Date: Sat, 16 Jan 2016 01:41:14 +0800 From: Sunpoet Po-Chuan Hsieh <sunpoet@freebsd.org> To: Bryan Drewery <bdrewery@freebsd.org> Cc: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: Re: svn commit: r406127 - head/security/vuxml Message-ID: <CAMHz58RAf-r9oiLRRAZHMzx40HmpPov7q33U5uEikGWdyy-yeQ@mail.gmail.com> In-Reply-To: <201601141934.u0EJYQfc021008@repo.freebsd.org> References: <201601141934.u0EJYQfc021008@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Jan 15, 2016 at 3:34 AM, Bryan Drewery <bdrewery@freebsd.org> wrote: > Author: bdrewery > Date: Thu Jan 14 19:34:26 2016 > New Revision: 406127 > URL: https://svnweb.freebsd.org/changeset/ports/406127 > > Log: > Document OpenSSH CVE-2016-0777 and CVE-2016-0778. > > Submitted by: brnrd > > Modified: > head/security/vuxml/vuln.xml > > Modified: head/security/vuxml/vuln.xml > > ============================================================================== > --- head/security/vuxml/vuln.xml Thu Jan 14 18:54:29 2016 > (r406126) > +++ head/security/vuxml/vuln.xml Thu Jan 14 19:34:26 2016 > (r406127) > @@ -58,6 +58,38 @@ Notes: > > --> > <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; > + <vuln vid="dfe0cdc1-baf2-11e5-863a-b499baebfeaf"> > + <topic>openssh -- information disclosure</topic> > + <affects> > + <package> > + <name>openssh-portable</name> > + <range> > + <gt>5.4p0,1</gt> > + <lt>7.1p2,1</lt> > Hello Bryan, % cd /usr/ports/security/openssh-portable % make -V PKGNAME openssh-portable-7.1.p2,1 % pkg version -t 7.1.p2,1 7.1p2,1 < Note the dot between 7.1 and p2. This would cause false alarm for OpenSSH 7.1p2 (openssh-portable-7.1.p2,1) users. Regards, sunpoet + </range> > + </package> > + </affects> > + <description> > + <body xmlns="http://www.w3.org/1999/xhtml">; > + <p>OpenSSH reports:</p> > + <blockquote cite="http://www.openssh.com/security.html">; > + <p>OpenSSH clients between versions 5.4 and 7.1 are vulnerable to > + information disclosure that may allow a malicious server to > retrieve > + information including under some circumstances, user's private > keys.</p> > + </blockquote> > + </body> > + </description> > + <references> > + <url>http://www.openssh.com/security.html</url>; > + <cvename>CVE-2016-0777</cvename> > + <cvename>CVE-2016-0778</cvename> > + </references> > + <dates> > + <discovery>2016-01-14</discovery> > + <entry>2016-01-14</entry> > + </dates> > + </vuln> > + > <vuln vid="842cd117-ba54-11e5-9728-002590263bf5"> > <topic>prosody -- multiple vulnerabilities</topic> > <affects> > _______________________________________________ > svn-ports-all@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/svn-ports-all > To unsubscribe, send any mail to "svn-ports-all-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAMHz58RAf-r9oiLRRAZHMzx40HmpPov7q33U5uEikGWdyy-yeQ>