Date: Mon, 9 Aug 2021 20:15:54 GMT From: Cy Schubert <cy@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: ea46c60b62e1 - main - security/vuxml: Document x11/cde local privilege escalation Message-ID: <202108092015.179KFsJs002785@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by cy: URL: https://cgit.FreeBSD.org/ports/commit/?id=ea46c60b62e15e7370387bcb7b472905a269a566 commit ea46c60b62e15e7370387bcb7b472905a269a566 Author: Cy Schubert <cy@FreeBSD.org> AuthorDate: 2021-08-09 18:15:59 +0000 Commit: Cy Schubert <cy@FreeBSD.org> CommitDate: 2021-08-09 20:15:04 +0000 security/vuxml: Document x11/cde local privilege escalation Security: CVE-2020-2696, VU#308289 --- security/vuxml/vuln-2021.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index 284a47041149..165f010a6519 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,34 @@ + <vuln vid="848bdd06-f93a-11eb-9f7d-206a8a720317"> + <topic>x11/cde -- Local privilege escalation via CDE dtsession</topic> + <affects> + <package> + <name>cde</name> + <range><lt>2.4.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Marco Ivaldi (marco.ivaldi () mediaservice net) reports:</p> + <blockquote cite="https://seclists.org/bugtraq/2020/Jan/22">; + <p>A buffer overflow in the CheckMonitor() function in the Common + Desktop Environment 2.3.1 and earlier and 1.6 and earlier, + as distributed with Oracle Solaris 10 1/13 (Update 11) and + earlier, allows local users to gain root privileges via a long + palette name passed to dtsession in a malicious .Xdefaults + file.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2020-2696</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2696</url>; + </references> + <dates> + <discovery>2020-01-15</discovery> + <entry>2021-08-09</entry> + </dates> + </vuln> + <vuln vid="880552c4-f63f-11eb-9d56-7186043316e9"> <topic>go -- net/http: panic due to racy read of persistConn after handler panic</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202108092015.179KFsJs002785>