Date: Tue, 8 Sep 2015 18:32:07 +0000 (UTC) From: Mark Felder <feld@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r396423 - head/security/vuxml Message-ID: <201509081832.t88IW7Pt031876@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: feld Date: Tue Sep 8 18:32:06 2015 New Revision: 396423 URL: https://svnweb.freebsd.org/changeset/ports/396423 Log: Document php vulnerabilities Security: CVE-2015-6834 Security: CVE-2015-6835 Security: CVE-2015-6836 Security: CVE-2015-6837 Security: CVE-2015-6838 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Sep 8 18:08:20 2015 (r396422) +++ head/security/vuxml/vuln.xml Tue Sep 8 18:32:06 2015 (r396423) @@ -58,6 +58,86 @@ Notes: --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="3d675519-5654-11e5-9ad8-14dae9d210b8"> + <topic>php -- multiple vulnerabilities</topic> + <affects> + <package> + <name>php5</name> + <name>php56-soap</name> + <name>php56-xsl</name> + <range><lt>5.4.45</lt></range> + </package> + <package> + <name>php55</name> + <name>php56-soap</name> + <name>php56-xsl</name> + <range><lt>5.5.29</lt></range> + </package> + <package> + <name>php56</name> + <name>php56-soap</name> + <name>php56-xsl</name> + <range><lt>5.6.13</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>PHP reports:</p> + <blockquote cite="http://php.net/ChangeLog-5.php#5.4.45"> + <ul><li>Core: + <ul> + <li>Fixed bug #70172 (Use After Free Vulnerability in unserialize()).</li> + <li>Fixed bug #70219 (Use after free vulnerability in session deserializer).</li> + </ul></li> + <li>EXIF: + <ul> + <li>Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).</li> + </ul></li> + <li>hash: + <ul> + <li>Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).</li> + </ul></li> + <li>PCRE: + <ul> + <li>Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).</li> + </ul></li> + <li>SOAP: + <ul> + <li>Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).</li> + </ul></li> + <li>SPL: + <ul> + <li>Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).</li> + <li>Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).</li> + </ul></li> + <li>XSLT: + <ul> + <li>Fixed bug #69782 (NULL pointer dereference).</li> + </ul></li> + <li>ZIP: + <ul> + <li>Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).</li> + </ul></li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>http://php.net/ChangeLog-5.php#5.4.45</url> + <url>http://php.net/ChangeLog-5.php#5.5.29</url> + <url>http://php.net/ChangeLog-5.php#5.6.13</url> + <cvename>CVE-2015-6834</cvename> + <cvename>CVE-2015-6835</cvename> + <cvename>CVE-2015-6836</cvename> + <cvename>CVE-2015-6837</cvename> + <cvename>CVE-2015-6838</cvename> + </references> + <dates> + <discovery>2015-09-03</discovery> + <entry>2015-09-08</entry> + </dates> + </vuln> + <vuln vid="d68df01b-564e-11e5-9ad8-14dae9d210b8"> <topic>ganglia-webfrontend -- auth bypass</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201509081832.t88IW7Pt031876>