svn commit: r509219 - head/security/vuxml
Niclas Zeising
zeising at FreeBSD.org
Sun Aug 18 15:21:52 UTC 2019
Author: zeising
Date: Sun Aug 18 15:21:51 2019
New Revision: 509219
URL: https://svnweb.freebsd.org/changeset/ports/509219
Log:
Document x11/xdm vulnerability CVE-2013-2179
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Sun Aug 18 15:08:02 2019 (r509218)
+++ head/security/vuxml/vuln.xml Sun Aug 18 15:21:51 2019 (r509219)
@@ -58,6 +58,40 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="d905b219-c1ca-11e9-8c46-0c9d925bbbc0">
+ <topic>xdm -- remote denial of service</topic>
+ <affects>
+ <package>
+ <name>xdm</name>
+ <range><lt>1.1.12</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>nvd.nist.gov reports</p>
+ <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2013-2179">
+ <p>X.Org xdm 1.1.10, 1.1.11, and possibly other versions,
+ when performing authentication using certain implementations of
+ the crypt API function that can return NULL, allows remote
+ attackers to cause a denial of service (NULL pointer dereference
+ and crash) by attempting to log into an account whose password
+ field contains invalid characters, as demonstrated using the crypt
+ function from glibc 2.17 and later with (1) the "!" character in
+ the salt portion of a password field or (2) a password that has
+ been encrypted using DES or MD5 in FIPS-140 mode.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2013-2179</url>
+ <cvename>CVE-2013-2179</cvename>
+ </references>
+ <dates>
+ <discovery>2013-06-07</discovery>
+ <entry>2019-08-18</entry>
+ </dates>
+ </vuln>
+
<vuln vid="d51b52cf-c199-11e9-b13f-001b217b3468">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-all
mailing list