Date: Tue, 20 Apr 2021 03:52:04 GMT From: Don Lewis <truckman@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: 940cf9711a1e - main - security/vuxml: Document OpenOffice vulnerability CVE-2021-30245 Message-ID: <202104200352.13K3q4Hp085097@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by truckman: URL: https://cgit.FreeBSD.org/ports/commit/?id=940cf9711a1e9fffe0878f2c9bf916479f170972 commit 940cf9711a1e9fffe0878f2c9bf916479f170972 Author: Don Lewis <truckman@FreeBSD.org> AuthorDate: 2021-04-20 03:49:20 +0000 Commit: Don Lewis <truckman@FreeBSD.org> CommitDate: 2021-04-20 03:49:20 +0000 security/vuxml: Document OpenOffice vulnerability CVE-2021-30245 --- security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 97c9911ca975..006e614389c2 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,36 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="e87c2647-a188-11eb-8806-1c1b0d9ea7e6"> + <topic>All versions of Apache OpenOffice through 4.1.9 can open non-http(s) hyperlinks. If the link is specifically crafted this could lead to untrusted code execution.</topic> + <affects> + <package> + <name>apache-openoffice</name> + <range><lt>4.1.10</lt></range> + </package> + <package> + <name>apache-openoffice-devel</name> + <range><lt>4.2.1612022694,4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Apache Openofffice project reports:</p> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245">; + <p>The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The problem has existed since about 2006 and the issue is also in 4.1.9. If the link is specifically crafted this could lead to untrusted code execution. It is always best practice to be careful opening documents from unknown and unverified sources. The mitigation in Apache OpenOffice 4.1.10 (unreleased) assures that a security warning is displayed giving the user the option of continuing to open the hyperlink.</p> + </blockquote> + </body> + </description> + <references> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30245</url>; + <cvename>CVE-2021-30245</cvename> + </references> + <dates> + <discovery>2021-01-25</discovery> + <entry>2021-04-20</entry> + </dates> + </vuln> + <vuln vid="20006b5f-a0bc-11eb-8ae6-fc4dd43e2b6a"> <topic>Apache Maven -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202104200352.13K3q4Hp085097>