VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.
security/vuxml: Mark zeek < 7.0.3 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v7.0.3
This release fixes the following potential DoS vulnerability:
- Adding to the POP3 hardening in 7.0.2, the parser now simply
discards too many pending commands, rather than any attempting
to process them. Further, invalid server responses do not result
in command completion anymore. Processing out-of-order commands
or finishing commands based on invalid server responses could
result in inconsistent analyzer state, potentially triggering
null pointer references for crafted traffic.
Reported by: Tim Wojtulewicz
security/vuxml: Update range of redis in 8b20f21a-8113-11ef-b988-08002784c58d
In 2024Q3 branch databases/redis still stays in 7.2.x.
Fixes: e44e4021e418
security/vuxml: Document PHP vulnerabilities
There were 4 vulnerabilities found and fixed in PHP.
PR: 281770
Reported by: FiLis <freebsdbugs@filis.org>
security/vuxml: Fix typos
Add linux-*-sqlite3 to last entry.
s/mozilla/firefox in an older entry
Reported by: Edward Sanford Sutton, III (mirror176@hotmail.com)
security/vuxml: Update zeek range for 6.X
Really, it was silly of me to add the <ge> range since there were
no commited 6.X versions that were not vulnerable to the new issue.
security/vuxml: Mark zeek < 7.0.2 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v7.0.2
This release fixes the following potential DoS vulnerability:
- The POP3 parser has been hardened to avoid unbounded state growth
in the face of one-sided traffic capture or when enabled for
non-POP3 traffic.
Reported by: Tim Wojtulewicz
security/vuxml: belatedly add FreeBSD SAs issued on 2024-08-07
FreeBSD-SA-24:05.pf affects all supported versions of FreeBSD
FreeBSD-SA-24:06.ktrace affects all supported versions of FreeBSD
FreeBSD-SA-24:07.nfsclient affects all supported versions of FreeBSD
security/vuxml: complete FreeBSD reference for CVE-2024-7589
FreeBSD-SA-24:08.openssh was issued on 2024-08-07 to address
CVE-2024-7589. All supported versions of FreeBSD were affected.
While here, correct minor markup nits in the vuxml entry.
security/vuxml: reference FreeBSD-SA-24:04.openssh in CVE-2024-6387
All supported versions of FreeBSD were affected by CVE-2024-6387,
announced on 2024-07-01. Reference FreeBSD-SA-24:04.openssh in the
vuxml entry.
security/vuxml: add FreeBSD SAs issued on 2024-09-19
FreeBSD-SA-24:15.bhyve affects all supported versions of FreeBSD
FreeBSD-SA-24:16.libnv affects all supported versions of FreeBSD
security/vuxml: correct vulnerable package range for nginx
14dc2636e72c396459a6559868033910ee8a4532 added a new vuxml entry, but
forgot to account for PORTEPOCH.
PR: 281250
Approved by: maintainer timeout
Security: CVE-2024-7347
security/vuxml: really fix versionning for firefox
in 8a5936ed301ec363fd7e80762e74bacf0d69fd05 I added the missing
portepoch except I added the wrong one, portepoch is at 2, not at 1
Reported by: Piotr Smyrak <piotr@smyrak.com>
security/vuxml: reference FreeBSD-SA-24:13.openssl
Add a reference to FreeBSD-SA-24:13.openssl (issued 2024-09-04) to the
vuxml entry for OpenSSL CVE-2024-6119.
FreeBSD-SA-24:13.openssl affects FreeBSD 14.x
security/vuxml: Record firefox multiple vulnerabilities
CVE-2024-6608
* Base Score: 4.3 MEDIUM
* Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2024-6609
* Base Score: 8.8 HIGH
* Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2024-6610
* Base Score: 4.3 MEDIUM
* Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2024-7524
* Base Score: 6.1 MEDIUM
* Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security/vuxml: Revert "Record firefox multiple vulnerabilites"
This reverts commit 4453cf7eef05f9ac2b27bda7a87afb7da713f1c4.
The 3 CVEs only apply to firefox on iOS.
Reported by: ronald-lists@klop.ws
security/vuxml: Record firefox multiple vulnerabilites
CVE-2024-43111
* Base Score: 6.1 MEDIUM
* Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2024-43112
* Base Score: 6.1 MEDIUM
* Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2024-43113
* Base Score: 6.1 MEDIUM
* Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
security/vuxml: Add firefox CVE
By monitoring the time certain operations take, an attacker could have guessed
which external protocol handlers were functional on a user's system.
security/vuxml: Correct mysql81-server typo
This was bothering me why mysql80-server 8.0.39 was being reported as
vulnerable when anything above 8.0.38 should be fine. It wasn't until I
looked at the VuXML webpage that I saw mysql81-server had a typo calling
it mysql80-server.
