Date: Mon, 13 Dec 2021 16:54:12 GMT From: Ashish SHUKLA <ashish@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: c378636ba08f - main - security/vuxml: Document vulnerabilities in Matrix clients Message-ID: <202112131654.1BDGsCnp082098@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by ashish: URL: https://cgit.FreeBSD.org/ports/commit/?id=c378636ba08f3fcab5ceba4413bfae2c6c5d85ff commit c378636ba08f3fcab5ceba4413bfae2c6c5d85ff Author: Ashish SHUKLA <ashish@FreeBSD.org> AuthorDate: 2021-12-13 16:52:39 +0000 Commit: Ashish SHUKLA <ashish@FreeBSD.org> CommitDate: 2021-12-13 16:52:39 +0000 security/vuxml: Document vulnerabilities in Matrix clients Security: 0dcf68fa-5c31-11ec-875e-901b0e9408dc --- security/vuxml/vuln-2021.xml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index 66346c65163b..323849898ffd 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,38 @@ + <vuln vid="0dcf68fa-5c31-11ec-875e-901b0e9408dc"> + <topic>Matrix clients -- several vulnerabilities</topic> + <affects> + <package> + <name>cinny</name> + <range><lt>1.6.0</lt></range> + </package> + <package> + <name>element-web</name> + <range><lt>1.9.7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Matrix developers report:</p> + <blockquote cite="https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk">; + <p>Today we are releasing security updates to libolm, matrix-js-sdk, + and several clients including Element Web / Desktop. Users are + encouraged to upgrade as soon as possible.</p> + <p>These releases mitigate a buffer overflow in olm_session_describe, + a libolm debugging function used by matrix-js-sdk in its end-to-end + encryption (E2EE) implementation. If you rely on matrix-js-sdk for + E2EE, you are affected.</p> + </blockquote> + </body> + </description> + <references> + <url>https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdk</url>; + </references> + <dates> + <discovery>2021-12-03</discovery> + <entry>2021-12-13</entry> + </dates> + </vuln> + <vuln vid="93a1c9a7-5bef-11ec-a47a-001517a2e1a4"> <topic>openhab -- log4j remote code injection</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202112131654.1BDGsCnp082098>