Date: Mon, 9 Jul 2018 08:19:46 +0000 (UTC) From: Martin Wilke <miwi@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r474238 - head/security/vuxml Message-ID: <201807090819.w698JkZ1051967@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: miwi Date: Mon Jul 9 08:19:46 2018 New Revision: 474238 URL: https://svnweb.freebsd.org/changeset/ports/474238 Log: - Document devel/zziplib - multible vulnerabilities PR: 226491 Sponsored by: iXsystems Inc. Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Jul 9 08:09:48 2018 (r474237) +++ head/security/vuxml/vuln.xml Mon Jul 9 08:19:46 2018 (r474238) @@ -58,6 +58,77 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374"> + <topic>zziplib - multiple vulnerabilities</topic> + <affects> + <package> + <name>zziplib</name> + <range><lt>0.13.68</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>NIST reports (by search in the range 2017/01/01 - 2018/07/06):</p> + <blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018">; + <p>17 security fixes in this release:</p> + <ul> + <li>Heap-based buffer overflow in the __zzip_get32 function in fetch.c.</li> + <li>Heap-based buffer overflow in the __zzip_get64 function in fetch.c.</li> + <li>Heap-based buffer overflow in the zzip_mem_entry_extra_block function + in memdisk.c.</li> + <li>The zzip_mem_entry_new function in memdisk.c allows remote attackers + to cause a denial of service (out-of-bounds read and crash) via a + crafted ZIP file.</li> + <li>The prescan_entry function in fseeko.c allows remote attackers to cause + a denial of service (NULL pointer dereference and crash) via crafted + ZIP file.</li> + <li>The zzip_mem_entry_new function in memdisk.c cause a NULL pointer + dereference and crash via a crafted ZIP file.</li> + <li>seeko.c cause a denial of service (assertion failure and crash) via a + crafted ZIP file.</li> + <li>A segmentation fault caused by invalid memory access in the + zzip_disk_fread function because the size variable is not validated + against the amount of file->stored data.</li> + <li>A memory alignment error and bus error in the __zzip_fetch_disk_trailer + function of zzip/zip.c.</li> + <li>A bus error caused by loading of a misaligned address in the + zzip_disk_findfirst function.</li> + <li>An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory + function.</li> + <li>An invalid memory address dereference was discovered in zzip_disk_fread + in mmapped.c.</li> + <li>A memory leak triggered in the function zzip_mem_disk_new in + memdisk.c.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-5974</cvename> + <cvename>CVE-2017-5975</cvename> + <cvename>CVE-2017-5976</cvename> + <cvename>CVE-2017-5977</cvename> + <cvename>CVE-2017-5978</cvename> + <cvename>CVE-2017-5979</cvename> + <cvename>CVE-2017-5980</cvename> + <cvename>CVE-2017-5981</cvename> + <cvename>CVE-2018-6381</cvename> + <cvename>CVE-2018-6484</cvename> + <cvename>CVE-2018-6540</cvename> + <cvename>CVE-2018-6541</cvename> + <cvename>CVE-2018-6542</cvename> + <cvename>CVE-2018-6869</cvename> + <cvename>CVE-2018-7725</cvename> + <cvename>CVE-2018-7726</cvename> + <cvename>CVE-2018-7727</cvename> + <url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018"</url>; + </references> + <dates> + <discovery>2017-03-01</discovery> + <entry>2018-07-06</entry> + </dates> + </vuln> + <vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d"> <topic>wordpress -- multiple issues</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201807090819.w698JkZ1051967>