Date: Sat, 10 Feb 2018 10:57:07 +0000 (UTC) From: Raphael Kubo da Costa <rakuco@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r461378 - head/security/vuxml Message-ID: <201802101057.w1AAv7Fi021612@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rakuco Date: Sat Feb 10 10:57:07 2018 New Revision: 461378 URL: https://svnweb.freebsd.org/changeset/ports/461378 Log: Add entries for CVE-2017-17969 and CVE-2018-5996 in p7zip Security: CVE-2017-17969 Security: CVE-2018-5996 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Feb 10 10:55:31 2018 (r461377) +++ head/security/vuxml/vuln.xml Sat Feb 10 10:57:07 2018 (r461378) @@ -58,6 +58,71 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="7a2e0063-0e4e-11e8-94c0-5453ed2e2b49"> + <topic>p7zip-codec-rar -- insufficient error handling</topic> + <affects> + <package> + <name>p7zip-codec-rar</name> + <range><lt>16.02_1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>MITRE reports:</p> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996">; + <p>Insufficient exception handling in the method + NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip + can lead to multiple memory corruptions within the PPMd code, + alows remote attackers to cause a denial of service (segmentation + fault) or execute arbitrary code via a crafted RAR archive.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2018-5996</cvename> + <url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>; + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996</url>; + <url>https://nvd.nist.gov/vuln/detail/CVE-2018-5996</url>; + </references> + <dates> + <discovery>2018-01-23</discovery> + <entry>2018-02-10</entry> + </dates> + </vuln> + + <vuln vid="6d337396-0e4a-11e8-94c0-5453ed2e2b49"> + <topic>p7zip -- heap-based buffer overflow</topic> + <affects> + <package> + <name>p7zip</name> + <range><lt>16.02_1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>MITRE reports:</p> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969">; + <p>Heap-based buffer overflow in the + NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before + 18.00 and p7zip allows remote attackers to cause a denial of + service (out-of-bounds write) or potentially execute arbitrary + code via a crafted ZIP archive.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-17969</cvename> + <url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>; + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969</url>; + <url>https://nvd.nist.gov/vuln/detail/CVE-2017-17969</url>; + <url>https://marc.info/?l=bugtraq&=151782582216805&=2</url>; + </references> + <dates> + <discovery>2018-01-23</discovery> + <entry>2018-02-10</entry> + </dates> + </vuln> + <vuln vid="3ee6e521-0d32-11e8-99b0-d017c2987f9a"> <topic>mpv -- arbitrary code execution via crafted website</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201802101057.w1AAv7Fi021612>