FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  484820
Date:      2018-11-12
Time:      20:18:10Z
Committer: brnrd

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
85eb4e46-cf16-11e5-840f-485d605f4717php -- multiple vulnerabilities

PHP reports:

  • Core:
    • Fixed bug #71039 (exec functions ignore length but look for NULL termination).
    • Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input).
    • Fixed bug #71459 (Integer overflow in iptcembed()).
  • PCRE:
    • Upgraded bundled PCRE library to 8.38.(CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
  • Phar:
    • Fixed bug #71354 (Heap corruption in tar/zip/phar parser).
    • Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
    • Fixed bug #71488 (Stack overflow when decompressing tar archives). (CVE-2016-2554)
  • WDDX:
    • Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization).

Discovery 2016-02-04
Entry 2016-02-09
Modified 2016-03-13
php55
php55-phar
php55-wddx
lt 5.5.32

php56
php56-phar
php56-wddx
lt 5.6.18

CVE-2015-8383
CVE-2015-8386
CVE-2015-8387
CVE-2015-8389
CVE-2015-8390
CVE-2015-8391
CVE-2015-8393
CVE-2015-8394
CVE-2016-2554
http://php.net/ChangeLog-5.php#5.6.18
http://php.net/ChangeLog-5.php#5.5.32
6b771fe2-b84e-11e5-92f9-485d605f4717php -- multiple vulnerabilities

PHP reports:

  • Core:
    • Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).
  • GD:
    • Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds).
  • SOAP:
    • Fixed bug #70900 (SoapClient systematic out of memory error).
  • Wddx
    • Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
    • Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability).
  • XMLRPC:
    • Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).

Discovery 2016-01-07
Entry 2016-01-11
php55
php55-gd
php55-wddx
php55-xmlrpc
lt 5.5.31

php56
php56-gd
php56-soap
php56-wddx
php56-xmlrpc
lt 5.6.17

http://www.php.net/ChangeLog-5.php#5.5.31
http://www.php.net/ChangeLog-5.php#5.6.17
5764c634-10d2-11e6-94fa-002590263bf5php -- multiple vulnerabilities

The PHP Group reports:

  • BCMath:
    • Fixed bug #72093 (bcpowmod accepts negative scale and corrupts _one_ definition).
  • Exif:
    • Fixed bug #72094 (Out of bounds heap read access in exif header processing).
  • GD:
    • Fixed bug #71912 (libgd: signedness vulnerability). (CVE-2016-3074)
  • Intl:
    • Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative offset).
  • XML:
    • Fixed bug #72099 (xml_parse_into_struct segmentation fault).

Discovery 2016-04-28
Entry 2016-05-03
php70
php70-bcmath
php70-exif
php70-gd
php70-xml
lt 7.0.6

php56
php56-bcmath
php56-exif
php56-gd
php56-xml
lt 5.6.21

php55
php55-bcmath
php55-exif
php55-gd
php55-xml
lt 5.5.35

CVE-2016-3074
ports/209145
http://www.php.net/ChangeLog-7.php#7.0.6
http://www.php.net/ChangeLog-5.php#5.6.21
http://www.php.net/ChangeLog-5.php#5.5.35
66d77c58-3b1d-11e6-8e82-002590263bf5php -- multiple vulnerabilities

The PHP Group reports:

Please reference CVE/URL list for details


Discovery 2016-06-23
Entry 2016-06-25
php55
php55-gd
php55-mbstring
php55-wddx
php55-zip
lt 5.5.37

php56
php56-gd
php56-mbstring
php56-phar
php56-wddx
php56-zip
lt 5.6.23

php70
php70-gd
php70-mbstring
php70-phar
php70-wddx
php70-zip
lt 7.0.8

CVE-2015-8874
CVE-2016-5766
CVE-2016-5767
CVE-2016-5768
CVE-2016-5769
CVE-2016-5770
CVE-2016-5771
CVE-2016-5772
CVE-2016-5773
ports/210491
ports/210502
http://php.net/ChangeLog-5.php#5.5.37
http://php.net/ChangeLog-5.php#5.6.23
http://php.net/ChangeLog-7.php#7.0.8
6b110175-246d-11e6-8dd3-002590263bf5php -- multiple vulnerabilities

The PHP Group reports:

  • Core:
    • Fixed bug #72114 (Integer underflow / arbitrary null write in fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)
    • Fixed bug #72135 (Integer Overflow in php_html_entities). (CVE-2016-5094) (PHP 5.5/5.6 only)
  • GD:
    • Fixed bug #72227 (imagescale out-of-bounds read). (CVE-2013-7456)
  • Intl:
    • Fixed bug #72241 (get_icu_value_internal out-of-bounds read). (CVE-2016-5093)
  • Phar:
    • Fixed bug #71331 (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)

Discovery 2016-05-26
Entry 2016-05-28
php70-gd
php70-intl
lt 7.0.7

php56
php56-gd
lt 5.6.22

php55
php55-gd
php55-phar
lt 5.5.36

CVE-2016-5096
CVE-2016-5094
CVE-2013-7456
CVE-2016-5093
CVE-2016-4343
ports/209779
http://php.net/ChangeLog-7.php#7.0.7
http://php.net/ChangeLog-5.php#5.6.22
http://php.net/ChangeLog-5.php#5.5.36
482d40cb-f9a3-11e5-92ce-002590263bf5php -- multiple vulnerabilities

The PHP Group reports:

  • Fileinfo:
    • Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic file).
  • mbstring:
    • Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in mbfl_strcut).
  • Phar:
    • Fixed bug #71860 (Invalid memory write in phar on filename with \0 in name).
  • SNMP:
    • Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
  • Standard:
    • Fixed bug #71798 (Integer Overflow in php_raw_url_encode).

Discovery 2016-03-31
Entry 2016-04-03
php70
php70-fileinfo
php70-mbstring
php70-phar
php70-snmp
lt 7.0.5

php56
php56-fileinfo
php56-mbstring
php56-phar
php56-snmp
lt 5.6.20

php55
php55-fileinfo
php55-mbstring
php55-phar
php55-snmp
lt 5.5.34

ports/208465
http://php.net/ChangeLog-7.php#7.0.5
http://php.net/ChangeLog-5.php#5.6.20
http://php.net/ChangeLog-5.php#5.5.34
b6402385-533b-11e6-a7bd-14dae9d210b8php -- multiple vulnerabilities

PHP reports:

  • Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)

  • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).

  • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).

  • Fixed bug #72519 (imagegif/output out-of-bounds access).

  • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).

  • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).

  • Fixed bug #72541 (size_t overflow lead to heap corruption).

  • Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).

  • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).

  • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).

  • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).

  • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).

  • Fixed bug #72613 (Inadequate error handling in bzread()).

  • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).


Discovery 2016-07-21
Entry 2016-07-26
php55
lt 5.5.38

php56
lt 5.6.24

php70
lt 7.0.9

php70-curl
lt 7.0.9

php55-bz2
lt 5.5.38

php56-bz2
lt 5.6.24

php70-bz2
lt 7.0.9

php55-exif
lt 5.5.38

php56-exif
lt 5.6.24

php70-exif
lt 7.0.9

php55-gd
lt 5.5.38

php56-gd
lt 5.6.24

php70-gd
lt 7.0.9

php70-mcrypt
lt 7.0.9

php55-odbc
lt 5.5.38

php56-odbc
lt 5.6.24

php70-odbc
lt 7.0.9

php55-snmp
lt 5.5.38

php56-snmp
lt 5.6.24

php70-snmp
lt 7.0.9

php55-xmlrpc
lt 5.5.38

php56-xmlrpc
lt 5.6.24

php70-xmlrpc
lt 7.0.9

php55-zip
lt 5.5.38

php56-zip
lt 5.6.24

php70-zip
lt 7.0.9

http://www.php.net/ChangeLog-5.php#5.5.38
http://www.php.net/ChangeLog-5.php#5.6.24
http://www.php.net/ChangeLog-7.php#7.0.8
http://seclists.org/oss-sec/2016/q3/121
CVE-2015-8879
CVE-2016-5385
CVE-2016-5399
CVE-2016-6288
CVE-2016-6289
CVE-2016-6290
CVE-2016-6291
CVE-2016-6292
CVE-2016-6294
CVE-2016-6295
CVE-2016-6296
CVE-2016-6297