FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-05-02 10:37:19 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
2ce1a2f1-0177-11ef-a45e-08002784c58d	ruby -- Arbitrary memory address read vulnerability with Regex search sp2ip reports: If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. Discovery 2024-04-23 Entry 2024-04-23 ruby ge 3.1.0,1 lt 3.1.5,1 ge 3.2.0,1 lt 3.2.4,1 ge 3.3.0,1 lt 3.3.1,1 ruby31 ge 3.1.0,1 lt 3.1.5,1 ruby32 ge 3.2.0,1 lt 3.2.4,1 ruby33 ge 3.3.0,1 lt 3.3.1,1 CVE-2024-27282 https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/
6bd2773c-cf1a-11ed-bd44-080027f5fec9	rubygem-time -- ReDoS vulnerability ooooooo_q reports: The Time parser mishandles invalid strings that have specific characters. It causes an increase in execution time for parsing strings to Time objects. Discovery 2023-03-30 Entry 2023-03-30 ruby ge 2.7.0,1 lt 2.7.8,1 ge 3.0.0,1 lt 3.0.6,1 ge 3.1.0,1 lt 3.1.4,1 ge 3.2.0.p1,1 lt 3.2.2,1 ruby27 ge 2.7.0,1 lt 2.7.8,1 ruby30 ge 3.0.0,1 lt 3.0.6,1 ruby31 ge 3.1.0,1 lt 3.1.4,1 ruby32 ge 3.2.0.p1,1 lt 3.2.2,1 rubygem-time < 0.2.2 CVE-2023-28756 https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
84ab03b6-6c20-11ed-b519-080027f5fec9	rubygem-cgi -- HTTP response splitting vulnerability Hiroshi Tokumaru reports: If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body. Also, the contents for a `CGI::Cookie` object were not checked properly. If an application creates a `CGI::Cookie` object based on user input, an attacker may exploit it to inject invalid attributes in `Set-Cookie` header. We think such applications are unlikely, but we have included a change to check arguments for `CGI::Cookie#initialize` preventatively. Discovery 2022-11-22 Entry 2022-11-24 rubygem-cgi < 0.3.4 ruby ge 2.7.0,1 lt 2.7.7,1 ge 3.0.0,1 lt 3.0.5,1 ge 3.1.0,1 lt 3.1.3,1 ge 3.2.0.p1,1 lt 3.2.0.r1,1 ruby27 ge 2.7.0,1 lt 2.7.7,1 ruby30 ge 3.0.0,1 lt 3.0.5,1 ruby31 ge 3.1.0,1 lt 3.1.3,1 ruby32 ge 3.2.0.p1,1 lt 3.2.0.r1,1 CVE-2021-33621 https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/
9b60bba1-cf18-11ed-bd44-080027f5fec9	rubygem-uri -- ReDoS vulnerability Dominic Couture reports: A ReDoS issue was discovered in the URI component. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. Discovery 2023-03-28 Entry 2023-03-30 ruby ge 2.7.0,1 lt 2.7.8,1 ge 3.0.0,1 lt 3.0.6,1 ge 3.1.0,1 lt 3.1.4,1 ge 3.2.0.p1,1 lt 3.2.2,1 ruby27 ge 2.7.0,1 lt 2.7.8,1 ruby30 ge 3.0.0,1 lt 3.0.6,1 ruby31 ge 3.1.0,1 lt 3.1.4,1 ruby32 ge 3.2.0.p1,1 lt 3.2.2,1 rubygem-uri < 0.12.1 CVE-2023-28755 https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/