diff options
| author | leres <leres@FreeBSD.org> | 2019-09-18 06:50:11 +0800 |
|---|---|---|
| committer | leres <leres@FreeBSD.org> | 2019-09-18 06:50:11 +0800 |
| commit | 04c731d71d00cfec042b1c6bc7263a24e2d97734 (patch) | |
| tree | 47fc63bea51161e96ae9da63c05857e8b60b89ee | |
| parent | 4f94fa4794638c52c3a52f152cab8d8f76ff77d2 (diff) | |
| download | freebsd-ports-gnome-04c731d71d00cfec042b1c6bc7263a24e2d97734.tar.gz freebsd-ports-gnome-04c731d71d00cfec042b1c6bc7263a24e2d97734.tar.zst freebsd-ports-gnome-04c731d71d00cfec042b1c6bc7263a24e2d97734.zip | |
security/vuxml: Mark bro < 2.6.4 as vulnerable as per:
https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS
The issue is inproper data handling of data that is either either
empty or unterminated, resulting in invalid memory access or heap
buffer over-read.
Approved by: matthew (mentor, implicit)
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 6ad993fa9426..e5cc5d6057c8 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,40 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="55571619-454e-4769-b1e5-28354659e152"> + <topic>bro -- invalid memory access or heap buffer over-read</topic> + <affects> + <package> + <name>bro</name> + <range><lt>2.6.4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Jon Siwek of Corelight reports:</p> + <blockquote cite="https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS"> + <p>This is a security patch release to address a potential + Denial of Service vulnerability:</p> + <ul> + <li> + The NTLM analyzer did not properly handle AV Pair sequences + that were either empty or unterminated, resulting in + invalid memory access or heap buffer over-read. The NTLM + analyzer is enabled by default and used in the analysis + of SMB, DCE/RPC, and GSSAPI protocols.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS</url> + </references> + <dates> + <discovery>2019-08-28</discovery> + <entry>2019-09-17</entry> + </dates> + </vuln> + <vuln vid="c5bd8a25-99a6-11e9-a598-f079596b62f9"> <topic>expat2 -- Fix extraction of namespace prefixes from XML names</topic> <affects> |