diff options
| author | Martin Wilke <miwi@FreeBSD.org> | 2018-07-09 08:19:46 +0000 |
|---|---|---|
| committer | Martin Wilke <miwi@FreeBSD.org> | 2018-07-09 08:19:46 +0000 |
| commit | 1637d2415fa038e1a2538b0ae896ee418b0311c7 (patch) | |
| tree | 78122206acf461484d552f9f56220e5a892d9edf | |
| parent | - Update DEPENDS which forgot in previous commit (diff) | |
- Document devel/zziplib - multible vulnerabilities
PR: 226491
Sponsored by: iXsystems Inc.
Notes
Notes:
svn path=/head/; revision=474238
| -rw-r--r-- | security/vuxml/vuln.xml | 71 |
1 files changed, 71 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index af055799e3fe..5b6aa4ed720d 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,77 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374"> + <topic>zziplib - multiple vulnerabilities</topic> + <affects> + <package> + <name>zziplib</name> + <range><lt>0.13.68</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>NIST reports (by search in the range 2017/01/01 - 2018/07/06):</p> + <blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018"> + <p>17 security fixes in this release:</p> + <ul> + <li>Heap-based buffer overflow in the __zzip_get32 function in fetch.c.</li> + <li>Heap-based buffer overflow in the __zzip_get64 function in fetch.c.</li> + <li>Heap-based buffer overflow in the zzip_mem_entry_extra_block function + in memdisk.c.</li> + <li>The zzip_mem_entry_new function in memdisk.c allows remote attackers + to cause a denial of service (out-of-bounds read and crash) via a + crafted ZIP file.</li> + <li>The prescan_entry function in fseeko.c allows remote attackers to cause + a denial of service (NULL pointer dereference and crash) via crafted + ZIP file.</li> + <li>The zzip_mem_entry_new function in memdisk.c cause a NULL pointer + dereference and crash via a crafted ZIP file.</li> + <li>seeko.c cause a denial of service (assertion failure and crash) via a + crafted ZIP file.</li> + <li>A segmentation fault caused by invalid memory access in the + zzip_disk_fread function because the size variable is not validated + against the amount of file->stored data.</li> + <li>A memory alignment error and bus error in the __zzip_fetch_disk_trailer + function of zzip/zip.c.</li> + <li>A bus error caused by loading of a misaligned address in the + zzip_disk_findfirst function.</li> + <li>An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory + function.</li> + <li>An invalid memory address dereference was discovered in zzip_disk_fread + in mmapped.c.</li> + <li>A memory leak triggered in the function zzip_mem_disk_new in + memdisk.c.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2017-5974</cvename> + <cvename>CVE-2017-5975</cvename> + <cvename>CVE-2017-5976</cvename> + <cvename>CVE-2017-5977</cvename> + <cvename>CVE-2017-5978</cvename> + <cvename>CVE-2017-5979</cvename> + <cvename>CVE-2017-5980</cvename> + <cvename>CVE-2017-5981</cvename> + <cvename>CVE-2018-6381</cvename> + <cvename>CVE-2018-6484</cvename> + <cvename>CVE-2018-6540</cvename> + <cvename>CVE-2018-6541</cvename> + <cvename>CVE-2018-6542</cvename> + <cvename>CVE-2018-6869</cvename> + <cvename>CVE-2018-7725</cvename> + <cvename>CVE-2018-7726</cvename> + <cvename>CVE-2018-7727</cvename> + <url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018"</url> + </references> + <dates> + <discovery>2017-03-01</discovery> + <entry>2018-07-06</entry> + </dates> + </vuln> + <vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d"> <topic>wordpress -- multiple issues</topic> <affects> |