Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 18 Oct 2014 12:52:27 +0000 (UTC)
From:      Koop Mast <kwm@FreeBSD.org>
To:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   svn commit: r371119 - head/security/vuxml
Message-ID:  <201410181252.s9ICqRL7027006@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: kwm
Date: Sat Oct 18 12:52:26 2014
New Revision: 371119
URL: https://svnweb.freebsd.org/changeset/ports/371119
QAT: https://qat.redports.org/buildarchive/r371119/

Log:
  Document libxml2 denial of service

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml	Sat Oct 18 12:38:22 2014	(r371118)
+++ head/security/vuxml/vuln.xml	Sat Oct 18 12:52:26 2014	(r371119)
@@ -57,6 +57,39 @@ Notes:
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">;
+  <vuln vid="0642b064-56c4-11e4-8b87-bcaec565249c">
+    <topic>libxml2 -- Denial of service</topic>
+    <affects>
+      <package>
+	<name>libxml2</name>
+	<range><lt>2.9.2</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">;
+	<p>RedHat reports:</p>
+	<blockquote cite="https://rhn.redhat.com/errata/RHSA-2014-1655.html">;
+	  <p>A denial of service flaw was found in libxml2, a library
+	    providing support to read, modify and write XML and HTML
+	    files. A remote attacker could provide a specially crafted
+	    XML file that, when processed by an application using
+	    libxml2, would lead to excessive CPU consumption (denial of
+	    service) based on excessive entity substitutions, even if
+	    entity substitution was disabled, which is the parser default
+	    behavior.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2014-3660</cvename>
+      <url>https://rhn.redhat.com/errata/RHSA-2014-1655.html</url>;
+    </references>
+    <dates>
+      <discovery>2014-10-16</discovery>
+      <entry>2014-10-18</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="6f825fa4-5560-11e4-a4c3-00a0986f28c4">
     <topic>drupal7 -- SQL injection</topic>
     <affects>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201410181252.s9ICqRL7027006>