svn commit: r419111 - head/security/vuxml
Mark Felder
feld at FreeBSD.org
Tue Jul 26 14:58:25 UTC 2016
Author: feld
Date: Tue Jul 26 14:58:24 2016
New Revision: 419111
URL: https://svnweb.freebsd.org/changeset/ports/419111
Log:
Document php vulnerabilities
Security: CVE-2015-8879
Security: CVE-2016-5385
Security: CVE-2016-5399
Security: CVE-2016-6288
Security: CVE-2016-6289
Security: CVE-2016-6290
Security: CVE-2016-6291
Security: CVE-2016-6292
Security: CVE-2016-6294
Security: CVE-2016-6295
Security: CVE-2016-6296
Security: CVE-2016-6297
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Tue Jul 26 14:00:22 2016 (r419110)
+++ head/security/vuxml/vuln.xml Tue Jul 26 14:58:24 2016 (r419111)
@@ -58,6 +58,161 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="b6402385-533b-11e6-a7bd-14dae9d210b8">
+ <topic>php -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>php55</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php70-curl</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php55-bz2</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56-bz2</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70-bz2</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php55-exif</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56-exif</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70-exif</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php55-gd</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56-gd</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70-gd</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php70-mcrypt</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php55-odbc</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56-odbc</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70-odbc</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php55-snmp</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56-snmp</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70-snmp</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php55-xmlrpc</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56-xmlrpc</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70-xmlrpc</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ <package>
+ <name>php55-zip</name>
+ <range><lt>5.5.38</lt></range>
+ </package>
+ <package>
+ <name>php56-zip</name>
+ <range><lt>5.6.24</lt></range>
+ </package>
+ <package>
+ <name>php70-zip</name>
+ <range><lt>7.0.9</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>PHP reports:</p>
+ <blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.38">
+ <ul>
+ <li><p>Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)</p></li>
+ <li><p>Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).</p></li>
+ <li><p>Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).</p></li>
+ <li><p>Fixed bug #72519 (imagegif/output out-of-bounds access).</p></li>
+ <li><p>Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).</p></li>
+ <li><p>Fixed bug #72533 (locale_accept_from_http out-of-bounds access).</p></li>
+ <li><p>Fixed bug #72541 (size_t overflow lead to heap corruption).</p></li>
+ <li><p>Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).</p></li>
+ <li><p>Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).</p></li>
+ <li><p>Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).</p></li>
+ <li><p>Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).</p></li>
+ <li><p>Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).</p></li>
+ <li><p>Fixed bug #72613 (Inadequate error handling in bzread()).</p></li>
+ <li><p>Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).</p></li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>http://www.php.net/ChangeLog-5.php#5.5.38</url>
+ <url>http://www.php.net/ChangeLog-5.php#5.6.24</url>
+ <url>http://www.php.net/ChangeLog-7.php#7.0.8</url>
+ <url>http://seclists.org/oss-sec/2016/q3/121</url>
+ <cvename>CVE-2015-8879</cvename>
+ <cvename>CVE-2016-5385</cvename>
+ <cvename>CVE-2016-5399</cvename>
+ <cvename>CVE-2016-6288</cvename>
+ <cvename>CVE-2016-6289</cvename>
+ <cvename>CVE-2016-6290</cvename>
+ <cvename>CVE-2016-6291</cvename>
+ <cvename>CVE-2016-6292</cvename>
+ <cvename>CVE-2016-6294</cvename>
+ <cvename>CVE-2016-6295</cvename>
+ <cvename>CVE-2016-6296</cvename>
+ <cvename>CVE-2016-6297</cvename>
+ </references>
+ <dates>
+ <discovery>2016-07-21</discovery>
+ <entry>2016-07-26</entry>
+ </dates>
+ </vuln>
+
<vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-head
mailing list