Date: Tue, 16 Aug 2016 19:07:29 +1000 From: Kubilay Kocak <koobs@FreeBSD.org> To: JosC <bsdports@cloudzeeland.nl>, FreeBSD Ports ML <freebsd-ports@freebsd.org> Subject: Re: Perl upgrade - 5.20.x vulnerable Message-ID: <280f6f77-ad33-6ebb-d54a-a97129f793b3@FreeBSD.org> In-Reply-To: <2915322d-0b1a-d36e-0725-c10bd0d32b7c@cloudzeeland.nl> References: <3f8f41ff-3262-1021-2e28-2aaae89849b6@cloudzeeland.nl> <2915322d-0b1a-d36e-0725-c10bd0d32b7c@cloudzeeland.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
On 16/08/2016 6:55 PM, JosC wrote: > Still get this port upgrade error: > > --- cut text --- > > ===>>> All >> perl5-5.20.3_14 (1/1) > ===> Cleaning for perl5-5.20.3_15 > ===> perl5-5.20.3_15 has known vulnerabilities: > perl5-5.20.3_15 is vulnerable: > p5-XSLoader -- local arbitrary code execution > CVE: CVE-2016-6185 > WWW: > https://vuxml.FreeBSD.org/freebsd/3e08047f-5a6c-11e6-a6c3-14dae9d210b8.html > > 1 problem(s) in the installed packages found. > => Please update your ports tree and try again. > => Note: Vulnerable ports are marked as such even if there is no update > available. > => If you wish to ignore this vulnerability rebuild with 'make > DISABLE_VULNERABILITIES=yes' > *** Error code 1 > > Stop. > make[1]: stopped in /usr/ports/lang/perl5.20 > *** Error code 1 > Stop. > make: stopped in /usr/ports/lang/perl5.20 > > ===>>> make build failed for lang/perl5.20 > ===>>> Aborting update > > ===>>> Update for lang/perl5.20 failed > ===>>> Aborting update > > ===>>> You can restart from the point of failure with this command line: > portmaster <flags> lang/perl5.20 > > --- cut text --- > > Can only solve by deinstalling the port and reinstall with > > 'DISABLE_VULNERABILITIES=yes' > > Perhaps I miss something, but what is exactly the issue? I just try to > understand how I can solve this... > > Thanks, > Jos > > In een bericht van 11-8-2016 20:45: >> Can someone tell me how to best upgrade from Perl5.20.x to the latest >> stable version? >> >> Tried to upgrade to Perl5.22 but got (also) the same issue while doing >> so: >> >> >> ===> Cleaning for perl5-5.20.3_14 >> ===> perl5-5.20.3_14 has known vulnerabilities: >> perl5-5.20.3_14 is vulnerable: >> p5-XSLoader -- local arbitrary code execution >> CVE: CVE-2016-6185 >> WWW: >> https://vuxml.FreeBSD.org/freebsd/3e08047f-5a6c-11e6-a6c3-14dae9d210b8.html >> >> >> perl5-5.20.3_14 is vulnerable: >> perl -- local arbitrary code execution >> CVE: CVE-2016-1238 >> WWW: >> https://vuxml.FreeBSD.org/freebsd/72bfbb09-5a6a-11e6-a6c3-14dae9d210b8.html >> >> >> 1 problem(s) in the installed packages found. >> => Please update your ports tree and try again. >> => Note: Vulnerable ports are marked as such even if there is no update >> available. >> => If you wish to ignore this vulnerability rebuild with 'make >> DISABLE_VULNERABILITIES=yes' >> *** Error code 1 >> >> Stop. >> make[1]: stopped in /usr/ports/lang/perl5.20 >> *** Error code 1 >> >> Stop. >> make: stopped in /usr/ports/lang/perl5.20 >> >> --- cut --- > > > Try running pkg audit -F to force updating/refreshing the latest VuXML changes. In this case the lang/perl5.20 (port) version string that the fix was made in [1], was only added to an existing entry in security/vuxml as an 'update' yesterday [2] [1] http://svnweb.freebsd.org/changeset/ports/420220 [2] http://svnweb.freebsd.org/changeset/ports/420219 In the absence of running 'pkg audit -F', only the"LOCALBASE/periodic/security/410.pkg-audit script updates the vuxml file and audit results. Until that happens, or pkg audit -F is run, pkg will still see an older version. Let us know how it goes ./koobs
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?280f6f77-ad33-6ebb-d54a-a97129f793b3>