svn commit: r546691 - head/security/vuxml
Craig Leres
leres at FreeBSD.org
Thu Aug 27 20:50:22 UTC 2020
Author: leres
Date: Thu Aug 27 20:50:21 2020
New Revision: 546691
URL: https://svnweb.freebsd.org/changeset/ports/546691
Log:
security/vuxml: Mark php72, php73, and php74 vulnerable as per:
https://www.php.net/ChangeLog-7.php#PHP_7_4
https://www.php.net/ChangeLog-7.php#PHP_7_3
https://www.php.net/ChangeLog-7.php#PHP_7_2
The phar_parse_zipfile function had [a] use-after-free vulnerability
because of [a] mishandling of the actual_alias variable.
Security: CVE-2020-7068
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Thu Aug 27 20:47:12 2020 (r546690)
+++ head/security/vuxml/vuln.xml Thu Aug 27 20:50:21 2020 (r546691)
@@ -58,6 +58,42 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="ee261034-b95e-4479-b947-08b0877e029f">
+ <topic>php72 -- use of freed hash key</topic>
+ <affects>
+ <package>
+ <name>php72</name>
+ <range><lt>7.2.33</lt></range>
+ </package>
+ <package>
+ <name>php73</name>
+ <range><lt>7.3.21</lt></range>
+ </package>
+ <package>
+ <name>php74</name>
+ <range><lt>7.4.9</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>grigoritchy at gmail dot com reports:</p>
+ <blockquote cite="https://bugs.php.net/bug.php?id=79797">
+ <p>The phar_parse_zipfile function had use-after-free
+ vulnerability because of mishandling of the actual_alias
+ variable.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7068</url>
+ <cvename>CVE-2020-7068</cvename>
+ </references>
+ <dates>
+ <discovery>2020-07-06</discovery>
+ <entry>2020-08-27</entry>
+ </dates>
+ </vuln>
+
<vuln vid="d73bc4e6-e7c4-11ea-a878-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-head
mailing list