Date: Sat, 18 Feb 2017 15:00:23 +0000 (UTC) From: Thomas Zander <riggs@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r434357 - head/security/vuxml Message-ID: <201702181500.v1IF0N8U053476@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: riggs Date: Sat Feb 18 15:00:23 2017 New Revision: 434357 URL: https://svnweb.freebsd.org/changeset/ports/434357 Log: Document multiple vulnerabilities in audio/wavpack PR: 216847 Submitted by: pkubaj@anongoth.pl Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Feb 18 14:51:25 2017 (r434356) +++ head/security/vuxml/vuln.xml Sat Feb 18 15:00:23 2017 (r434357) @@ -58,6 +58,39 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="f1075415-f5e9-11e6-a4e2-5404a68ad561"> + <topic>wavpack -- multiple invalid memory reads</topic> + <affects> + <package> + <name>wavpack</name> + <range><lt>5.1.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>David Bryant reports:</p> + <blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/23/4">; + <p>global buffer overread in read_code / read_words.c</p> + <p>heap out of bounds read in WriteCaffHeader / caff.c</p> + <p>heap out of bounds read in unreorder_channels / wvunpack.c</p> + <p>heap oob read in read_new_config_info / open_utils.c</p> + </blockquote> + </body> + </description> + <references> + <url>http://www.openwall.com/lists/oss-security/2017/01/23/4</url>; + <cvename>CVE-2016-10169</cvename> + <cvename>CVE-2016-10170</cvename> + <cvename>CVE-2016-10171</cvename> + <cvename>CVE-2016-10172</cvename> + <url>https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc</url>; + </references> + <dates> + <discovery>2017-01-21</discovery> + <entry>2017-02-18</entry> + </dates> + </vuln> + <vuln vid="8fedf75c-ef2f-11e6-900e-003048f78448"> <topic>optipng -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201702181500.v1IF0N8U053476>