Date: Sat, 7 Jan 2017 22:55:03 +0000 (UTC) From: Jason Unovitch <junovitch@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r430842 - head/security/vuxml Message-ID: <201701072255.v07Mt3Wo039541@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: junovitch Date: Sat Jan 7 22:55:03 2017 New Revision: 430842 URL: https://svnweb.freebsd.org/changeset/ports/430842 Log: Document last quarter of Tomcat security advisories Latest advisory is awaiting upstream release PR: 214599 PR: 215865 Security: CVE-2016-0762 Security: CVE-2016-5018 Security: CVE-2016-6794 Security: CVE-2016-6796 Security: CVE-2016-6797 Security: CVE-2016-6816 Security: CVE-2016-8735 Security: CVE-2016-8745 Security: https://vuxml.FreeBSD.org/freebsd/0b9af110-d529-11e6-ae1b-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/3ae106e2-d521-11e6-ae1b-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/e5ec2767-d529-11e6-ae1b-002590263bf5.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Jan 7 21:47:14 2017 (r430841) +++ head/security/vuxml/vuln.xml Sat Jan 7 22:55:03 2017 (r430842) @@ -58,6 +58,126 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="e5ec2767-d529-11e6-ae1b-002590263bf5"> + <topic>tomcat -- information disclosure vulnerability</topic> + <affects> + <package> + <name>tomcat6</name> + <range><lt>6.0.49</lt></range> + </package> + <package> + <name>tomcat7</name> + <range><lt>7.0.74</lt></range> + </package> + <package> + <name>tomcat8</name> + <range><lt>8.0.40</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Apache Software Foundation reports:</p> + <blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40">; + <p>Important: Information Disclosure CVE-2016-8745</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-8745</cvename> + <freebsdpr>ports/215865</freebsdpr> + <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49</url>; + <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74</url>; + <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40</url>; + </references> + <dates> + <discovery>2017-01-05</discovery> + <entry>2017-01-07</entry> + </dates> + </vuln> + + <vuln vid="0b9af110-d529-11e6-ae1b-002590263bf5"> + <topic>tomcat -- multiple vulnerabilities</topic> + <affects> + <package> + <name>tomcat6</name> + <range><lt>6.0.48</lt></range> + </package> + <package> + <name>tomcat7</name> + <range><lt>7.0.73</lt></range> + </package> + <package> + <name>tomcat8</name> + <range><lt>8.0.39</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Apache Software Foundation reports:</p> + <blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39">; + <p>Important: Remote Code Execution CVE-2016-8735</p> + <p>Important: Information Disclosure CVE-2016-6816</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-8735</cvename> + <cvename>CVE-2016-6816</cvename> + <freebsdpr>ports/214599</freebsdpr> + <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48</url>; + <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73</url>; + <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39</url>; + </references> + <dates> + <discovery>2016-11-22</discovery> + <entry>2017-01-07</entry> + </dates> + </vuln> + + <vuln vid="3ae106e2-d521-11e6-ae1b-002590263bf5"> + <topic>tomcat -- multiple vulnerabilities</topic> + <affects> + <package> + <name>tomcat6</name> + <range><lt>6.0.47</lt></range> + </package> + <package> + <name>tomcat7</name> + <range><lt>7.0.72</lt></range> + </package> + <package> + <name>tomcat8</name> + <range><lt>8.0.37</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Apache Software Foundation reports:</p> + <blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">; + <p>Low: Unrestricted Access to Global Resources CVE-2016-6797</p> + <p>Low: Security Manager Bypass CVE-2016-6796</p> + <p>Low: System Property Disclosure CVE-2016-6794</p> + <p>Low: Security Manager Bypass CVE-2016-5018</p> + <p>Low: Timing Attack CVE-2016-0762</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-6797</cvename> + <cvename>CVE-2016-6796</cvename> + <cvename>CVE-2016-6794</cvename> + <cvename>CVE-2016-5018</cvename> + <cvename>CVE-2016-0762</cvename> + <url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47</url>; + <url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72</url>; + <url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37</url>; + </references> + <dates> + <discovery>2016-10-27</discovery> + <entry>2017-01-07</entry> + </dates> + </vuln> + <vuln vid="3d6be69b-d365-11e6-a071-001e67f15f5a"> <topic>Irssi -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201701072255.v07Mt3Wo039541>