svn commit: r517534 - head/security/vuxml
Sunpoet Po-Chuan Hsieh
sunpoet at FreeBSD.org
Wed Nov 13 23:45:37 UTC 2019
Author: sunpoet
Date: Wed Nov 13 23:45:36 2019
New Revision: 517534
URL: https://svnweb.freebsd.org/changeset/ports/517534
Log:
Document libmad vulnerability
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Wed Nov 13 23:45:30 2019 (r517533)
+++ head/security/vuxml/vuln.xml Wed Nov 13 23:45:36 2019 (r517534)
@@ -58,6 +58,55 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="b48e7b14-052a-11ea-a1de-53b029d2b061">
+ <topic>libmad -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>libmad</name>
+ <range><lt>0.15.1b_7</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>National Vulnerability Database:</p>
+ <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8372">
+ <p>CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD
+ libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a
+ denial of service (assertion failure and application exit) via a crafted
+ audio file.</p>
+ </blockquote>
+ <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8373">
+ <p>CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD
+ libmad 0.15.1b allows remote attackers to cause a denial of service
+ (heap-based buffer overflow and application crash) or possibly have
+ unspecified other impact via a crafted audio file.</p>
+ </blockquote>
+ <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8374">
+ <p>CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD
+ libmad 0.15.1b allows remote attackers to cause a denial of service
+ (heap-based buffer over-read and application crash) via a crafted audio
+ file.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133#15</url>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8372</url>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8373</url>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8374</url>
+ <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/</url>
+ <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/</url>
+ <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/</url>
+ <cvename>CVE-2017-8372</cvename>
+ <cvename>CVE-2017-8373</cvename>
+ <cvename>CVE-2017-8374</cvename>
+ </references>
+ <dates>
+ <discovery>2017-04-30</discovery>
+ <entry>2019-11-13</entry>
+ </dates>
+ </vuln>
+
<vuln vid="88d00176-058e-11ea-bd1c-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-all
mailing list