svn commit: r401184 - head/security/vuxml
Jason Unovitch
junovitch at FreeBSD.org
Tue Nov 10 03:18:51 UTC 2015
Author: junovitch
Date: Tue Nov 10 03:18:50 2015
New Revision: 401184
URL: https://svnweb.freebsd.org/changeset/ports/401184
Log:
Revise lldpd entry to cover denial of service CVE and add references.
PR: 204044
Security: CVE-2015-8012
Security: CVE-2015-8011
Security: https://vuxml.FreeBSD.org/freebsd/2a4a112a-7c1b-11e5-bd77-0800275369e2.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Tue Nov 10 02:56:41 2015 (r401183)
+++ head/security/vuxml/vuln.xml Tue Nov 10 03:18:50 2015 (r401184)
@@ -290,7 +290,7 @@ Notes:
</vuln>
<vuln vid="2a4a112a-7c1b-11e5-bd77-0800275369e2">
- <topic>lldpd -- Buffer overflow</topic>
+ <topic>lldpd -- Buffer overflow/Denial of service</topic>
<affects>
<package>
<name>lldpd</name>
@@ -304,14 +304,22 @@ Notes:
<p>A buffer overflow may allow arbitrary code execution
only if hardening was disabled.</p>
</blockquote>
+ <blockquote cite="https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c46772388417a00">
+ <p>Malformed packets should not make lldpd crash. Ensure we can
+ handle them by not using assert() in this part.</p>
+ </blockquote>
</body>
</description>
<references>
+ <cvename>CVE-2015-8011</cvename>
+ <cvename>CVE-2015-8012</cvename>
<url>https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS</url>
+ <url>http://www.openwall.com/lists/oss-security/2015/10/30/2</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-26</entry>
+ <modified>2015-11-10</modified>
</dates>
</vuln>
More information about the svn-ports-all
mailing list