FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  456342
Date:      2017-12-14
Time:      19:44:02Z
Committer: bhughes

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
04f29189-1a05-11e7-bc6e-b499baebfeafcURL -- potential memory disclosure

The cURL project reports:

There were two bugs in curl's parser for the command line option --write-out (or -w for short) that would skip the end of string zero byte if the string ended in a % (percent) or \ (backslash), and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that memory to the terminal or the target file etc..

This flaw only exists in the command line tool.

We are not aware of any exploit of this flaw.


Discovery 2017-04-03
Entry 2017-04-05
Modified 2017-04-06
curl
ge 6.5 lt 7.53.1_1

https://curl.haxx.se/docs/adv_20170403.html
CVE-2017-7407
3e2e9b44-25ce-11e7-a175-939b30e0836dcURL -- TLS session resumption client cert bypass (again)

cURL security advisory:

libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).

libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.

This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.


Discovery 2017-04-19
Entry 2017-04-20
curl
ge 7.52.0 lt 7.54.0

CVE-2017-7468
https://curl.haxx.se/docs/adv_20170419.html
ccace707-a8d8-11e7-ac58-b499baebfeafcURL -- out of bounds read

The cURL project reports:

FTP PWD response parser out of bounds read

libcurl may read outside of a heap allocated buffer when doing FTP.

When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses.

Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path.

A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault.


Discovery 2017-10-04
Entry 2017-10-04
curl
lt 7.56.0

https://curl.haxx.se/docs/adv_20171004.html
CVE-2017-1000254
9314058e-5204-11e7-b712-b1a44a034d72cURL -- URL file scheme drive letter buffer overflow

cURL security advisory:

When libcurl is given either

1. a file: URL that doesn't use two slashes following the colon, or

2. is told that file is the default scheme to use for URLs without scheme

... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.

We are not aware of any exploit of this flaw.


Discovery 2017-06-14
Entry 2017-06-15
curl
ge 7.53.0 lt 7.54.1

CVE-2017-9502
https://curl.haxx.se/docs/adv_20170614.html
69cfa386-7cd0-11e7-867f-b499baebfeafcURL -- multiple vulnerabilities

The cURL project reports:

  • FILE buffer read out of bounds
  • TFTP sends more than buffer size
  • URL globbing out of bounds read

Discovery 2017-08-09
Entry 2017-08-09
curl
lt 7.55.0

https://curl.haxx.se/docs/security.html
CVE-2017-1000099
CVE-2017-1000100
CVE-2017-1000101