svn commit: r438933 - head/security/vuxml
Jan Beich
jbeich at FreeBSD.org
Thu Apr 20 08:39:55 UTC 2017
Author: jbeich
Date: Thu Apr 20 08:39:53 2017
New Revision: 438933
URL: https://svnweb.freebsd.org/changeset/ports/438933
Log:
security/vuxml: mark some firefox < 53 bundled deps as vulnerable
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Thu Apr 20 08:27:09 2017 (r438932)
+++ head/security/vuxml/vuln.xml Thu Apr 20 08:39:53 2017 (r438933)
@@ -58,6 +58,130 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="cf133acc-82e7-4755-a66a-5ddf90dacbe6">
+ <topic>graphite2 -- out-of-bounds write with malicious font</topic>
+ <affects>
+ <package>
+ <name>graphite2</name>
+ <name>linux-c7-graphite2</name>
+ <range><lt>1.3.10</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Mozilla Foundation reports:</p>
+ <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
+ <p>An out-of-bounds write in the Graphite 2 library
+ triggered with a maliciously crafted Graphite font. This
+ results in a potentially exploitable crash. This issue was
+ fixed in the Graphite 2 library as well as Mozilla
+ products.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2017-5436</cvename>
+ <url>https://github.com/silnrsi/graphite/commit/1ce331d5548b</url>
+ </references>
+ <dates>
+ <discovery>2017-04-19</discovery>
+ <entry>2017-04-19</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="b8ee7a81-a879-4358-9b30-7dd1bd4c14b1">
+ <topic>libevent -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>libevent</name>
+ <name>libevent2</name>
+ <name>linux-c6-libevent2</name>
+ <name>linux-c7-libevent</name>
+ <range><lt>2.1.6</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Debian Security reports:</p>
+ <blockquote cite="https://security-tracker.debian.org/tracker/DSA-3789-1">
+ <p>CVE-2016-10195: The name_parse function in evdns.c in
+ libevent before 2.1.6-beta allows remote attackers to have
+ unspecified impact via vectors involving the label_len
+ variable, which triggers an out-of-bounds stack read.</p>
+ <p>CVE-2016-10196: Stack-based buffer overflow in the
+ evutil_parse_sockaddr_port function in evutil.c in libevent
+ before 2.1.6-beta allows attackers to cause a denial of
+ service (segmentation fault) via vectors involving a long
+ string in brackets in the ip_as_string argument.</p>
+ <p>CVE-2016-10197: The search_make_new function in evdns.c
+ in libevent before 2.1.6-beta allows attackers to cause a
+ denial of service (out-of-bounds read) via an empty
+ hostname.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-10195</cvename>
+ <cvename>CVE-2016-10196</cvename>
+ <cvename>CVE-2016-10197</cvename>
+ <url>http://www.openwall.com/lists/oss-security/2017/01/31/17</url>
+ <url>https://github.com/libevent/libevent/issues/317</url>
+ <url>https://github.com/libevent/libevent/issues/318</url>
+ <url>https://github.com/libevent/libevent/issues/332</url>
+ <url>https://github.com/libevent/libevent/issues/335</url>
+ </references>
+ <dates>
+ <discovery>2017-01-31</discovery>
+ <entry>2017-04-19</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="4cb165f0-6e48-423e-8147-92255d35c0f7">
+ <topic>NSS -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>nss</name>
+ <name>linux-f10-nss</name>
+ <name>linux-c6-nss</name>
+ <name>linux-c7-nss</name>
+ <range><ge>3.30</ge><lt>3.30.1</lt></range>
+ <range><ge>3.29</ge><lt>3.29.5</lt></range>
+ <range><ge>3.22</ge><lt>3.28.4</lt></range>
+ <range><lt>3.21.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Mozilla Foundation reports:</p>
+ <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
+ <p>An out-of-bounds write during Base64 decoding operation
+ in the Network Security Services (NSS) library due to
+ insufficient memory being allocated to the buffer. This
+ results in a potentially exploitable crash. The NSS library
+ has been updated to fix this issue to address this issue and
+ Firefox 53 has been updated with NSS version 3.29.5.</p>
+ </blockquote>
+ <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
+ <p>A flaw in DRBG number generation within the Network
+ Security Services (NSS) library where the internal state V
+ does not correctly carry bits over. The NSS library has been
+ updated to fix this issue to address this issue and Firefox
+ 53 has been updated with NSS version 3.29.5.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2017-5461</cvename>
+ <cvename>CVE-2017-5462</cvename>
+ <url>https://hg.mozilla.org/projects/nss/rev/99a86619eac9</url>
+ <url>https://hg.mozilla.org/projects/nss/rev/e126381a3c29</url>
+ </references>
+ <dates>
+ <discovery>2017-03-17</discovery>
+ <entry>2017-04-19</entry>
+ </dates>
+ </vuln>
+
<vuln vid="5e0a038a-ca30-416d-a2f5-38cbf5e7df33">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-head
mailing list