svn commit: r424859 - head/security/vuxml

Sat Oct 29 08:49:03 UTC 2016

In message <201610281534.u9SFYHfg000507 at repo.freebsd.org>, Mark Felder 
writes:
> Author: feld
> Date: Fri Oct 28 15:34:17 2016
> New Revision: 424859
> URL: https://svnweb.freebsd.org/changeset/ports/424859
> 
> Log:
>   Document sudo vulnerability
> 
> Modified:
>   head/security/vuxml/vuln.xml
> 
> Modified: head/security/vuxml/vuln.xml
> =============================================================================
> =
> --- head/security/vuxml/vuln.xml	Fri Oct 28 15:08:14 2016	(r42485
> 8)
> +++ head/security/vuxml/vuln.xml	Fri Oct 28 15:34:17 2016	(r42485
> 9)
> @@ -58,6 +58,35 @@ Notes:
>    * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
>  -->
>  <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
> +  <vuln vid="2e4fbc9a-9d23-11e6-a298-14dae9d210b8">
> +    <topic>sudo -- Potential bypass of sudo_noexec.so via wordexp()</topic>
> +    <affects>
> +      <package>
> +	<name>sudo</name>
> +	<range><ge>1.6.8</ge><lt>1.8.18p1</lt></range>
> +      </package>
> +    </affects>
> +    <description>
> +      <body xmlns="http://www.w3.org/1999/xhtml">
> +	<p>Todd C. Miller reports:</p>
> +	<blockquote cite="https://www.sudo.ws/alerts/noexec_wordexp.html">
> +	  <p>A flaw exists in sudo's noexec functionality that may allow
> +	    a user with sudo privileges to run additional commands even when th
> e
> +	    NOEXEC tag has been applied to a command that uses the wordexp()
> +	    function.</p>
> +	</blockquote>
> +      </body>
> +    </description>
> +    <references>
> +      <url>https://www.sudo.ws/alerts/noexec_wordexp.html</url>
> +      <cvename>CVE-2016-7076</cvename>
> +    </references>
> +    <dates>
> +      <discovery>2016-10-28</discovery>
> +      <entry>2016-10-28</entry>
> +    </dates>
> +  </vuln>
> +
>    <vuln vid="ac18046c-9b08-11e6-8011-005056925db4">
>      <topic>Axis2 -- Security vulnerabilities on dependency Apache HttpClient
> </topic>
>      <affects>
> 
> 

Thanks.

-- 
Cheers,
Cy Schubert <Cy.Schubert at cschubert.com>
FreeBSD UNIX:  <cy at FreeBSD.org>   Web:  http://www.FreeBSD.org

	The need of the many outweighs the greed of the few.