From owner-svn-ports-head@FreeBSD.ORG Sun May 19 14:06:37 2013 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 802CD155; Sun, 19 May 2013 14:06:37 +0000 (UTC) (envelope-from rakuco@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 70261AE8; Sun, 19 May 2013 14:06:37 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r4JE6bYf089127; Sun, 19 May 2013 14:06:37 GMT (envelope-from rakuco@svn.freebsd.org) Received: (from rakuco@localhost) by svn.freebsd.org (8.14.6/8.14.5/Submit) id r4JE6aYw089122; Sun, 19 May 2013 14:06:36 GMT (envelope-from rakuco@svn.freebsd.org) Message-Id: <201305191406.r4JE6aYw089122@svn.freebsd.org> From: Raphael Kubo da Costa Date: Sun, 19 May 2013 14:06:36 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r318524 - in head: security/vuxml x11-toolkits/plib x11-toolkits/plib/files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 May 2013 14:06:37 -0000 Author: rakuco Date: Sun May 19 14:06:36 2013 New Revision: 318524 URL: http://svnweb.freebsd.org/changeset/ports/318524 Log: Patch multiple vulnerabilities in x11-toolkits/plib. PR: ports/178710 Submitted by: Denny Lin Added: head/x11-toolkits/plib/files/patch-src-ssg-ssgParser.cxx (contents, props changed) head/x11-toolkits/plib/files/patch-src-util-ulError.cxx (contents, props changed) Modified: head/security/vuxml/vuln.xml head/x11-toolkits/plib/Makefile Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun May 19 13:37:05 2013 (r318523) +++ head/security/vuxml/vuln.xml Sun May 19 14:06:36 2013 (r318524) @@ -51,6 +51,75 @@ Note: Please add new entries to the beg --> + + plib -- stack-based buffer overflow + + + plib + 1.8.5_4 + + + + +

CVE reports:

+
Stack-based buffer overflow in the error function in + ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to + execute arbitrary code via a crafted 3d model file that + triggers a long error message, as demonstrated by a .ase + file.
+

+ + + + 55839 + CVE-2012-4552 + http://www.openwall.com/lists/oss-security/2012/10/29/8 + + + 2012-10-09 + 2013-05-19 + + + + + plib -- buffer overflow + + + plib + 1.8.5_4 + + + + +

Secunia reports:

+
A vulnerability has been discovered in PLIB, which can be + exploited by malicious people to compromise an application + using the library. The vulnerability is caused due to a + boundary error within the "ulSetError()" function + (src/util/ulError.cxx) when creating the error message, + which can be exploited to overflow a static buffer.
+
Successful exploitation allows the execution of arbitrary + code but requires that the attacker can e.g. control the + content of an overly long error message passed to the + "ulSetError()" function.
+
The vulnerability is confirmed in version 1.8.5. Other + versions may also be affected.
+
Originally reported in TORCS by Andres Gomez.
+

+ + + + CVE-2011-4620 + http://openwall.com/lists/oss-security/2011/12/21/2 + + + 2011-12-21 + 2013-05-19 + + + optipng -- use-after-free vulnerability Modified: head/x11-toolkits/plib/Makefile ============================================================================== --- head/x11-toolkits/plib/Makefile Sun May 19 13:37:05 2013 (r318523) +++ head/x11-toolkits/plib/Makefile Sun May 19 14:06:36 2013 (r318524) @@ -7,7 +7,7 @@ PORTNAME= plib PORTVERSION= 1.8.5 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= x11-toolkits MASTER_SITES= http://plib.sourceforge.net/dist/ Added: head/x11-toolkits/plib/files/patch-src-ssg-ssgParser.cxx ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/x11-toolkits/plib/files/patch-src-ssg-ssgParser.cxx Sun May 19 14:06:36 2013 (r318524) @@ -0,0 +1,60 @@ +Index: src/ssg/ssgParser.cxx +=================================================================== +--- src/ssg/ssgParser.cxx.orig ++++ src/ssg/ssgParser.cxx +@@ -57,18 +57,18 @@ void _ssgParser::error( const char *form + char msgbuff[ 255 ]; + va_list argp; + +- char* msgptr = msgbuff; +- if (linenum) +- { +- msgptr += sprintf ( msgptr,"%s, line %d: ", +- path, linenum ); +- } +- + va_start( argp, format ); +- vsprintf( msgptr, format, argp ); ++ vsnprintf( msgbuff, sizeof(msgbuff)-1, format, argp ); + va_end( argp ); ++ ++ msgbuff[sizeof(msgbuff)-1] = '\0'; + +- ulSetError ( UL_WARNING, "%s", msgbuff ) ; ++ if (linenum) ++ { ++ ulSetError ( UL_WARNING, "%s, line %d: %s", path, linenum, msgbuff ) ; ++ } else { ++ ulSetError ( UL_WARNING, "%s", msgbuff ) ; ++ } + } + + +@@ -78,18 +78,18 @@ void _ssgParser::message( const char *fo + char msgbuff[ 255 ]; + va_list argp; + +- char* msgptr = msgbuff; +- if (linenum) +- { +- msgptr += sprintf ( msgptr,"%s, line %d: ", +- path, linenum ); +- } +- + va_start( argp, format ); +- vsprintf( msgptr, format, argp ); ++ vsnprintf( msgbuff, sizeof(msgbuff)-1, format, argp ); + va_end( argp ); ++ ++ msgbuff[sizeof(msgbuff)-1] = '\0'; + +- ulSetError ( UL_DEBUG, "%s", msgbuff ) ; ++ if (linenum) ++ { ++ ulSetError ( UL_DEBUG, "%s, line %d: %s", path, linenum, msgbuff ) ; ++ } else { ++ ulSetError ( UL_DEBUG, "%s", msgbuff ) ; ++ } + } + + // Opens the file and does a few internal calculations based on the spec. Added: head/x11-toolkits/plib/files/patch-src-util-ulError.cxx ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/x11-toolkits/plib/files/patch-src-util-ulError.cxx Sun May 19 14:06:36 2013 (r318524) @@ -0,0 +1,18 @@ +Index: src/util/ulError.cxx +=================================================================== +--- src/util/ulError.cxx.orig ++++ src/util/ulError.cxx +@@ -39,9 +39,11 @@ void ulSetError ( enum ulSeverity severi + { + va_list argp; + va_start ( argp, fmt ) ; +- vsprintf ( _ulErrorBuffer, fmt, argp ) ; ++ vsnprintf ( _ulErrorBuffer, sizeof(_ulErrorBuffer)-1, fmt, argp ) ; + va_end ( argp ) ; +- ++ ++ _ulErrorBuffer[sizeof(_ulErrorBuffer)-1] = '\0'; ++ + if ( _ulErrorCB ) + { + (*_ulErrorCB)( severity, _ulErrorBuffer ) ;