Date: Sun, 11 Jan 2015 19:39:46 +0000 (UTC) From: Martin Matuska <mm@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r376799 - head/security/vuxml Message-ID: <201501111939.t0BJdkfB004426@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mm Date: Sun Jan 11 19:39:45 2015 New Revision: 376799 URL: https://svnweb.freebsd.org/changeset/ports/376799 QAT: https://qat.redports.org/buildarchive/r376799/ Log: Add vuln.xml entry for libevent CVE-2014-6272 PR: ports/199640 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Jan 11 19:25:27 2015 (r376798) +++ head/security/vuxml/vuln.xml Sun Jan 11 19:39:45 2015 (r376799) @@ -57,6 +57,43 @@ Notes: --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="daa8a49b-99b9-11e4-8f66-3085a9a4510d"> + <topic>libevent -- integer overflow in evbuffers</topic> + <affects> + <package> + <name>libevent</name> + <range><lt>1.4.15</lt></range> + </package> + <package> + <name>libevent2</name> + <range><lt>2.0.22</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Debian Security Team reports:</p> + <blockquote cite="https://www.debian.org/security/2015/dsa-3119">; + <p>Andrew Bartlett of Catalyst reported a defect affecting certain + applications using the Libevent evbuffer API. This defect leaves + applications which pass insanely large inputs to evbuffers open + to a possible heap overflow or infinite loop. In order to exploit + this flaw, an attacker needs to be able to find a way to provoke + the program into trying to make a buffer chunk larger than what + will fit into a single size_t or off_t. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2014-6272</cvename> + <url>https://www.debian.org/security/2015/dsa-3119</url>; + </references> + <dates> + <discovery>2015-01-05</discovery> + <entry>2015-01-11</entry> + </dates> + </vuln> + <vuln vid="caa98ffd-0a92-40d0-b234-fd79b429157e"> <topic>cURL -- URL request injection vulnerability</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201501111939.t0BJdkfB004426>