Date: Sat, 13 Jun 2020 04:43:34 +0000 (UTC) From: Cy Schubert <cy@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r538637 - head/security/vuxml Message-ID: <202006130443.05D4hYSu044536@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cy Date: Sat Jun 13 04:43:34 2020 New Revision: 538637 URL: https://svnweb.freebsd.org/changeset/ports/538637 Log: Document multiple sqlite3 vulnerabilities with CVSS scores ranging from 5.5 (medium) to 7.5 (high). PR: 247149 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Jun 13 04:09:08 2020 (r538636) +++ head/security/vuxml/vuln.xml Sat Jun 13 04:43:34 2020 (r538637) @@ -58,6 +58,53 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="c4ac9c79-ab37-11ea-8b5e-b42e99a1b9c3"> + <topic>several security issues in sqlite3</topic> + <affects> + <package> + <name>sqlite3</name> + <range><lt>3.32.2</lt></range> + </package> + <package> + <name>FreeBSD</name> + <range><le>12.1_6</le></range> + <range><le>11.3_10</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>sqlite3 update:</p> + <p>Various security issues could be used by an attacker to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.</p> + <ul> + <li>CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.</li> + <li>CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.</li> + <li>CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.</li> + <li>CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.</li> + <li>CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.</li> + <li>CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.</li> + </ul> + </body> + </description> + <references> + <url>https://nvd.nist.gov/vuln/detail/CVE-2020-11655</url> + <cvename>CVE-2020-11655</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13434</url> + <cvename>CVE-2020-13434</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13435</url> + <cvename>CVE-2020-13435</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13630</url> + <cvename>CVE-2020-13630</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13631</url> + <cvename>CVE-2020-13631</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13632</url> + <cvename>CVE-2020-13632</cvename> + </references> + <dates> + <discovery>2020-05-25</discovery> + <entry>2020-06-10</entry> + </dates> + </vuln> + <vuln vid="11fcfa8f-ac64-11ea-9dab-000d3ab229d6"> <topic>Node.js -- June 2020 Security Releases</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202006130443.05D4hYSu044536>