From owner-svn-ports-all@FreeBSD.ORG Thu Sep 19 05:44:02 2013 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id C6EE3A22; Thu, 19 Sep 2013 05:44:02 +0000 (UTC) (envelope-from remko@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id B54C5235B; Thu, 19 Sep 2013 05:44:02 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r8J5i27Z034019; Thu, 19 Sep 2013 05:44:02 GMT (envelope-from remko@svn.freebsd.org) Received: (from remko@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r8J5i26Q034018; Thu, 19 Sep 2013 05:44:02 GMT (envelope-from remko@svn.freebsd.org) Message-Id: <201309190544.r8J5i26Q034018@svn.freebsd.org> From: Remko Lodder Date: Thu, 19 Sep 2013 05:44:02 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r327595 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Sep 2013 05:44:02 -0000 Author: remko (src,doc committer) Date: Thu Sep 19 05:44:02 2013 New Revision: 327595 URL: http://svnweb.freebsd.org/changeset/ports/327595 Log: Add the latest two FreeBSD Security Advisories that have impact on -RELEASE versions. (RC's are not documented). Hat: secteam Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Sep 19 05:17:52 2013 (r327594) +++ head/security/vuxml/vuln.xml Thu Sep 19 05:44:02 2013 (r327595) @@ -51,6 +51,94 @@ Note: Please add new entries to the beg --> + + FreeBSD -- Cross-mount links between nullfs(5) mounts + + + FreeBSD + 9.19.1_7 + 8.48.4_4 + 8.38.3_11 + + + + +

Problem Description:

The nullfs(5) implementation of the VOP_LINK(9) VFS + operation does not check whether the source and target of + the link are both in the same nullfs instance. It is + therefore possible to create a hardlink from a location in + one nullfs instance to a file in another, as long as the + underlying (source) filesystem is the same.

Impact:

If multiple nullfs views into the same filesystem are + mounted in different locations, a user with read access to + one of these views and write access to another will be able + to create a hard link from the latter to a file in the + former, even though they are, from the user's perspective, + different filesystems. The user may thereby gain write + access to files which are nominally on a read-only + filesystem.

+ + + + CVE-2013-5710 + SA-13:13.nullfs + + + 2013-09-10 + 2013-09-19 + + + + + FreeBSD -- Insufficient credential checks in network ioctl(2) + + + FreeBSD + 9.19.1_7 + 8.48.4_4 + 8.38.3_11 + + + + +

Problem Description:

As is commonly the case, the IPv6 and ATM network layer + ioctl request handlers are written in such a way that an + unrecognized request is passed on unmodified to the link + layer, which will either handle it or return an error + code.

Network interface drivers, however, assume that the + SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and + SIOCSIFNETMASK requests have been handled at the network + layer, and therefore do not perform input validation or + verify the caller's credentials. Typical link-layer actions + for these requests may include marking the interface as "up" + and resetting the underlying hardware.

Impact:

An unprivileged user with the ability to run arbitrary code + can cause any network interface in the system to perform the + link layer actions associated with a SIOCSIFADDR, + SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl + request; or trigger a kernel panic by passing a specially + crafted address structure which causes a network interface + driver to dereference an invalid pointer.

Although this has not been confirmed, the possibility that + an attacker may be able to execute arbitrary code in kernel + context can not be ruled out.

+ + + + CVE-2013-5691 + SA-13:12.ifioctl + + + 2013-09-10 + 2013-09-19 + + + mozilla -- multiple vulnerabilities @@ -215,10 +303,12 @@ Note: Please add new entries to the beg CVE-2013-4315 + https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/ 2013-09-10 2013-09-12 + 2013-09-18