diff options
| author | Remko Lodder <remko@FreeBSD.org> | 2007-02-26 21:08:24 +0000 |
|---|---|---|
| committer | Remko Lodder <remko@FreeBSD.org> | 2007-02-26 21:08:24 +0000 |
| commit | ff75480abf504d9423bf590f6e66d0287289d864 (patch) | |
| tree | db1e8b3ddede04dd6bdbb43a5a442329952f40c0 /security/vuxml | |
| parent | - Fix plist (diff) | |
Document libarchive -- Infinite loop in corrupt archives handling in
libarchive.
This is also FreeBSD SA-06:24.libarchive, FreeBSD systems are not
affected, only specific STABLE versions which are not released!!
Notes
Notes:
svn path=/head/; revision=186024
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 46 |
1 files changed, 41 insertions, 5 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 341350217190..8311511272d4 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,9 +34,50 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="792bc222-c5d7-11db-9f82-000e0c2e438a"> + <topic>libarchive -- Infinite loop in corrupt archives handling in libarchive</topic> + <affects> + <package> + <name>libarchive</name> + <range><lt>1.3.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <h1>Problem Description:</h1> + <p>If the end of an archive is reached while attempting to + "skip" past a region of an archive, libarchive will enter an + infinite loop wherein it repeatedly attempts (and fails) to + read further data.</p> + <h1>Impact:</h1> + <p>An attacker able to cause a system to extract (via "tar -x" + or another application which uses libarchive) or list the + contents (via "tar -t" or another libarchive-using + application) of an archive provided by the attacker can cause + libarchive to enter an infinite loop and use all available + CPU time.</p> + <h1>Workaround:</h1> + <p>No workaround is available.</p> + </body> + </description> + <references> + <cvename>CVE-2006-5680</cvename> + <freebsdsa>SA-06:24.libarchive</freebsdsa> + </references> + <dates> + <discovery>2006-11-08</discovery> + <entry>2007-02-26</entry> + </dates> + </vuln> + <vuln vid="0f37d765-c5d4-11db-9f82-000e0c2e438a"> <topic>OpenSSL -- Multiple problems in crypto(3)</topic> <affects> + <package> + <name>openssl</name> + <range><lt>0.9.7l_0</lt></range> + <range><gt>0.9.8</gt><lt>0.9.8d_0</lt></range> + </package> <system> <name>FreeBSD</name> <range><gt>6.1</gt><lt>6.1_9</lt></range> @@ -46,11 +87,6 @@ Note: Please add new entries to the beginning of this file. <range><gt>5.3</gt><lt>5.3_36</lt></range> <range><gt>4.11</gt><lt>4.11_24</lt></range> </system> - <package> - <name>openssl</name> - <range><lt>0.9.7l_0</lt></range> - <range><gt>0.9.8</gt><lt>0.9.8d_0</lt></range> - </package> </affects> <description> <body xmlns="http://www.w3.org/1999/xhtml"> |