From owner-svn-ports-all@freebsd.org Mon Jul 13 20:46:05 2015 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 622B299CB9D; Mon, 13 Jul 2015 20:46:05 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 462631614; Mon, 13 Jul 2015 20:46:05 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.70]) by repo.freebsd.org (8.14.9/8.14.9) with ESMTP id t6DKk5hR062948; Mon, 13 Jul 2015 20:46:05 GMT (envelope-from feld@FreeBSD.org) Received: (from feld@localhost) by repo.freebsd.org (8.14.9/8.14.9/Submit) id t6DKk4ak062946; Mon, 13 Jul 2015 20:46:04 GMT (envelope-from feld@FreeBSD.org) Message-Id: <201507132046.t6DKk4ak062946@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: feld set sender to feld@FreeBSD.org using -f From: Mark Felder Date: Mon, 13 Jul 2015 20:46:04 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r391952 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2015 20:46:05 -0000 Author: feld Date: Mon Jul 13 20:46:04 2015 New Revision: 391952 URL: https://svnweb.freebsd.org/changeset/ports/391952 Log: Document CVE-2015-3152 "BACKRONYM" vulnerability PHP resolved in recent releases MySQL has fixed in 5.7 branch and did not backport to older branches MariaDB resolved in 5.5.44 and 10.0.20 Percona has not included a fix in any release (5.1, 5.5, or 5.6) Security: CVE-2015-3152 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Jul 13 20:27:49 2015 (r391951) +++ head/security/vuxml/vuln.xml Mon Jul 13 20:46:04 2015 (r391952) @@ -58,6 +58,67 @@ Notes: --> + + mysql -- SSL Downgrade + + + php56-mysql + php56-mysqli + 5.6.11 + + + php55-mysql + php55-mysqli + 5.5.27 + + + php54-mysql + php54-mysqli + 5.4.43 + + + mariadb-server + mysql51-server + mysql55-server + mysql56-server + percona55-server + percona56-server + 0 + + + mariadb55 + 5.5.44 + + + mariadb10 + 10.0.20 + + + + +

Duo Security reports:

+
Researchers have identified a serious vulnerability in some + versions of Oracle’s MySQL database product that allows an attacker to + strip SSL/TLS connections of their security wrapping transparently.
+

+ + + + https://bugs.php.net/bug.php?id=69669 + https://www.duosecurity.com/blog/backronym-mysql-vulnerability + http://www.ocert.org/advisories/ocert-2015-003.html + https://mariadb.atlassian.net/browse/MDEV-7937 + https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/ + https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/ + CVE-2015-3152 + + + 2015-03-20 + 2015-07-13 + + + devel/ipython -- CSRF possible remote execution vulnerability