git: eb54bae70a84 - main - security/vuxml: Remove spurious file
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 22 Sep 2023 10:39:19 UTC
The branch main has been updated by fernape:
URL: https://cgit.FreeBSD.org/ports/commit/?id=eb54bae70a84effe0d024cfd343c6698ad61fc86
commit eb54bae70a84effe0d024cfd343c6698ad61fc86
Author: Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2023-09-22 10:22:02 +0000
Commit: Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2023-09-22 10:39:05 +0000
security/vuxml: Remove spurious file
Fixes: 20c93ef1ae8f43a36f9b05e79e6531b6186f3a86
---
security/vuxml/attachment.cgi?id=244811 | 57 ---------------------------------
1 file changed, 57 deletions(-)
diff --git a/security/vuxml/attachment.cgi?id=244811 b/security/vuxml/attachment.cgi?id=244811
deleted file mode 100644
index 20c93ef1ae8f..000000000000
--- a/security/vuxml/attachment.cgi?id=244811
+++ /dev/null
@@ -1,57 +0,0 @@
-From 7ea414f0f67c4e6e54d86d54fd639ff476d9af73 Mon Sep 17 00:00:00 2001
-From: Yasuhiro Kimura <yasu@FreeBSD.org>
-Date: Thu, 14 Sep 2023 00:15:37 +0900
-Subject: [PATCH] security/vuxml: Document "eat all memory" vulnerability in
- curl
-
----
- security/vuxml/vuln/2023.xml | 36 ++++++++++++++++++++++++++++++++++++
- 1 file changed, 36 insertions(+)
-
-diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
-index eb3c8fd68d81..862e66ee01b6 100644
---- a/security/vuxml/vuln/2023.xml
-+++ b/security/vuxml/vuln/2023.xml
-@@ -1,3 +1,39 @@
-+ <vuln vid="833b469b-5247-11ee-9667-080027f5fec9">
-+ <topic>curl -- HTTP headers eat all memory</topic>
-+ <affects>
-+ <package>
-+ <name>curl</name>
-+ <range><lt>8.3.0</lt></range>
-+ </package>
-+ </affects>
-+ <description>
-+ <body xmlns="http://www.w3.org/1999/xhtml">
-+ <p>selmelc on hackerone reports:</p>
-+ <blockquote cite="https://curl.se/docs/CVE-2023-38039.html">
-+ <p>
-+ When curl retrieves an HTTP response, it stores the
-+ incoming headers so that they can be accessed later via
-+ the libcurl headers API.
-+ </p>
-+ <p>
-+ However, curl did not have a limit in how many or how
-+ large headers it would accept in a response, allowing a
-+ malicious server to stream an endless series of headers
-+ and eventually cause curl to run out of heap memory.
-+ </p>
-+ </blockquote>
-+ </body>
-+ </description>
-+ <references>
-+ <cvename>CVE-2023-38039</cvename>
-+ <url>https://curl.se/docs/CVE-2023-38039.html HERE</url>
-+ </references>
-+ <dates>
-+ <discovery>2023-09-13</discovery>
-+ <entry>2023-09-13</entry>
-+ </dates>
-+ </vuln>
-+
- <vuln vid="b5508c08-547a-11ee-85eb-84a93843eb75">
- <topic>Roundcube -- XSS vulnerability</topic>
- <affects>
---
-2.42.0
-