Date: Fri, 30 Jun 2017 11:05:28 +0000 (UTC) From: Dmitry Marakasov <amdmi3@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r444707 - head/security/vuxml Message-ID: <201706301105.v5UB5SSp063494@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: amdmi3 Date: Fri Jun 30 11:05:28 2017 New Revision: 444707 URL: https://svnweb.freebsd.org/changeset/ports/444707 Log: - Document tor security regression Security: CVE-2017-0377 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Jun 30 10:05:05 2017 (r444706) +++ head/security/vuxml/vuln.xml Fri Jun 30 11:05:28 2017 (r444707) @@ -58,6 +58,42 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="0b9f4b5e-5d82-11e7-85df-14dae9d5a9d2"> + <topic>tor -- security regression</topic> + <affects> + <package> + <name>tor</name> + <range><lt>0.3.0.9</lt></range> + </package> + <package> + <name>tor-devel</name> + <range><lt>0.3.1.4.a</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Tor Project reports:</p> + <blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html">; + <p>Tor 0.3.0.9 fixes a path selection bug that would allow a client + to use a guard that was in the same network family as a chosen exit + relay. This is a security regression; all clients running earlier + versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or + 0.3.1.4-alpha.</p> + </blockquote> + </body> + </description> + <references> + <url>https://blog.torproject.org/blog/tor-0309-released-security-update-clients</url>; + <url>https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients</url>; + <url>https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html</url>; + <cvename>CVE-2017-0377</cvename> + </references> + <dates> + <discovery>2017-06-29</discovery> + <entry>2017-06-30</entry> + </dates> + </vuln> + <vuln vid="8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f"> <topic>exim -- Privilege escalation via multiple memory leaks</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201706301105.v5UB5SSp063494>