Commit History - (may be incomplete: for full details, see links to repositories near top of page) Commit Credits Log message 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Fix range of ruby27 in 06ed6a49-bad4-11ec-9cfe-0800270512f4
Reported by: John Hein 1.1_5 Craig Leres (leres) security/vuxml: Mark zeek < 4.0.6 as vulnerable as per:
https://github.com/zeek/zeek/releases/tag/v4.0.6
- Fix potential unbounded state growth in the FTP analyzer when
receiving a specially-crafted stream of commands. This may lead
to a buffer overflow and cause Zeek to crash. Due to the possibility
of this happening with packets received from the network, this
is a potential DoS vulnerabilty.
Reported by: Tim Wojtulewicz 1.1_5 Fernando Apesteguía (fernape) security/vuxml: Add gzip's CVE-2022-1271
Arbitrary file write vulnerability.
Security: CVE-2022-1271 1.1_5 Bernard Spil (brnrd) www/nextcloud-calendar: Document command injection vuln 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Add lang/ruby32 to the entries of recent Ruby vulnerabilities
Both 06ed6a49-bad4-11ec-9cfe-0800270512f4 and
f22144d7-bad1-11ec-9cfe-0800270512f4 affect lang/ruby32. So add it to
them. 1.1_5 Bernard Spil (brnrd) security/vuxml: Add 2022-04 MySQL vulnerabilities 1.1_5 Rene Ladan (rene) security/vuxml: pet 'make validate'
This commit contains space/tab changes only. 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 100.0.4896.127
Obtained
from: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html 1.1_5 Fernando Apesteguía (fernape) Derek Schrock security/vuxml: Add CVE-2022-1328 mail/mutt < 2.2.3
ChangeLog: https://gitlab.com/muttmua/mutt/-/issues/404
PR: 263247
Reported by: dereks@lifeofadishwasher.com 1.1_5 Guido Falsi (madpilot) security/vuxml: Report new asterisk vulnerabilities. 1.1_5 Guido Falsi (madpilot) security/vuxml: Document new PHP composer vulnerability 1.1_5 Lev A. Serebryakov (lev) security/vuxml: Document several subversion vulnerabilities 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document buffer overrun vulnerability in Ruby 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document double free vulnerability in Ruby 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 100.0.4896.88
Obtained
from: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html 1.1_5 Wen Heping (wen) security/vuxml: Document Django multiple vulnerabilities 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:08.zlib 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:07.wifi_meshid 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:06.ioctl 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:05.bhyve 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:04.netmap 1.1_5 Fernando Apesteguía (fernape) dns/powerdns*: document CVE-2022-27227
Related commits:
79872ab6096b3bfc3edbd2ec845698316260bd0d
56b664aa3d2cd0e8dbf48d26d0839d0b1aa5998f
PR: 262879
Reported by: Ralf van der Enden <tremere@cainites.net> (maintainer) 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 100.0.4896.75
Obtained
from: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html 1.1_5 Matthias Fechner (mfechner) security/vuxml: Document gitlab vulnerabilities 1.1_5 Wen Heping (wen) security/vuxml: Document mediawiki multiple vulnerabilities 1.1_5 Matthias Andree (mandree) security/vuxml: add dnsmasq DHCPv6 vuln <= 2.86
Security: 3f321a5a-b33b-11ec-80c2-1bb2c6a00592
Security: CVE-2022-0934 1.1_5 Juraj Lutter (otis) Boris Korzun security/vuxml: Document nodejs vulnerabilities
PR: 261789 1.1_5 Florian Smeets (flo) fsbruva@yahoo.com security/vuxml: Add www/gitea vulnerabilities
PR: 262898 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 100.0.4896.60
Obtained
from: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 99.0.4844.84
Obtained
from: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html 1.1_5 Tobias C. Berner (tcberner) security/vuxml: Document graphics/p5-Image-ExifTool vulnerability
Security: CVE-2021-22204
PR: 260590 1.1_5 Sofian Brabez (sbz) security/vuxml: Document net/tcpslice CVE-2021-41043 vulnerability 1.1_5 Guangyuan Yang (ygy) security/vuxml: Document lang/go vulnerabilities 1.1_5 Matthias Andree (mandree) security/vuxml: add OpenVPN < 2.5.6 deferred auth plugin vuln
Security: CVE-2022-0547 1.1_5 Jochen Neumeister (joneum) security/vuxml: Add entry for wordpress 1.1_5 Bernard Spil (brnrd) security/vuxml: Weechat vulnerability 1.1_5 Bernard Spil (brnrd) security/vuxml: Add LibreSSL and QuicTLS to latest OpenSSL vuln 1.1_5 Philip Paeps (philip) security/vuxml: remove duplicate gpli entries
These entries, introduced in 8d55457d6e333a68173be8f6ec18d1f6bb6644cf,
were already added to vuxml in 6fdeda4e86c4109ef9be89a0a21d2a15baae3b5b.
This fixes "make validate"
PR: 255948
Pointy hat to: nc 1.1_5 Philip Paeps (philip) security/vuxml: add OpenSSL CVE-2022-0778
Also FreeBSD SA-22:03.openssl. 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:02.wifi 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 99.0.4844.74
Obtained
from: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html 1.1_5 Bernard Spil (brnrd) security/vuxml: Document Apache 2.4.52 vulns 1.1_5 Dmitry Marakasov (amdmi3) security/vuxml: document CVE-2021-43518 for games/teeworlds 1.1_5 Dmitry Marakasov (amdmi3) security/vuxml: fix syntax broken in 8d55457
PR: 255948 1.1_5 Matthias Fechner (mfechner) security/vuxml: Document gitlab vulnerabilities 1.1_5 Neel Chauhan (nc) Mathias Monnerville security/vuxml: add CVE entries related to www/glpi
PR: 255948 1.1_5 Guido Falsi (madpilot) security/vuxml: Report new asterisk vulnerabilities. 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 99.0.4844.51
Obtained
from: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html 1.1_5 Hajimu UMEMOTO (ume) security/vuxml: Document cyrus-sasl -- Fix off by one error 1.1_5 Florian Smeets (flo) security/vuxml: Document TYPO3 vulnerabilities
PR: 262196 , 262197 1.1_5 Thomas Zander (riggs) security/vuxml: Document grafana vulnerabilities
PR: 261892
Reported by: Boris Korzun <drtr0jan@yandex.ru>
Security: CVE-2022-21702
CVE-2022-21703
CVE-2022-21713 1.1_5 Jason E. Hale (jhale) security/vuxml: Document CVE-2021-40530 for security/cryptopp 1.1_5 Christian Weisgerber (naddy) security/vuxml: document CVE-2021-0561 for audio/flac 1.1_5 Hajimu UMEMOTO (ume) security/vuxml: cyrus-sasl -- Escape password for SQL insert/update commands 1.1_5 Jan Beich (jbeich) security/vuxml: add CVE for seatd 0.6.[0-3] entry 1.1_5 Dmitry Marakasov (amdmi3) security/vuxml: py-tuf vulnerability 1.1_5 Jan Beich (jbeich) security/vuxml: mark seatd 0.6.[0-3] as vulnerable 1.1_5 Adriaan de Groot (adridg) security/vuxml: Qt5 vulnerability 1.1_5 Jason E. Hale (jhale) security/vuxml: Document CVE-2021-3756 for audio/libmysofa 1.1_5 Bernard Spil (brnrd) security/vuxml: MariaDB vulnerabilities 1.1_5 Guangyuan Yang (ygy) security/vuxml: Document lang/go vulnerabilities 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 98.0.4758.102
Obtained
from: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html 1.1_5 Bernard Spil (brnrd) security/vuxml: Add additional vuln for MariaDB 1.1_5 Koichiro Iwao (meta) security/vuxml: Fix affected version declaration
and add missing PORTEPOCH.
PR: 261856 1.1_5 Kai Knoblich (kai) Sascha Biberhofer security/vuxml: Document devel/py-twisted vulnerabilities
PR: 261791 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document arbitrary command execution vulnerability in Zsh 1.1_5 Li-Wen Hsu (lwhsu) security/vuxml: Document Jenkins Security Advisory 2022-02-09
Sponsored by: The FreeBSD Foundation 1.1_5 Bernard Spil (brnrd) security/vuxml: Document MariaDB vulnerabilities 1.1_5 Jung-uk Kim (jkim) security/vuxml: Add missing PORTEPOCH for x11/libX11
PR: 261804 1.1_5 Koichiro Iwao (meta) security/vuxml: Document xrdp vulnerability
Security: fc2a9541-8893-11ec-9d01-80ee73419af3
Security: CVE-2022-23613
Sponsored by: HAW International 1.1_5 Matthias Fechner (mfechner) security/vuxml: Document gitlab vulnerabilities 1.1_5 Tobias Kortkamp (tobik) security/vuxml: Fix recent lang/rust entry
PR: 261449 1.1_5 Rene Ladan (rene) security/vuxml: add www/chromium < 98.0.4758.80
Obtained
from: https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html 1.1_5 Dave Cottlehuber (dch) security/vuxml: add h2o-devel vuln details
Security: CVE-2021-43848 1.1_5 Philip Paeps (philip) security/vuxml: add FreeBSD SA-22:01.vt 1.1_5 Timur I. Bakeyev (timur) security/vuxml: Add a note about recent Samba vulnerabilities.
CVE-2021-43566
CVE-2021-44141
CVE-2021-44142
CVE-2022-0336
Security: CVE-2021-43566
CVE-2021-44141
CVE-2021-44142
CVE-2022-0336 1.1_5 Bernard Spil (brnrd) security/vuxml: Document Rust vulnerability 1.1_5 Danilo G. Baio (dbaio) security/vuxml: Remove wrong cvename entry
From:
<vuln vid="7262f826-795e-11ec-8be6-d4c9ef517024">
<topic>MySQL -- Multiple vulnerabilities</topic>
<entry>2022-01-19</entry> 1.1_5 Danilo G. Baio (dbaio) security/vuxml: Document varnish cache vulnerability
PR: 261562
Security: CVE-2022-23959 1.1_5 Matthias Andree (mandree) security/vuxml: document OpenEXR < 3.1.4 vuln
Heap-buffer-overflow in Imf_3_1::LineCompositeTask::execute
Security: b6ef8a53-8062-11ec-9af3-fb232efe4d2e
Security: CVE-2021-45942 1.1_5 Bernard Spil (brnrd) security/vuxml: Document OpenSSL MIPS vulnerability 1.1_5 Fernando Apesteguía (fernape) security/vuxml: Add CVE-2022-0323 (www/phpmustache)
Following change in 4f0a5e1540c3..6901bf72b3b2
Reported by: Marc Veldman <marc@bumblingdork.com> (maintainer) 1.1_5 Adriaan de Groot (adridg) security/vuxml: notify polkit local-privilege-escalation
It was unclear if the actual explot would work on FreeBSD,
since there's no GNU libc which the payload would work on.
The following changes are / have been applied:
- fix in polkit from upstream (from Greg V)
- at kernel level, fixes to disallow argc==0 (from kevans, I think)
PR: 261482 1.1_5 Dries Michiels (driesm) Francois ten Krooden security/vuxml: Document security/strongswan CVE-2021-45079
PR: 261462 1.1_5 Li-Wen Hsu (lwhsu) Francois ten Krooden security/vuxml: Add CVE-2021-41990 and CVE-2021-41991 for security/strongswan
PR: 259267 1.1_5 Cy Schubert (cy) security/vuxml: Document aide CVE-2021-45417
Document aide heap buffer overflow.
PR: 261407
Reported by: Yonas Yanfa <yonas.yanfa@gmail.com> 1.1_5 Rene Ladan (rene) security/vuxml: document www/chromium < 97.0.4692.99
Obtained
from: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html 1.1_5 Bernard Spil (brnrd) security/vuxml: Document MySQL vulnerabilities 1.1_5 Thomas Zander (riggs) security/vuxml: Document Prosody XMPP server advisory 2022-01-13
PR: 261210
Reported by: thomas@beingboiled.info
Security: CVE-2022-0217 1.1_5 Bernard Spil (brnrd) security/vuxml: Document WordPress vulnerabilities 1.1_5 Matthias Fechner (mfechner) security/vuxml: document www/gitlab-ce vulnerabilities 1.1_5 Yasuhiro Kimura (yasu) security/vuxml: Document invalid pointer read vulnerability in ClamAV. 1.1_5 Li-Wen Hsu (lwhsu) security/vuxml: Document Jenkins Security Advisory 2022-01-12
Sponsored by: The FreeBSD Foundation 1.1_5 Thomas Zander (riggs) security/vuxml: Document vulnerabilities in net/uniparser before 0.9.6
PR: 261056
Security: CVE-2021-46141
CVE-2021-46142 1.1_5 Wen Heping (wen) security/vuxml: Document django multiple vulnerabilities. 1.1_5 Fernando Apesteguía (fernape) security/vuxml: document routinator vulnerabilities 1.1_5 Rene Ladan (rene) security/vuxml: document www/chromium < 97.0.4692.71
While here add definitions for 2022, as this is the first vuxml commit
of the year. This cannot be done in its own commit because `make
validate` complains in that case (even with a 0-byte vuln-2022.xml).
Obtained
from: https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html 1.1_5 Bernard Spil (brnrd) security/vuxml: Document Roundcube vulnerability 1.1_5 Tijl Coosemans (tijl) security/vuxml: Document Mbed TLS advisory 2021-12
Security: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12 1.1_5 Philip Paeps (philip) Dan Mahoney security/vuxml: OpenDMARC 1.4.1 vulnerability
PR: 260594
