git: 68056e7f1306 - main - security/vuxml: Add CVE-2022-0323 (www/phpmustache)
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 27 Jan 2022 07:20:49 UTC
The branch main has been updated by fernape:
URL: https://cgit.FreeBSD.org/ports/commit/?id=68056e7f1306019698f71ac7fb262427da558e73
commit 68056e7f1306019698f71ac7fb262427da558e73
Author: Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2022-01-27 07:07:46 +0000
Commit: Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2022-01-27 07:18:51 +0000
security/vuxml: Add CVE-2022-0323 (www/phpmustache)
Following change in 4f0a5e1540c3..6901bf72b3b2
Reported by: Marc Veldman <marc@bumblingdork.com> (maintainer)
---
security/vuxml/vuln-2022.xml | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml
index 7d27bd6cc453..2ff34eca31d9 100644
--- a/security/vuxml/vuln-2022.xml
+++ b/security/vuxml/vuln-2022.xml
@@ -1,3 +1,32 @@
+ <vuln vid="65847d9d-7f3e-11ec-8624-b42e991fc52e">
+ <topic>mustache - Possible Remote Code Execution</topic>
+ <affects>
+ <package>
+ <name>phpmustache</name>
+ <range><lt>2.14.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>huntr.dev reports:</p>
+ <blockquote cite="https://huntr.dev/bounties/a5f5a988-aa52-4443-839d-299a63f44fb7/">
+ <p>In Mustache.php v2.0.0 through v2.14.0, Sections tag can
+ lead to arbitrary php code execution even if
+ strict_callables is true when section value is
+ controllable.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2022-0323</cvename>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-0323</url>
+ </references>
+ <dates>
+ <discovery>2022-01-20</discovery>
+ <entry>2022-01-27</entry>
+ </dates>
+ </vuln>
+
<vuln vid="0f8bf913-7efa-11ec-8c04-2cf05d620ecc">
<topic>polkit -- Local Privilege Escalation</topic>
<affects>