Date: Mon, 2 Oct 2017 14:06:27 +0000 (UTC) From: Bernard Spil <brnrd@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r451078 - head/security/vuxml Message-ID: <201710021406.v92E6ROS067119@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: brnrd Date: Mon Oct 2 14:06:26 2017 New Revision: 451078 URL: https://svnweb.freebsd.org/changeset/ports/451078 Log: security/vuxml: Document dnsmasq vulnerabilities Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Oct 2 13:26:50 2017 (r451077) +++ head/security/vuxml/vuln.xml Mon Oct 2 14:06:26 2017 (r451078) @@ -58,6 +58,52 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="b77b5646-a778-11e7-ac58-b499baebfeaf"> + <topic>dnsmasq -- mulitple</topic> + <affects> + <package> + <name>dnsmasq</name> + <range><lt>2.78,1</lt></range> + </package> + <package> + <name>dnsmasq-devel</name> + <range><lt>2.78</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Google Project Zero reports:</p> + <blockquote cite="https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html">; + <ul> + <li>CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this + commit overflow was unrestricted.</li> + <li>CVE-2017-14492: Heap based overflow.</li> + <li>CVE-2017-14493: Stack Based overflow.</li> + <li>CVE-2017-14494: Information Leak</li> + <li>CVE-2017-14495: Lack of free()</li> + <li>CVE-2017-14496: Invalid boundary checks. Integer underflow leading + to a huge memcpy.</li> + <li>CVE-2017-13704: Crash on large DNS query</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html</url>; + <cvename>CVE-2017-14491</cvename> + <cvename>CVE-2017-14492</cvename> + <cvename>CVE-2017-14493</cvename> + <cvename>CVE-2017-14494</cvename> + <cvename>CVE-2017-14495</cvename> + <cvename>CVE-2017-14496</cvename> + <cvename>CVE-2017-13704</cvename> + </references> + <dates> + <discovery>2017-10-02</discovery> + <entry>2017-10-02</entry> + </dates> + </vuln> + <vuln vid="33888815-631e-4bba-b776-a9b46fe177b5"> <topic>phpmyfaq -- multiple issues</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201710021406.v92E6ROS067119>