From owner-freebsd-ports-bugs@FreeBSD.ORG Fri Feb 29 16:30:02 2008 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9BC711065671 for ; Fri, 29 Feb 2008 16:30:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 7C3998FC39 for ; Fri, 29 Feb 2008 16:30:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m1TGU2Kh054375 for ; Fri, 29 Feb 2008 16:30:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m1TGU2EE054370; Fri, 29 Feb 2008 16:30:02 GMT (envelope-from gnats) Resent-Date: Fri, 29 Feb 2008 16:30:02 GMT Resent-Message-Id: <200802291630.m1TGU2EE054370@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nick Barkas Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3D5D01065673 for ; Fri, 29 Feb 2008 16:26:38 +0000 (UTC) (envelope-from snb@smtp.earth.threerings.net) Received: from smtp.earth.threerings.net (smtp1.earth.threerings.net [64.127.109.108]) by mx1.freebsd.org (Postfix) with ESMTP id 309688FC36 for ; Fri, 29 Feb 2008 16:26:37 +0000 (UTC) (envelope-from snb@smtp.earth.threerings.net) Received: by smtp.earth.threerings.net (Postfix, from userid 10038) id E458161E22; Fri, 29 Feb 2008 08:26:37 -0800 (PST) Message-Id: <20080229162637.E458161E22@smtp.earth.threerings.net> Date: Fri, 29 Feb 2008 08:26:37 -0800 (PST) From: Nick Barkas To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: ports/121224: [patch] Add pcre vulnerability to security/vuxml X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Nick Barkas List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Feb 2008 16:30:02 -0000 >Number: 121224 >Category: ports >Synopsis: [patch] Add pcre vulnerability to security/vuxml >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Fri Feb 29 16:30:02 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Nick Barkas >Release: FreeBSD 6.2-RELEASE-p11 i386 >Organization: Three Rings Design, Inc. >Environment: System: FreeBSD mail1.earth.threerings.net 6.2-RELEASE-p11 FreeBSD 6.2-RELEASE-p11 #0: Wed Feb 13 07:00:04 UTC 2008 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/SMP i386 >Description: PCRE versions before 7.6 are vulnerable to arbitrary code execution via a buffer overflow. The following patch adds this vulnerability to the VuXML document. >How-To-Repeat: >Fix: --- pcre_vuln.patch begins here --- --- vuln.xml.orig Wed Feb 27 17:41:13 2008 +++ vuln.xml Fri Feb 29 08:19:53 2008 @@ -34,6 +34,35 @@ --> + + pcre -- buffer overflow vulnerability + + + pcre + 7.6 + + + + +

PCRE developers report:

+
+

A character class containing a very large number of characters with + codepoints greater than 255 (in UTF-8 mode, of course) caused a + buffer overflow.

+
+ + + + CVE-2008-0674 + 27786 + http://pcre.org/changelog.txt + + + 2008-01-28 + 2008-02-29 + + + libxine -- buffer overflow vulnerability --- pcre_vuln.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: