VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.
dns/unbound: Update to unbound 1.19.3
This release has a number of bug fixes. The CNAME synthesized for a
DNAME record uses the original TTL, of the DNAME record, and that means
it can be cached for the TTL, instead of 0.
There is a fix that when a message was stored in cache, but one of the
RRsets was not updated due to cache policy, it now restricts the message
TTL if the cache version of the RRset has a shorter TTL. It avoids a
bug where the message is not expired, but its contents is expired.
For dnstap, it logs type DoH and DoT correctly, if that is used for
the message.
The b.root-servers.net address is updated in the default root hints.
(Only the first 15 lines of the commit message are shown above )
security/vuxml: Add sysutils/eza vulnerability
Include eza port in the Libgit2 entry.
Approved by: dbaio (mentor), garga (mentor)
Differential Revision: https://reviews.freebsd.org/D43868
security/vuxml: add FreeBSD SAs released on 2024-02-14
FreeBSD-SA-24:01.bhyveload affects all supported releases of FreeBSD.
FreeBSD-SA-24:02.tty affects all supported releases of FreeBSD.
security/vuxml: fix NS tag on body of Gitlab vuln entry
This fixes a vxquery warning (line number may vary):
| Parsing failed @ line 4442:
| Expected element in XHTML namespace.
Security: 6e0ebb4a-5e75-11ee-a365-001b217b3468
security/vuxml: Add qt[56]-webengine
qt5-webengine and qt6-webengine are also vulnerable to:
dc9e5237-c197-11ee-86bb-a8a1599412c6
19047673-c680-11ee-86bb-a8a1599412c6
qt5-webengine is also vulnerable to:
bbcb1584-c068-11ee-bdd6-4ccc6adda413
security/vuxml: document rclone vulnerabilities
CVE-2023-48795: Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVE-2023-45286: Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
PR: 276515
security/vuxml: Mark zeek < 6.0.3 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v6.0.3
This release fixes the following potential DoS vulnerability:
- A specially-crafted series of packets containing nested MIME
entities can cause Zeek to spend large amounts of time parsing
the entities.
Reported by: Tim Wojtulewicz
security/vuxml: Document QtNetwork buffer overflow
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17,
6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before
6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer
overflow check.
Base Score: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security/vuxml: add FreeBSD SA released on 2023-12-19
FreeBSD-SA-23:19.openssl affects all supported releases of FreeBSD.
FreeBSD 12.4 reached its end of life at the end of December 2023. Users
are encouraged to either implement the documented workaround or leverage
an up to date version of OpenSSH from the ports/pkg collection.
security/vuxml: Add www/qt5-webengine
qt5-webengine < 5.15.16.p5_2 is also affected by the following VuXML
IDs:
- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6
security/vuxml: Add www/qt6-webengine
qt6-webengine < 6.6.1_1 is also affected by the following VuXML IDs:
- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6
devel/zookeeper: Update version 3.8.1=>3.8.3
- Fixes critical security vulnerability
- Return to pool
- Add entry in vuxml
PR: 275999
Approved by: submitter is maintainer
www/gitea: Update version 1.21.0=>1.21.3
- Add relevant vuxml entry
- Move pkg-message to SUB_FILES as we are using PREFIX
Changelog: https://blog.gitea.com/release-of-1.21.3/
PR: 275742
Approved by: submitter is maintainer
security/vuxml: adjust 12.4 range of FreeBSD SA-23:17.pf
Similar to what I did in 4826396e5d1555b9eebf58cac290490b24bf1243,
adjust the 12.4 releases affected by FreeBSD SA-23:17.pf.
There is no 100% correct way to encode this issue in vuxml. Since the
issue only affects pf.ko, freebsd-update does not rebuild the kernel.
PR: 275743
Reported by: martin@lispworks.com
secuirty/vuxml: Remove duplicate entry
A previous entry for CVE-2023-41913 was added in
8c6ee1a1c2df0d7a769c1fd50f0366ded3798e86
PR: 275620
Reported by: eugen@
Fixes: eea55ca7b5c621fd4f032b1f256b8472fbae2b15
security/vuxml: Record kafka vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Apache
ZooKeeper.
Note that this only affects SASL Quorum Peer authentication which is
not enabled by default.
Base Score: 9.1 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
PR: 275611
Number of commits found: 8304 (showing only 100 on this page)
