FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  452262
Date:      2017-10-17
Time:      05:29:41Z
Committer: jkim

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

I found 2 entries for ce4b3af8-0b7c-11e1-846b-00235409fd3e. There should be only one.
VuXML IDDescription
e5423caf-8fb8-11e5-918c-bcaec565249clibxml2 -- multiple vulnerabilities

reports:

CVE-2015-5312 Another entity expansion issue (David Drysdale).

CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey (David Drysdale).

CVE-2015-7498 Avoid processing entities after encoding conversion failures (Daniel Veillard).

CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser (Daniel Veillard).

CVE-2015-7499 (2) Detect incoherency on GROW (Daniel Veillard).

CVE-2015-7500 Fix memory access error due to incorrect entities boundaries (Daniel Veillard).

CVE-2015-7941 (1) Stop parsing on entities boundaries errors (Daniel Veillard).

CVE-2015-7941 (2) Cleanup conditional section error handling (Daniel Veillard).

CVE-2015-7942 Another variation of overflow in Conditional sections (Daniel Veillard).

CVE-2015-7942 (2) Fix an error in previous Conditional section patch (Daniel Veillard).

CVE-2015-8035 Fix XZ compression support loop (Daniel Veillard).

CVE-2015-8242 Buffer overead with HTML parser in push mode (Hugh Davenport)


Discovery 2015-11-20
Entry 2015-11-20
libxml2
lt 2.9.3

CVE-2015-5312
CVE-2015-7497
CVE-2015-7498
CVE-2015-7499
CVE-2015-7500
CVE-2015-7941
CVE-2015-7942
CVE-2015-8035
CVE-2015-8241
CVE-2015-8242
http://xmlsoft.org/news.html
http://www.openwall.com/lists/oss-security/2015/11/18/23
efdd0edc-da3d-11e3-9ecb-2c4138874f7dlibxml2 -- entity substitution DoS

Stefan Cornelius reports:

It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substitution in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors.

This issue was discovered by Daniel Berrange of Red Hat.


Discovery 2013-12-03
Entry 2014-05-06
Modified 2015-07-15
libxml2
lt 2.9.1

linux-c6-libxml2
lt 2.7.6_2

linux-f10-libxml2
ge *

CVE-2014-0191
http://www.openwall.com/lists/oss-security/2014/05/06/4
https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191
0642b064-56c4-11e4-8b87-bcaec565249clibxml2 -- Denial of service

RedHat reports:

A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.


Discovery 2014-10-16
Entry 2014-10-18
Modified 2015-07-15
libxml2
lt 2.9.2

linux-c6-libxml2
lt 2.7.6_2

linux-f10-libxml2
ge *

CVE-2014-3660
https://rhn.redhat.com/errata/RHSA-2014-1655.html
b8ae4659-a0da-11e1-a294-bcaec565249clibxml2 -- An off-by-one out-of-bounds write by XPointer

Google chrome team reports:

An off-by-one out-of-bounds write flaw was found in the way libxml, a library for providing XML and HTML support, evaluated certain XPointer parts (XPointer is used by libxml to include only the part from the returned XML document, that can be accessed using the XPath expression given with the XPointer). A remote attacker could provide a specially-crafted XML file, which once opened in an application, linked against libxml, would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.

Note: The flaw to be exploited requires the particular application, linked against libxml, to use the XPointer evaluation functionality.


Discovery 2012-05-15
Entry 2012-05-18
Modified 2014-04-30
libxml2
lt 2.7.8_3

linux-f10-libxml2
lt 2.7.8_3

CVE-2011-3202
http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102