From owner-svn-ports-head@freebsd.org Sun Feb 14 14:46:08 2016 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 31159AA8DB5; Sun, 14 Feb 2016 14:46:08 +0000 (UTC) (envelope-from miwi@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id DC5AA19F2; Sun, 14 Feb 2016 14:46:07 +0000 (UTC) (envelope-from miwi@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u1EEk6W2070762; Sun, 14 Feb 2016 14:46:06 GMT (envelope-from miwi@FreeBSD.org) Received: (from miwi@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u1EEk64l070760; Sun, 14 Feb 2016 14:46:06 GMT (envelope-from miwi@FreeBSD.org) Message-Id: <201602141446.u1EEk64l070760@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: miwi set sender to miwi@FreeBSD.org using -f From: Martin Wilke Date: Sun, 14 Feb 2016 14:46:06 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r408859 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Feb 2016 14:46:08 -0000 Author: miwi Date: Sun Feb 14 14:46:06 2016 New Revision: 408859 URL: https://svnweb.freebsd.org/changeset/ports/408859 Log: - Fix formating Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Feb 14 14:40:21 2016 (r408858) +++ head/security/vuxml/vuln.xml Sun Feb 14 14:46:06 2016 (r408859) @@ -70,11 +70,11 @@ Notes:

Nghttp2 reports:

Out of memory in nghttpd, nghttp, and libnghttp2_asio applications - due to unlimited incoming HTTP header fields.

+ due to unlimited incoming HTTP header fields.

nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage - for the incoming HTTP header field. If peer sends specially crafted HTTP/2 - HEADERS frames and CONTINUATION frames, they will crash with out of memory - error.

+ for the incoming HTTP header field. If peer sends specially crafted HTTP/2 + HEADERS frames and CONTINUATION frames, they will crash with out of memory + error.

Note that libnghttp2 itself is not affected by this vulnerability.

@@ -158,16 +158,16 @@ Notes:

  • CVE-2016-0773: This release closes security hole CVE-2016-0773, - an issue with regular expression (regex) parsing. Prior code allowed - users to pass in expressions which included out-of-range Unicode - characters, triggering a backend crash. This issue is critical for - PostgreSQL systems with untrusted users or which generate regexes - based on user input. + an issue with regular expression (regex) parsing. Prior code allowed + users to pass in expressions which included out-of-range Unicode + characters, triggering a backend crash. This issue is critical for + PostgreSQL systems with untrusted users or which generate regexes + based on user input.
  • CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege - escalation issue for users of PL/Java. Certain custom configuration - settings (GUCS) for PL/Java will now be modifiable only by the - database superuser + escalation issue for users of PL/Java. Certain custom configuration + settings (GUCS) for PL/Java will now be modifiable only by the + database superuser