Date: Fri, 6 Sep 2019 10:37:07 +0000 (UTC) From: Vsevolod Stakhov <vsevolod@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r511293 - head/security/vuxml Message-ID: <201909061037.x86Ab7gK040190@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: vsevolod Date: Fri Sep 6 10:37:07 2019 New Revision: 511293 URL: https://svnweb.freebsd.org/changeset/ports/511293 Log: Document Exim vulnerability Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Sep 6 10:27:43 2019 (r511292) +++ head/security/vuxml/vuln.xml Fri Sep 6 10:37:07 2019 (r511293) @@ -58,6 +58,35 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="61db9b88-d091-11e9-8d41-97657151f8c2"> + <topic>Exim -- RCE with root privileges in TLS SNI handler</topic> + <affects> + <package> + <name>exim</name> + <range><lt>4.92.2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Exim developers report:</p> + <blockquote cite="https://git.exim.org/exim.git/blob/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt">; + <p>If your Exim server accepts TLS connections, it is vulnerable. This does + not depend on the TLS libray, so both, GnuTLS and OpenSSL are affected.</p> + <p>The vulnerability is exploitable by sending a SNI ending in a +backslash-null sequence during the initial TLS handshake. The exploit +exists as a POC. For more details see the document qualys.mbx</p> + </blockquote> + </body> + </description> + <references> + <url>https://git.exim.org/exim.git/blob_plain/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt</url>; + </references> + <dates> + <discovery>2019-09-02</discovery> + <entry>2019-09-06</entry> + </dates> + </vuln> + <vuln vid="7d53d8da-d07a-11e9-8f1a-001999f8d30b"> <topic>asterisk -- Remote Crash Vulnerability in audio transcoding</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201909061037.x86Ab7gK040190>