Date: Fri, 14 Aug 2020 00:14:16 +0000 (UTC) From: Larry Rosenman <ler@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r544856 - head/security/vuxml Message-ID: <202008140014.07E0EGtD000929@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ler Date: Fri Aug 14 00:14:16 2020 New Revision: 544856 URL: https://svnweb.freebsd.org/changeset/ports/544856 Log: security/vuxml: mail/dovecot multiple vulnerabilities. Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Aug 13 23:48:10 2020 (r544855) +++ head/security/vuxml/vuln.xml Fri Aug 14 00:14:16 2020 (r544856) @@ -58,6 +58,51 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="87a07de1-e55e-4d51-bb64-8d117829a26a"> + <topic>mail/dovecot -- multiple vulnerabilities</topic> + <affects> + <package> + <name>dovecot</name> + <range><lt>2.3.11</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Aki Tuomi reports:</p> + <blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">; + <p>Parsing mails with a large number of MIME parts could + have resulted in excessive CPU usage or a crash due to running out of + stack memory..</p> + </blockquote> + <blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">; + <p>Dovecot's NTLM implementation does not correctly check + message buffer size, which leads to reading past allocation which can + lead to crash</p> + </blockquote> + <blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">; + <p>lmtp/submission: Issuing the RCPT command with an + address that has the empty quoted string as local-part causes the lmtp + service to crash.</p> + </blockquote> + <blockquote cite="https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html">; + <p>Dovecot's RPA mechanism implementation accepts + zero-length message, which leads to assert-crash later on.</p> + </blockquote> + </body> + </description> + <references> + <url>https://dovecot.org/pipermail/dovecot-news/2020-August/000440.html</url>; + <cvename>CVE-2020-12100</cvename> + <cvename>CVE-2020-12673</cvename> + <cvename>CVE-2020-10967</cvename> + <cvename>CVE-2020-12674</cvename> + </references> + <dates> + <discovery>2020-04-23</discovery> + <entry>2020-08-13</entry> + </dates> + </vuln> + <vuln vid="b1d6b383-dd51-11ea-a688-7b12871ef3ad"> <topic>ilmbase, openexr -- v2.5.3 is a patch release with various bug/security fixes</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202008140014.07E0EGtD000929>