diff options
| author | Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> | 2019-11-13 23:45:36 +0000 |
|---|---|---|
| committer | Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> | 2019-11-13 23:45:36 +0000 |
| commit | 582506a11afd5c71be6170bcbb1676c2d41577cf (patch) | |
| tree | 5448e7236add1e9cf3b6a90200f2f8e358a1d53a | |
| parent | Update RUN_DEPENDS for rubygem-rouge 3.13.0 update and patched Gemfile (diff) | |
Document libmad vulnerability
Notes
Notes:
svn path=/head/; revision=517534
| -rw-r--r-- | security/vuxml/vuln.xml | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 5beaf8c5a372..a1416a8e3d61 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,55 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="b48e7b14-052a-11ea-a1de-53b029d2b061"> + <topic>libmad -- multiple vulnerabilities</topic> + <affects> + <package> + <name>libmad</name> + <range><lt>0.15.1b_7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>National Vulnerability Database:</p> + <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8372"> + <p>CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD + libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a + denial of service (assertion failure and application exit) via a crafted + audio file.</p> + </blockquote> + <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8373"> + <p>CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD + libmad 0.15.1b allows remote attackers to cause a denial of service + (heap-based buffer overflow and application crash) or possibly have + unspecified other impact via a crafted audio file.</p> + </blockquote> + <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8374"> + <p>CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD + libmad 0.15.1b allows remote attackers to cause a denial of service + (heap-based buffer over-read and application crash) via a crafted audio + file.</p> + </blockquote> + </body> + </description> + <references> + <url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133#15</url> + <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8372</url> + <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8373</url> + <url>https://nvd.nist.gov/vuln/detail/CVE-2017-8374</url> + <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/</url> + <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/</url> + <url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/</url> + <cvename>CVE-2017-8372</cvename> + <cvename>CVE-2017-8373</cvename> + <cvename>CVE-2017-8374</cvename> + </references> + <dates> + <discovery>2017-04-30</discovery> + <entry>2019-11-13</entry> + </dates> + </vuln> + <vuln vid="88d00176-058e-11ea-bd1c-3065ec8fd3ec"> <topic>chromium -- multiple vulnerabilities</topic> <affects> |