.  Adjust version number to reflect
upcoming fix.

Document xpm heap overflows and integer overflows affecting imlib and imlib2.

Document a vulnerability in eGroupWare.

Document Quake II vulnerabilities reported by Richard Stanway.

Add CVE names for konversation bugs.

Document security issue in irc/konversation.

Pointed out by: markus

Correct several instances where the "msgid" attribute content had an
extraneous trailing greater-than character ">", e.g.

   <mlist msgid="some-message@id>">some-url</mlist>

These were probably the result of off-by-one errors during
cut-and-paste.

Eliminate character entity references.  They are technically fine of
course, but I prefer to use the UTF-8 character directly: it makes
grep'ing and the like easier.

Update entries with 12 new CVE name references.

Fix date (was YYYY-MM-DD, now 2005-01-19)

Thanks for Chimera@#bsdports

squid -- no sanity check of usernames in squid_ldap_auth

(My first attempt to update this thing. Hope all goes fine!)

PR:             ports/76364
Submitted by:   Thomas-Martin Seck <tmseck@netcologne.de>

Document remote DoS in CUPS.

Heads-ups by:   Hilko Meyer <hilko.meyer@gmx.de>
Description by: nectar

During last year's bumpercrop of vulnerabilities in libtiff, a 2004 CVE
name was assigned to what was actually a much older (circa March 2002)
denial-of-service issue.  Document it, since occassionally the CVE name
crops up and then I wonder why we missed it.

Document exploitable vulnerabilities in zgv and xzgv.

Document bug in Mozilla-based software that may leave downloaded files
or attachments world-readable.

Add more references to exim entry.

pdflib contains libtiff, and thus is affected by several vulnerabilities
that affected libtiff.

Document remote command execution vulnerability in awstats.

Document security vulnerability in ImageMagick.

Update "cups-base -- HPGL buffer overflow vulnerability" entry to
reflect the fix in the latest port version.

Spelling corrections.

Regarding CUPS lppasswd entry: Add the CVE names for each issue inline
with the excerpt from Bernstein's message.  Note that the third issue
does not effect users of FreeBSD 4.6 or later.

Document two vulnerabilities in CUPS.

Heads up by:    Hilko Meyer <hilko.meyer@gmx.de>

Document mysqlaccess insecure temporary file creation.

Document buffer overflow vulnerability in unrtf.

Correct recent squid entry: WCCP is in fact enabled by default.

Submitted by:   Thomas-Martin Seck <tmseck@netcologne.de> (squid maintainer)

For mod_access_referer issue:
- Correct spelling.
- `null' in `null pointer' should not be all caps
- Correct the secunia.com URL (it did not identify this particular bug)

Add references to Konqueror password disclosure bug: CVE name, CERT
Vulnerability Note, and KDE security advisory.

Update phpBB command execution entry references:
- Convert some <url>s into the appropriate <certvu> and <uscertta>
  elements.
- Add CVE name
- Add a couple of mailing list posts

For the latest three Squid issues, add references to the Squid bug
tracking database.  Also, rework the description of the empty ACL issue.

Add a better reference and description of the jabberd vulnerability.

Oops, add missing closing tag for Bugtraq ID which I recently added.

Add CVE name for up-imapproxy issue.

Add CVE names to greed buffer overflows issue.  Re-indent <references>
children.

For mpg123 playlist issue, add CVE name, Bugtraq ID, and X-Force
references.  Correct a double slash (`//') in a URL.  Re-ident the
<references> children.

Add a CVE name for VIM modeline handling issue.

Cancel VID 14e8f315-600e-11d9-a9e7-0001020eed82 "tiff -- stripoffsets
integer overflow vulnerability", as it was a subset of VID
3897a2f8-1d57-11d9-bc4a-000c41e2cdad "tiff -- multiple integer
overflows".  This is another case of iDEFENSE ``discovering'' a
vulnerability months after it had already been made public and
corrected.  I've preserved the iDEFENSE advisory reference by moving it
to the older entry, so that someone won't get misled by it again later.

Add CVE name for tnftp mget vulnerability.  Re-indent <references>
children while I'm here.

For recent squid WCCP DoS issue, correct the URL used in <blockquote>
"cite" attribute and <url> content.  It referenced the wrong squid
patch description.

Document Mozilla NNTP handler vulnerability.

- Document a vulnerability in mpg123.
- Add mpg123-nas to an earlier mpg123 entry.
- Make title for exim entry more accurate.
- Fix invalid modification date in latest xpdf entry.

- Integrate vendor patches as published on
  <http://www.squid-cache.org/Versions/v2/2.5/bugs/> for the following
  issues:
  + Prevent a possible denial of service attack via WCCP messages (squid bug
    #1190), classified as security issue by the vendor
  + Fix a buffer overflow in the Gopher to HTML conversion routine (squid bug
    #1189), classified as security issue by the vendor
  + Fix a null pointer access and plug memory leaks in the fake_auth NTLM
    helper (squid bug #1183) (this helper app is not installed by default by
    the port)
  + Stop closing open filedescriptors beyond stdin, stdout and stderr on
    startup (squid bug #1177)

- Unbreak the port on NO_NIS systems (thanks to "Alexander <freebsd AT
  nagilum.de>" for reporting this)

- Document the two security issues in VuXML.

PR:             ports/76173
Submitted by:   Thomas-Martin Seck <tmseck@netcologne.de> (maintainer)
Approved by:    erwin (mentor)

- Document some older security issues in libxine.
- Cancel VID bef4515b-eaa9-11d8-9440-000347a4fa7d in favor of a more
  complete, new entry.  (A xine security announcement covered the same
  issue and others.)
- Add references to xine security announcements and iDEFENSE
  Security Advisories.

Document HylaFAX authentication bypass vulnerability.

Document xshisen buffer overflows.

Add CERT Vulnerability Note reference for tiff issue.

Bump copyright for 2005.

Mark pdftohtml as vulnerable to recent xpdf vulnerability.

Documented two vulnerabilities in the helvis port

Add CVE names for exim issue.

Document format string vulnerability in dillo.

- Shorten exim entry

Thanks to:      simon

Fix typo in latest tiff entry.

Noticed by:     bmah

Change the behavior of `make newentry' so that it invokes ${EDITOR}
after adding the template, since this is certainly the next required
action. [1]

Fix the error checking: a pipeline was masking some errors, and `set
errexit' was not effective in some other places.

Suggested by:   delphij [1]

Add a target, `newentry', that will insert a VuXML <vuln> template
(including generated VID) to the top of the `vuln.xml' file.  This will
save a little time when adding new entries.

Inspired by:    a patch from simon

- Document that two older tiff vulnerabilities also affects
  linux-tiff. [1]
- Add an extra reference to each of the two entries while I'm here
  anyway.
- In one of the tiff title elements do s/---/--/ for consistency.

Discussed with: nectar [1]
Approved by:    portmgr (implicit, VuXML)

The tnftp port has been updated.

Approved by:    portmgr (implicit, VuXML)

Fix up last commit (tnftp entry):
- Malformed XML
    - mismatched tags (<packages></package>)
    - invalid entity reference &content-type= (ampersand should have
      been replaced with &amp;)
- Replace <range> so that it matches all possible versions for now,
  until a fixed version is available in the ports tree
- <entry> date was in the past

Approved by:    portmgr (implicit, VuXML)
Pointy hat to:  ahze  (hint: make validate)

Document vulnerabilites in tnftp

PR:             ports/75782
Submitted by:   Tom McLaughlin
Approved by:    portmgr (krion)

Document several vulnerabilites in tiff.

Approved by:    portmgr (implicit, VuXML)

Fill in forgotten `cite' attribute value.

Noticed by:     simon
Approved by:    portmgr (implicit, VuXML)

Document a local vulnerability in VIM's modeline handling.

Approved by:    portmgr (implicit, VuXML)