git: 7e559598e001 - 2023Q1 - security/vuxml: add an entry for CVE-2022-4170 in x11/rxvt-unicode

From: Thierry Thomas <thierry_at_FreeBSD.org>
Date: Tue, 03 Jan 2023 11:14:23 UTC 
The branch 2023Q1 has been updated by thierry:

URL: https://cgit.FreeBSD.org/ports/commit/?id=7e559598e001276bd9d2652aebad1f0e977760f2

commit 7e559598e001276bd9d2652aebad1f0e977760f2
Author:     Thierry Thomas <thierry@FreeBSD.org>
AuthorDate: 2023-01-03 10:16:55 +0000
Commit:     Thierry Thomas <thierry@FreeBSD.org>
CommitDate: 2023-01-03 11:13:38 +0000

    security/vuxml: add an entry for CVE-2022-4170 in x11/rxvt-unicode
    
    Security:       CVE-2022-4170
    (cherry picked from commit 93b08b54dd5ecbc0fe26aa4660191a591e213f5f)
---
 security/vuxml/Makefile      |  1 +
 security/vuxml/vuln/2023.xml | 29 +++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/security/vuxml/Makefile b/security/vuxml/Makefile
index 11132d8c65d5..1c5016141eb3 100644
--- a/security/vuxml/Makefile
+++ b/security/vuxml/Makefile
@@ -10,6 +10,7 @@ DIST_SUBDIR=	vuxml
 
 MAINTAINER=	ports-secteam@FreeBSD.org
 COMMENT=	Vulnerability and eXposure Markup Language DTD
+WWW=		https://vuxml.freebsd.org/
 
 LICENSE=	BSD2CLAUSE
 
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index 794ada3ebc27..8b880c07b232 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -1,3 +1,32 @@
+  <vuln vid="5b2eac07-8b4d-11ed-8b23-a0f3c100ae18">
+    <topic>rxvt-unicode is vulnerable to a remote code execution</topic>
+    <affects>
+      <package>
+	<name>rxvt-unicode</name>
+	<range><lt>9.31</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Marc Lehmann reports:</p>
+	<blockquote cite="http://lists.schmorp.de/pipermail/rxvt-unicode/2023q1/002638.html">
+	  <p>The biggest issue is resolving CVE-2022-4170, which allows command
+	     execution inside urxvt from within the terminal (that means anything that
+	     can output text in the terminal can start commands in the context of the
+	     urxvt process, even remotely).</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2022-4170</cvename>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2022-4170</url>
+    </references>
+    <dates>
+      <discovery>2022-12-05</discovery>
+      <entry>2023-01-03</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="86c330fe-bbae-4ca7-85f7-5321e627a4eb">
     <topic>gitea -- multiple issues</topic>
     <affects>