From owner-svn-ports-head@FreeBSD.ORG Wed Feb 20 13:58:20 2013 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 83A1CDA0; Wed, 20 Feb 2013 13:58:20 +0000 (UTC) (envelope-from rm@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 6B48B392; Wed, 20 Feb 2013 13:58:20 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.5/8.14.5) with ESMTP id r1KDwKhj094477; Wed, 20 Feb 2013 13:58:20 GMT (envelope-from rm@svn.freebsd.org) Received: (from rm@localhost) by svn.freebsd.org (8.14.5/8.14.5/Submit) id r1KDwKxc094476; Wed, 20 Feb 2013 13:58:20 GMT (envelope-from rm@svn.freebsd.org) Message-Id: <201302201358.r1KDwKxc094476@svn.freebsd.org> From: Ruslan Mahmatkhanov Date: Wed, 20 Feb 2013 13:58:20 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r312626 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Feb 2013 13:58:20 -0000 Author: rm Date: Wed Feb 20 13:58:19 2013 New Revision: 312626 URL: http://svnweb.freebsd.org/changeset/ports/312626 Log: - add an entry for net/nss-pam-ldapd stack-based buffer overflow According to advisory, vulnerability exists in nss-pam-ldapd < 0.8.11, but since we never had this version in the ports tree, mark everything < 0.8.12 as vulnerable. PR: 176293 Submitted by: pluknet Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Feb 20 11:12:25 2013 (r312625) +++ head/security/vuxml/vuln.xml Wed Feb 20 13:58:19 2013 (r312626) @@ -51,6 +51,35 @@ Note: Please add new entries to the beg --> + + nss-pam-ldapd -- file descriptor buffer overflow + + + nss-pam-ldapd + 0.8.12 + + + + +

Garth Mollett reports:

+
A file descriptor overflow issue in the use of FD_SET() + in nss-pam-ldapd can lead to a stack-based buffer overflow. + An attacker could, under some circumstances, use this flaw + to cause a process that has the NSS or PAM module loaded to + crash or potentially execute arbitrary code.
+

+ + + + CVE-2013-0288 + + + 2013-02-18 + 2013-02-20 + + + bugzilla -- multiple vulnerabilities