From owner-svn-ports-head@freebsd.org Sun Oct 6 05:42:05 2019 Return-Path: Delivered-To: svn-ports-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 94B9E12A717; Sun, 6 Oct 2019 05:42:05 +0000 (UTC) (envelope-from tobik@freebsd.org) Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 46mCDF3Prlz4fHR; Sun, 6 Oct 2019 05:42:05 +0000 (UTC) (envelope-from tobik@freebsd.org) Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id 9ABEF20F51; Sun, 6 Oct 2019 01:42:04 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute7.internal (MEProxy); Sun, 06 Oct 2019 01:42:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=K0RBml +VEC821Rj6XAQW40m9yFEIZKwDvfSwkHH6jf8=; b=JFwDsgmWl7YM5x7qR/e9If wR62ZkNrL1P0wS5zu+Z0J4bhzSrcEhzaSM57OJQW2x2CLrqhCRxEjGGm/nLJdKMJ 9nHP/I3wTbBBrPpAOSITUwfCzx1VXmynWSf+8+C6Nz3TkNxswt8s5ykDUk8ZebUc olj0vwjk/t0qfwF6+ryI+kqB8uaF24qlSPPfzLbFBZAL06T3msEW9kD3jBRt833z w73R8uEkz/3YP+35BVlGgSr/Q+07N1a2kSV90uZJwuy3CxrDv398QDcm/wlwKQAJ wp+as8sPW1RRMFkt6ImAYtau/6ESF8N27Xfcy5v+XYHVr5Imm8D4nZeECSgptXJw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedufedrheeggdeigecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecufghrlhcuvffnffculddqiedmnecujfgurhepfffhvf fukfhfgggtuggjfgesghdtreertdervdenucfhrhhomhepvfhosghirghsucfmohhrthhk rghmphcuoehtohgsihhksehfrhgvvggsshgurdhorhhgqeenucffohhmrghinhepfhhrvg gvsghsugdrohhrghdpmhhithhrvgdrohhrghdpnhhishhtrdhgohhvpdifrhhonhhgrdhg rhgrphhhihgtshdpvhhugihmlhdrohhrghenucfkphepleehrdeltddrvddviedruddune curfgrrhgrmhepmhgrihhlfhhrohhmpehtohgsihhksehfrhgvvggsshgurdhorhhgnecu vehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: from urd.tobik.me (ip5f5ae20b.dynamic.kabel-deutschland.de [95.90.226.11]) by mail.messagingengine.com (Postfix) with ESMTPA id 99EF0D6005A; Sun, 6 Oct 2019 01:42:03 -0400 (EDT) Date: Sun, 6 Oct 2019 07:42:01 +0200 From: Tobias Kortkamp To: Cy Schubert Cc: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: Re: svn commit: r513861 - head/security/vuxml Message-ID: <20191006054201.GA62549@urd.tobik.me> References: <201910060148.x961mok1058065@repo.freebsd.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="8t9RHnE3ZwKMSgU+" Content-Disposition: inline In-Reply-To: <201910060148.x961mok1058065@repo.freebsd.org> User-Agent: Mutt/1.12.1 (2019-06-15) X-Rspamd-Queue-Id: 46mCDF3Prlz4fHR X-Spamd-Bar: ----- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-6.00 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-0.998,0]; REPLY(-4.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000,0] X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Oct 2019 05:42:05 -0000 --8t9RHnE3ZwKMSgU+ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Oct 06, 2019 at 01:48:50AM +0000, Cy Schubert wrote: > Author: cy > Date: Sun Oct 6 01:48:49 2019 > New Revision: 513861 > URL: https://svnweb.freebsd.org/changeset/ports/513861 >=20 > Log: > Document two new Xpdf vulnerabilities: CVE-2019-16927 and CVE-2019-9877. > =20 > PR: 241066 > Security: https://nvd.nist.gov/vuln/detail/CVE-2019-16927 > Security: https://nvd.nist.gov/vuln/detail/CVE-2019-9877 > Security: https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2019-9877 > Security: https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2019-169= 27 >=20 > Modified: > head/security/vuxml/vuln.xml >=20 > Modified: head/security/vuxml/vuln.xml > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D > --- head/security/vuxml/vuln.xml Sun Oct 6 01:42:14 2019 (r513860) > +++ head/security/vuxml/vuln.xml Sun Oct 6 01:48:49 2019 (r513861) > @@ -58,6 +58,49 @@ Notes: > * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) > --> > > + > + Xpdf -- Multiple Vulnerabilities > + > + > + xpdf > + 4.02 > + > + > + xpdf4 > + 4.02 Hi, the version range for xpdf4 (and maybe xpdf) is wrong. graphics/xpdf4 has PORTEPOCH=3D1, so it should be 4.02,1 Otherwise nobody will ever see this entry with pkg audit: $ pkg audit -f vuln.xml xpdf4-4.01_2,1 0 problem(s) in 0 installed package(s) found. --8t9RHnE3ZwKMSgU+ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGTBAEBCgB9FiEElXvTEJc6ePgdQuobpPCftzzFH2EFAl2ZfqdfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDk1 N0JEMzEwOTczQTc4RjgxRDQyRUExQkE0RjA5RkI3M0NDNTFGNjEACgkQpPCftzzF H2Ffagf8Dw9R+G3GrRLXDliYnkPNPlKYYTT0HEJpd16RCXaPKP9T6ahebq7tWCUW 0VhvKCYuBx/ffVwIjIHodti0w5iTmhbDikgpL89fMMcvNY1MiKK+gq4RKUlwkAks Vti2yEneJu0miNPOD3G4kDFkQgE0sNRsCmERTLaUyyt6ne/6zc+QBbXeqNzCvtMv gh6/fAb5O0ccOvIE5WODpBQY5TdkQUjIjuwVIwFEH1KtJlRTO+hNA61MTk095f92 mjXvfU6XGvX01m1ElLCBTBq6LNhLFIz0HeeVcxIxCQqTeERrTzp6XbD0rh/SChPv xPWTw+hl9VPYa2XqWmo36FCXgaTI8w== =ecsE -----END PGP SIGNATURE----- --8t9RHnE3ZwKMSgU+--