FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  454426
Date:      2017-11-18
Time:      11:38:23Z
Committer: brnrd

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
ccace707-a8d8-11e7-ac58-b499baebfeafcURL -- out of bounds read

The cURL project reports:

FTP PWD response parser out of bounds read

libcurl may read outside of a heap allocated buffer when doing FTP.

When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses.

Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path.

A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault.


Discovery 2017-10-04
Entry 2017-10-04
curl
lt 7.56.0

https://curl.haxx.se/docs/adv_20171004.html
CVE-2017-1000254
9314058e-5204-11e7-b712-b1a44a034d72cURL -- URL file scheme drive letter buffer overflow

cURL security advisory:

When libcurl is given either

1. a file: URL that doesn't use two slashes following the colon, or

2. is told that file is the default scheme to use for URLs without scheme

... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.

We are not aware of any exploit of this flaw.


Discovery 2017-06-14
Entry 2017-06-15
curl
ge 7.53.0 lt 7.54.1

CVE-2017-9502
https://curl.haxx.se/docs/adv_20170614.html
69cfa386-7cd0-11e7-867f-b499baebfeafcURL -- multiple vulnerabilities

The cURL project reports:

  • FILE buffer read out of bounds
  • TFTP sends more than buffer size
  • URL globbing out of bounds read

Discovery 2017-08-09
Entry 2017-08-09
curl
lt 7.55.0

https://curl.haxx.se/docs/security.html
CVE-2017-1000099
CVE-2017-1000100
CVE-2017-1000101