Date: Thu, 20 Aug 2009 20:55:40 +0200 From: Armin Pirkovitsch <armin@frozen-zone.org> To: FreeBSD-gnats-submit@FreeBSD.org, freebsd-ports-bugs@FreeBSD.org Subject: Re: ports/137997: vuxml update (for pidgin) Message-ID: <20090820201208fz@frozen-zone.org> In-Reply-To: <200908201810.n7KIA6CI045160@freefall.freebsd.org> References: <200908201809.n7KI9iDV035571@www.freebsd.org> <200908201810.n7KIA6CI045160@freefall.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--vtzGhvizbBRQ85DL Content-Type: text/plain; charset=us-ascii Content-Disposition: inline corrected patch. --vtzGhvizbBRQ85DL Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="vuln-patch.txt" --- vuln.xml.orig 2009-08-19 23:48:01.000000000 +0200 +++ vuln.xml 2009-08-20 20:50:26.000000000 +0200 @@ -34,6 +34,44 @@ --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="59e7af2d-8db7-11de-883b-001e3300a30d"> + <topic> pidgin -- MSN overflow parsing SLP messages </topic> + <affects> + <package> + <name>pidgin</name> + <name>libpurple</name> + <name>finch</name> + <range><lt>2.5.9</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Secunia reports:</p> + <blockquote cite="http://secunia.com/advisories/36384">; + <p>A vulnerability has been reported in Pidgin, which can be + exploited by malicious people to potentially compromise a user's + system.</p> + <p>The vulnerability is caused due to an error in the + "msn_slplink_process_msg()" function when processing MSN SLP + messages and can be exploited to corrupt memory.</p> + <p>Successful exploitation may allow execution of arbitrary + code.</p> + <p>The vulnerability is reported in versions 2.5.8 and prior. + Other versions may also be affected.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2009-2694</cvename> + <url>http://secunia.com/advisories/36384/</url>; + <url>http://www.pidgin.im/news/security/?id=34</url>; + </references> + <dates> + <discovery>2009-08-18</discovery> + <entry>2009-08-20</entry> + </dates> + </vuln> + <vuln vid="b31a1088-460f-11de-a11a-0022156e8794"> <topic>GnuTLS -- multiple vulnerabilities</topic> <affects> --vtzGhvizbBRQ85DL--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090820201208fz>