From owner-freebsd-ports-bugs@FreeBSD.ORG Wed Oct 3 21:40:01 2007 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A3F8816A420 for ; Wed, 3 Oct 2007 21:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 6D5A113C465 for ; Wed, 3 Oct 2007 21:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.1/8.14.1) with ESMTP id l93Le1Fd089003 for ; Wed, 3 Oct 2007 21:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.1/8.14.1/Submit) id l93Le131089002; Wed, 3 Oct 2007 21:40:01 GMT (envelope-from gnats) Resent-Date: Wed, 3 Oct 2007 21:40:01 GMT Resent-Message-Id: <200710032140.l93Le131089002@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nick Barkas Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4AD3516A468 for ; Wed, 3 Oct 2007 21:37:35 +0000 (UTC) (envelope-from snb@smtp.earth.threerings.net) Received: from smtp.earth.threerings.net (smtp1.earth.threerings.net [64.127.109.108]) by mx1.freebsd.org (Postfix) with ESMTP id 24FAB13C46A for ; Wed, 3 Oct 2007 21:37:35 +0000 (UTC) (envelope-from snb@smtp.earth.threerings.net) Received: by smtp.earth.threerings.net (Postfix, from userid 10038) id 132E161DCF; Wed, 3 Oct 2007 14:37:35 -0700 (PDT) Message-Id: <20071003213735.132E161DCF@smtp.earth.threerings.net> Date: Wed, 3 Oct 2007 14:37:35 -0700 (PDT) From: Nick Barkas To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: ports/116881: [patch] security/vuxml add entry for buffer overflow in tcl < 8.4.16 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Nick Barkas List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Oct 2007 21:40:01 -0000 >Number: 116881 >Category: ports >Synopsis: [patch] security/vuxml add entry for buffer overflow in tcl < 8.4.16 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Wed Oct 03 21:40:01 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Nick Barkas >Release: FreeBSD 6.2-RELEASE-p4 i386 >Organization: Three Rings Desing, Inc. >Environment: System: FreeBSD mail1.earth.threerings.net 6.2-RELEASE-p4 FreeBSD 6.2-RELEASE-p4 #0: Thu Apr 26 17:55:55 UTC 2007 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/SMP i386 >Description: lang/tcl84 below 8.4.16 is vulnerable to a buffer overflow. This patch adds an entry to VuXML for this vulnerability. tcl 8.4.16 is already available in the ports tree. >How-To-Repeat: >Fix: --- vuln.xml.patch begins here --- --- vuln.xml.orig 2007-10-03 23:17:00.000000000 +0200 +++ vuln.xml 2007-10-03 23:27:34.000000000 +0200 @@ -34,6 +34,41 @@ --> + + tcl -- buffer overflow in ReadImage function + + + tcl + 8.4.16 + + + + +

Secunia reports:

+
+

A vulnerability has been reported in Tk, which can potentially be + exploited by malicious people to compromise an application using the + library.

+

The vulnerability is caused due to a boundary error within the + "ReadImage()" function in generic/tkImgGIF.c. This can be exploited to + cause a buffer overflow via interlaced GIF files containing multiple + smaller frames following the first frame.

+

Successful exploitation may allow execution of arbitrary code.

+

The vulnerability is reported in versions prior to 8.4.16.

+
+ + + + http://secunia.com/advisories/26942 + http://sourceforge.net/project/shownotes.php?release_id=541207 + CVE-2007-5137 + + + 2007-09-27 + 2007-10-03 + + + id3lib -- insecure temporary file creation --- vuln.xml.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: