From owner-freebsd-ports-bugs@FreeBSD.ORG Fri Mar 28 06:30:01 2014 Return-Path: Delivered-To: freebsd-ports-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 1500154A for ; Fri, 28 Mar 2014 06:30:01 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E57B197 for ; Fri, 28 Mar 2014 06:30:00 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s2S6U0QL012595 for ; Fri, 28 Mar 2014 06:30:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s2S6U0lK012594; Fri, 28 Mar 2014 06:30:00 GMT (envelope-from gnats) Resent-Date: Fri, 28 Mar 2014 06:30:00 GMT Resent-Message-Id: <201403280630.s2S6U0lK012594@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Yasuhiro KIMURA Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id CE91D515 for ; Fri, 28 Mar 2014 06:26:32 +0000 (UTC) Received: from gate.utahime.jp (ipq210.utahime.jp [183.180.29.210]) by mx1.freebsd.org (Postfix) with ESMTP id 8F30779 for ; Fri, 28 Mar 2014 06:26:31 +0000 (UTC) Received: from eastasia.home.utahime.org (eastasia.home.utahime.org [192.168.174.1]) by gate.utahime.jp (Postfix) with ESMTP id 532374E641; Fri, 28 Mar 2014 15:26:25 +0900 (JST) Received: from eastasia.home.utahime.org (localhost [127.0.0.1]) by localhost-backdoor.home.utahime.org (Postfix) with ESMTP id 1A7DD7594C; Fri, 28 Mar 2014 15:26:25 +0900 (JST) Received: by eastasia.home.utahime.org (Postfix, from userid 1000) id BDEA275942; Fri, 28 Mar 2014 15:26:24 +0900 (JST) Message-Id: <20140328062624.BDEA275942@eastasia.home.utahime.org> Date: Fri, 28 Mar 2014 15:26:24 +0900 (JST) From: Yasuhiro KIMURA To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.114 Subject: ports/188022: [PATCH] security/vuxml: fix false positive about www/mod_php5 vulneravilities. X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Mar 2014 06:30:01 -0000 >Number: 188022 >Category: ports >Synopsis: [PATCH] security/vuxml: fix false positive about www/mod_php5 vulneravilities. >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Fri Mar 28 06:30:00 UTC 2014 >Closed-Date: >Last-Modified: >Originator: Yasuhiro KIMURA >Release: FreeBSD 10.0-RELEASE amd64 >Organization: >Environment: System: FreeBSD xxxx 10.0-RELEASE FreeBSD 10.0-RELEASE #0 r260673: Thu Jan 23 22:36:39 JST 2014 xxxx amd64 >Description: - New port www/mod_php5 is added but 'pkg audit' reports 8 vulneravilities as following. They seem false positive so fix range of corresponding entries in vuln.xml. - Add LICENSE. - Support staging. >How-To-Repeat: >Fix: --- pkg-audit-F.log begins here --- Script started on Fri Mar 28 14:31:03 2014 command: pkg audit -F Vulnxml file up-to-date. mod_php5-5.4.26 is vulnerable: php -- multiple vulnerabilities CVE: CVE-2006-4486 CVE: CVE-2006-4485 CVE: CVE-2006-4484 CVE: CVE-2006-4483 CVE: CVE-2006-4482 CVE: CVE-2006-4481 WWW: http://portaudit.FreeBSD.org/ea09c5df-4362-11db-81e1-000e0c2e438a.html mod_php5-5.4.26 is vulnerable: php -- vulnerability in RFC 1867 file upload processing WWW: http://portaudit.FreeBSD.org/562a3fdf-16d6-11d9-bc4a-000c41e2cdad.html mod_php5-5.4.26 is vulnerable: php -- php_variables memory disclosure WWW: http://portaudit.FreeBSD.org/ad74a1bd-16d2-11d9-bc4a-000c41e2cdad.html mod_php5-5.4.26 is vulnerable: php -- strip_tags cross-site scripting vulnerability CVE: CVE-2004-0595 WWW: http://portaudit.FreeBSD.org/edf61c61-0f07-11d9-8393-000103ccf9d6.html mod_php5-5.4.26 is vulnerable: php -- memory_limit related vulnerability CVE: CVE-2004-0594 WWW: http://portaudit.FreeBSD.org/dd7aa4f1-102f-11d9-8a8a-000c41e2cdad.html mod_php5-5.4.26 is vulnerable: php -- _ecalloc Integer Overflow Vulnerability CVE: CVE-2006-4812 WWW: http://portaudit.FreeBSD.org/e329550b-54f7-11db-a5ae-00508d6a62df.html mod_php5-5.4.26 is vulnerable: php -- multiple vulnerabilities CVE: CVE-2004-1065 CVE: CVE-2004-1019 WWW: http://portaudit.FreeBSD.org/d47e9d19-5016-11d9-9b5f-0050569f0001.html mod_php5-5.4.26 is vulnerable: php -- open_basedir Race Condition Vulnerability CVE: CVE-2006-5178 WWW: http://portaudit.FreeBSD.org/edabe438-542f-11db-a5ae-00508d6a62df.html 1 problem(s) in the installed packages found. Script done on Fri Mar 28 14:31:03 2014 --- pkg-audit-F.log ends here --- --- patch-security_vuxml begins here --- Index: Makefile =================================================================== --- Makefile (revision 349387) +++ Makefile (working copy) @@ -14,6 +14,8 @@ MAINTAINER= ports-secteam@FreeBSD.org COMMENT= Vulnerability and eXposure Markup Language DTD +LICENSE= BSD2CLAUSE + RUN_DEPENDS= ${XMLCATMGR}:${PORTSDIR}/textproc/xmlcatmgr \ ${LOCALBASE}/share/xml/dtd/xhtml-modularization/VERSION:${PORTSDIR}/textproc/xhtml-modularization \ ${LOCALBASE}/share/xml/dtd/xhtml-basic/xhtml-basic10.dtd:${PORTSDIR}/textproc/xhtml-basic @@ -46,7 +48,6 @@ VUXML_FILE?= ${PKGDIR}/vuln.xml -NO_STAGE= yes do-extract: @${RM} -rf ${WRKDIR} @${MKDIR} ${WRKDIR} @@ -65,13 +66,10 @@ ${PLIST} do-install: - @[ -d ${PREFIX}/${dir_DTD} ] || \ - ${MKDIR} ${PREFIX}/${dir_DTD} + @${MKDIR} ${STAGEDIR}${PREFIX}/${dir_DTD} .for f in ${DISTFILES} - ${INSTALL_DATA} ${WRKSRC}/${f} ${PREFIX}/${dir_DTD}/${f} + ${INSTALL_DATA} ${WRKSRC}/${f} ${STAGEDIR}${PREFIX}/${dir_DTD}/${f} .endfor - ${XMLCAT_ADD} - ${SGMLCAT_ADD} validate: tidy @${SH} ${FILESDIR}/validate.sh "${VUXML_FILE}" Index: vuln.xml =================================================================== --- vuln.xml (revision 349387) +++ vuln.xml (working copy) @@ -55637,7 +55637,7 @@ php5-horde php5-nms mod_php5 - 0 + 5.1.6_1 @@ -55853,7 +55853,8 @@ php5-nms mod_php4 mod_php5 - 0 + 4.4.4_1 + 5.*5.1.6_2 @@ -56832,7 +56833,8 @@ php5-nms mod_php4 mod_php5 - 0 + 4.4.4 + 55.1.5 @@ -76096,7 +76098,7 @@ mod_php5 - 5.0.3,1 + 5.0.3 @@ -79080,7 +79082,7 @@ mod_php5 - 5.0.1,1 + 5.0.1 @@ -79130,7 +79132,7 @@ mod_php5 - 5.0.1,1 + 5.0.1 @@ -79816,7 +79818,7 @@ mod_php5 - 5.0.0.r3_2,1 + 5.0.0.r3_2 @@ -79865,7 +79867,7 @@ mod_php5 - 5.0.0.r3_2,1 + 5.0.0.r3_2 --- patch-security_vuxml ends here --- >Release-Note: >Audit-Trail: >Unformatted: