From nobody Wed Jan 31 07:45:19 2024 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TPvG80kPxz58grb; Wed, 31 Jan 2024 07:45:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TPvG80BzYz4tYX; Wed, 31 Jan 2024 07:45:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1706687120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1kMnLouaSH9/P7+VMkmDbhtR+OrvUgDDPabrmADE6Uc=; b=NEUzMqqZxiQpcbEjkuk+hpvhfVa+kovsyCEJclkNBghyDyikiKxAUjHEgqMqz1JQWuHQBd FlvnZ3nqlUN14xoAjNzYk4rDg8occtXx2itjq7yMQjra8JquA78KwGjZkVeWGg9836S54P oqebiJJ6M8RLqySxSMNb0Xs4XmGKzms6Tfyr194pt1jstnoAT3yYSer/rpkAzbJdrYS3k+ JrbXWf5/pvv/O1Z+M3FD1e+06qdIu6UZcmtm0Ndzq0YhMD9PhxVe+s2OzRmTBd4wzl1rW8 /HNZm84V5Qfc95CLarffzvt2E1+hGI1njUrdhidCv4wjwALN2Cq+Kzlyp4CPkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1706687120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=1kMnLouaSH9/P7+VMkmDbhtR+OrvUgDDPabrmADE6Uc=; b=ljT2S9P7iX/1ut7Tiel/kGiC3Vi6GN1koKI8lhHUPXaNy9oqhp4s4m9UeT1z9zOuVoYMOV r+/OT33w7DyONZMs6M0cJi3HHD8Vm/A1Iw1GIPxHaxpkL/w8WenVpBzr/6OxFrywcot9OA Feko8tqxsxRnGNFqap5XJSM6B829GnO7ls7XcSrAVoog8VdeoB4p6ujztuaw9ztnKwTK4e eCtigFFkSt2hqeu7U58S1VyXFKwjhZNan83y5JNG4secHfO9KCPDqaawJExSzOVeUO4nME DFsZ+co+mH0ZYNqbX5Pe2cb2svJlm4yTMiNtDiSw0HbjOP0+f0Q8Pr6mKieXuQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1706687120; a=rsa-sha256; cv=none; b=UMLHS7nWrsV/E5nYqQFhMhuEUN3YP8Dsggis1NgQZmbqrGQ6UWLeNN/NLm0hEc68x/oR5z lZDXrjxDJZSzillGRUTgDnboRPlFOBkNzJUgySpUh00GRBbtsb7J2FHBHiWLrv8FINQsMk PBPTTrehd2ez6ftCHnL9HzALHjY1l+W7qfO9TP8hnyVB9scwS6gHoFUDQVZea0FqGlahFH /198d/qSNkFF5hHhciG+Evleq50zz8Ih4sVe/XuovAqEJNKFqcehaz0YpUFlWajQfA0VF9 cucsei6f6YyS+MeXJfyXpFHCGTIzwqaCJZISU9E/kQxfrOU/oXgHtyC7kiegew== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4TPvG76MYXz18Q8; Wed, 31 Jan 2024 07:45:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 40V7jJGF069707; Wed, 31 Jan 2024 07:45:19 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 40V7jJYZ069704; Wed, 31 Jan 2024 07:45:19 GMT (envelope-from git) Date: Wed, 31 Jan 2024 07:45:19 GMT Message-Id: <202401310745.40V7jJYZ069704@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Hiroki Tagato Subject: git: 145041b73074 - main - security/vuxml: document lizard memory corruption List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tagattie X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 145041b73074c241d4fe9f460e4225b1487fe257 Auto-Submitted: auto-generated The branch main has been updated by tagattie: URL: https://cgit.FreeBSD.org/ports/commit/?id=145041b73074c241d4fe9f460e4225b1487fe257 commit 145041b73074c241d4fe9f460e4225b1487fe257 Author: Hiroki Tagato AuthorDate: 2024-01-31 07:43:35 +0000 Commit: Hiroki Tagato CommitDate: 2024-01-31 07:43:35 +0000 security/vuxml: document lizard memory corruption Obtained from: https://nvd.nist.gov/vuln/detail/CVE-2018-11498 --- security/vuxml/vuln/2024.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 190cd8118f16..d29b8fadfce7 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,34 @@ + + lizard -- Negative size passed to memcpy resulting in memory corruption + + + lizard + 1.0_1 + + + + +

cve@mitre.org reports:

+
+

In Lizard v1.0 and LZ5 v2.0 (the prior release, before the product + was renamed), there is an unchecked buffer size during a memcpy in + the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). + Remote attackers can leverage this vulnerability to cause a denial + of service via a crafted input file, as well as achieve remote code + execution.

+
+ + + + CVE-2018-11498 + https://nvd.nist.gov/vuln/detail/CVE-2018-11498 + + + 2018-05-26 + 2024-01-31 + + + qt6-webengine -- Multiple vulnerabilities