Date: Sat, 14 Jan 2017 17:10:58 +0000 (UTC) From: Bernard Spil <brnrd@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r431476 - head/security/vuxml Message-ID: <201701141710.v0EHAwtU065280@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: brnrd Date: Sat Jan 14 17:10:58 2017 New Revision: 431476 URL: https://svnweb.freebsd.org/changeset/ports/431476 Log: security/vuxml: Document multiple MySQL vulnerabilities Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Jan 14 16:29:44 2017 (r431475) +++ head/security/vuxml/vuln.xml Sat Jan 14 17:10:58 2017 (r431476) @@ -58,6 +58,124 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="e5186c65-d729-11e6-a9a5-b499baebfeaf"> + <topic>mysql -- multiple vulnerabilities</topic> + <affects> + <package> + <name>mysql57-client</name> + <name>mysql57-server</name> + <range><lt>5.7.15</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>SO-AND-SO reports:</p> + <blockquote cite="INSERT URL HERE"> + <p>Local security vulnerability in 'Server: Packaging' sub component.</p> + </blockquote> + </body> + </description> + <references> + <url>INSERT BLOCKQUOTE URL HERE</url> + <cvename>CVE-2016-5625</cvename> + </references> + <dates> + <discovery>2016-10-18</discovery> + <entry>2017-01-14</entry> + </dates> + </vuln> + + <vuln vid="22373c43-d728-11e6-a9a5-b499baebfeaf"> + <topic>MySQL -- multiple vulnerabilities</topic> + <affects> + <package> + <name>mariadb55-client</name> + <name>mariadb55-server</name> + <range><lt>5.5.52</lt></range> + </package> + <package> + <name>mariadb100-client</name> + <name>mariadb100-server</name> + <range><lt>10.0.28</lt></range> + </package> + <package> + <name>mariadb101-client</name> + <name>mariadb101-server</name> + <range><lt>10.1.18</lt></range> + </package> + <package> + <name>mysql55-client</name> + <name>mysql55-server</name> + <range><lt>5.5.52</lt></range> + </package> + <package> + <name>mysql56-client</name> + <name>mysql56-server</name> + <range><lt>5.6.33</lt></range> + </package> + <package> + <name>mysql57-client</name> + <name>mysql57-server</name> + <range><lt>5.7.15</lt></range> + </package> + <package> + <name>percona55-client</name> + <name>percona55-server</name> + <range><lt>5.5.51.38.2</lt></range> + </package> + <package> + <name>percona56-client</name> + <name>percona56-server</name> + <range><lt>5.6.32.78.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The MySQL project reports:</p> + <blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL">; + <ul> + <li>CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' + sub component.</li> + <li>CVE-2016-5616, CVE-2016-6663: Race condition allows local users with + certain permissions to gain privileges by leveraging use of my_copystat + by REPAIR TABLE to repair a MyISAM table.</li> + <li>CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based + logging, allows local users with access to the mysql account to gain + root privileges via a symlink attack on error logs and possibly other + files.</li> + <li>CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub + component.</li> + <li>CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub + component.</li> + <li>CVE-2016-5629: Remote security vulnerability in 'Server: Federated' + sub component.</li> + <li>CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub + component.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL</url>; + <url>https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/</url>; + <url>https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/</url>; + <url>https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/</url>; + <cvename>CVE-2016-3492</cvename> + <cvename>CVE-2016-5616</cvename> + <cvename>CVE-2016-5617</cvename> + <cvename>CVE-2016-5624</cvename> + <cvename>CVE-2016-5626</cvename> + <cvename>CVE-2016-5629</cvename> + <cvename>CVE-2016-6663</cvename> + <cvename>CVE-2016-6664</cvename> + <cvename>CVE-2016-8283</cvename> + </references> + <dates> + <discovery>2016-09-13</discovery> + <entry>2017-01-14</entry> + </dates> + </vuln> + <vuln vid="a93c3287-d8fd-11e6-be5c-001fbc0f280f"> <topic>Ansible -- Command execution on Ansible controller from host</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201701141710.v0EHAwtU065280>