3 files changed, 38 insertions, 3 deletions

diff --git a/ports-mgmt/portaudit-db/database/portaudit.txt b/ports-mgmt/portaudit-db/database/portaudit.txt
index 2777cc16ea42..ac09a89ae347 100644
--- a/ports-mgmt/portaudit-db/database/portaudit.txt
+++ b/ports-mgmt/portaudit-db/database/portaudit.txt
@@ -56,7 +56,6 @@ imp<3.2.5|http://www.greymagic.com/security/advisories/gm005-mc/ http://cvs.hord
 phpMyAdmin<2.5.7.1|http://www.securityfocus.com/archive/1/367486 http://www.securityfocus.com/bid/10629 http://secunia.com/SA11974 http://www.osvdb.org/7314 http://www.osvdb.org/7315|phpMyAdmin configuration manipulation and code injection|56648b44-e301-11d8-9b0a-000347a4fa7d
 gnutls<1.0.17|http://www.hornik.sk/SA/SA-20040802.txt http://secunia.com/advisories/12156|GnuTLS certificate chain verification DoS|84ab58cf-e4ac-11d8-9b0a-000347a4fa7d
 gnutls-devel>=1.1.*<1.1.12|http://www.hornik.sk/SA/SA-20040802.txt http://secunia.com/advisories/12156|GnuTLS certificate chain verification DoS|84ab58cf-e4ac-11d8-9b0a-000347a4fa7d
-ripmime<1.3.2.3|http://www.osvdb.org/8287 http://secunia.com/advisories/12201 http://www.securityfocus.com/bid/10848|ripMIME attachment extraction bypass|85e19dff-e606-11d8-9b0a-000347a4fa7d
 {linux-,}opera<7.54|http://www.opera.com/freebsd/changelogs/754/ http://www.greymagic.com/security/advisories/gm008-op/ http://secunia.com/advisories/12233 http://www.osvdb.org/8331|Opera "location" object write access vulnerability|0deed2ce-e6f5-11d8-9a79-000347dd607f
 putty<0.55|http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.coresecurity.com/common/showdoc.php?idx=417&idxseccion=10 http://www.osvdb.org/8299 http://secunia.com/advisories/12212|modified server can execute commands on the client|4424f4db-e697-11d8-bf04-000c763e9a47
 cfengine2<2.1.8|http://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10 http://secunia.com/advisories/12251|cfengine authentication heap corruption|f2a1dc8b-ea66-11d8-9440-000347a4fa7d
diff --git a/security/portaudit-db/database/portaudit.txt b/security/portaudit-db/database/portaudit.txt
index 2777cc16ea42..ac09a89ae347 100644
--- a/security/portaudit-db/database/portaudit.txt
+++ b/security/portaudit-db/database/portaudit.txt
@@ -56,7 +56,6 @@ imp<3.2.5|http://www.greymagic.com/security/advisories/gm005-mc/ http://cvs.hord
 phpMyAdmin<2.5.7.1|http://www.securityfocus.com/archive/1/367486 http://www.securityfocus.com/bid/10629 http://secunia.com/SA11974 http://www.osvdb.org/7314 http://www.osvdb.org/7315|phpMyAdmin configuration manipulation and code injection|56648b44-e301-11d8-9b0a-000347a4fa7d
 gnutls<1.0.17|http://www.hornik.sk/SA/SA-20040802.txt http://secunia.com/advisories/12156|GnuTLS certificate chain verification DoS|84ab58cf-e4ac-11d8-9b0a-000347a4fa7d
 gnutls-devel>=1.1.*<1.1.12|http://www.hornik.sk/SA/SA-20040802.txt http://secunia.com/advisories/12156|GnuTLS certificate chain verification DoS|84ab58cf-e4ac-11d8-9b0a-000347a4fa7d
-ripmime<1.3.2.3|http://www.osvdb.org/8287 http://secunia.com/advisories/12201 http://www.securityfocus.com/bid/10848|ripMIME attachment extraction bypass|85e19dff-e606-11d8-9b0a-000347a4fa7d
 {linux-,}opera<7.54|http://www.opera.com/freebsd/changelogs/754/ http://www.greymagic.com/security/advisories/gm008-op/ http://secunia.com/advisories/12233 http://www.osvdb.org/8331|Opera "location" object write access vulnerability|0deed2ce-e6f5-11d8-9a79-000347dd607f
 putty<0.55|http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.coresecurity.com/common/showdoc.php?idx=417&idxseccion=10 http://www.osvdb.org/8299 http://secunia.com/advisories/12212|modified server can execute commands on the client|4424f4db-e697-11d8-bf04-000c763e9a47
 cfengine2<2.1.8|http://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10 http://secunia.com/advisories/12251|cfengine authentication heap corruption|f2a1dc8b-ea66-11d8-9440-000347a4fa7d
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
index f64752cca45e..5f82b69dbfda 100644
--- a/security/vuxml/vuln.xml
+++ b/security/vuxml/vuln.xml
@@ -32,8 +32,45 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="85e19dff-e606-11d8-9b0a-000347a4fa7d">
+    <topic>ripMIME -- decoding bug allowing content filter bypass</topic>
+    <affects>
+      <package>
+        <name>ripmime</name>
+        <range><lt>1.3.2.3</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>ripMIME may prematurely terminate decoding Base64 encoded
+	  messages when it encounters multiple blank lines or other
+	  non-standard Base64 constructs.  Virus scanning and content
+	  filtering tools that use ripMIME may therefore be
+	  bypassed.</p>
+	<p>The ripMIME CHANGELOG file says:</p>
+	<blockquote cite="http://www.pldaniels.com/ripmime/CHANGELOG">
+          <p>There's viruses going around exploiting the ability to
+            hide the majority of their data in an attachment by using
+            blank lines and other tricks to make scanning systems
+	    prematurely terminate their base64 decoding.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <bid>10848</bid>
+      <url>http://www.osvdb.org/8287</url>
+      <url>http://www.pldaniels.com/ripmime/CHANGELOG</url>
+      <url>http://secunia.com/advisories/12201</url>
+      <url>http://xforce.iss.net/xforce/xfdb/16867</url>
+    </references>
+    <dates>
+      <discovery>2004-07-30</discovery>
+      <entry>2004-08-27</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93">
-    <topic>moinmoin ACL group bypass (and lack thereof bypass)</topic>
+    <topic>moinmoin -- ACL group bypass</topic>
     <affects>
       <package>
         <name>moinmoin</name>