FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  499927
Date:      2019-04-25
Time:      02:05:05Z
Committer: acm

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
9245681c-7c3c-11e7-b5af-a4badb2f4699sqlite3 -- heap-buffer overflow

Google reports:

A heap-buffer overflow (sometimes a crash) can arise when running a SQL request on malformed sqlite3 databases.


Discovery 2017-08-08
Entry 2017-08-08
Modified 2017-09-19
sqlite3
lt 3.20.0

https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937
CVE-2017-10989
6d52bda1-2e54-11e8-a68f-485b3931c969SQLite -- Corrupt DB can cause a NULL pointer dereference

MITRE reports:

SQLite databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.


Discovery 2018-03-16
Entry 2018-03-22
sqlite3
lt 3.22.0_1

CVE-2018-8740
http://openwall.com/lists/oss-security/2018/03/17/1
dec3164f-3121-45ef-af18-bb113ac5082fsqlite -- multiple vulnerabilities

NVD reports:

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.


Discovery 2015-04-14
Entry 2015-04-18
Modified 2015-05-08
sqlite3
lt 3.8.9

CVE-2015-3414
CVE-2015-3415
CVE-2015-3416
https://www.sqlite.org/src/info/eddc05e7bb31fae7
https://www.sqlite.org/src/info/02e3c88fbf6abdcf
https://www.sqlite.org/src/info/c494171f77dc2e5e
http://seclists.org/fulldisclosure/2015/Apr/31
546deeea-3fc6-11e6-a671-60a44ce6887bSQLite3 -- Tempdir Selection Vulnerability

KoreLogic security reports:

Affected versions of SQLite reject potential tempdir locations if they are not readable, falling back to '.'. Thus, SQLite will favor e.g. using cwd for tempfiles on such a system, even if cwd is an unsafe location. Notably, SQLite also checks the permissions of '.', but ignores the results of that check.


Discovery 2016-07-01
Entry 2016-07-03
sqlite3
lt 3.13.0

CVE-2016-6153
ports/209827
https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt
http://openwall.com/lists/oss-security/2016/07/01/2
http://www.sqlite.org/cgi/src/info/67985761aa93fb61
http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3
http://www.sqlite.org/cgi/src/info/614bb709d34e1148