diff options
| author | trasz <trasz@FreeBSD.org> | 2007-06-02 03:36:13 +0800 |
|---|---|---|
| committer | trasz <trasz@FreeBSD.org> | 2007-06-02 03:36:13 +0800 |
| commit | 7d22e05cddb9bef99d138501309f9baa3d9614a2 (patch) | |
| tree | 39e028d71638f5cb8af91bf90bcac031df682182 /security/vuxml | |
| parent | 0412cc54f4e77a5ae335e91247fad02827d0be98 (diff) | |
| download | freebsd-ports-gnome-7d22e05cddb9bef99d138501309f9baa3d9614a2.tar.gz freebsd-ports-gnome-7d22e05cddb9bef99d138501309f9baa3d9614a2.tar.zst freebsd-ports-gnome-7d22e05cddb9bef99d138501309f9baa3d9614a2.zip | |
- Add entry for findutils -- GNU locate heap buffer overrun.
Revieved by: simon (secteam)
Approved by: miwi (mentor)
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index c3ee6511f28b..caa1077231fb 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="7ca2a709-103b-11dc-8e82-00001cd613f9"> + <topic>findutils -- GNU locate heap buffer overrun</topic> + <affects> + <package> + <name>findutils</name> + <range><lt>4.2.31</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>James Youngman reports:</p> + <blockquote cite="http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html"> + <p>When GNU locate reads filenames from an old-format locate database, + they are read into a fixed-length buffer allocated on the heap. + Filenames longer than the 1026-byte buffer can cause a buffer overrun. + The overrunning data can be chosen by any person able to control the + names of filenames created on the local system. This will normally + include all local users, but in many cases also remote users (for + example in the case of FTP servers allowing uploads).</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2007-2452</cvename> + <mlist>http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html</mlist> + </references> + <dates> + <discovery>2007-05-30</discovery> + <entry>2007-06-01</entry> + </dates> + </vuln> + <vuln vid="de2fab2d-0a37-11dc-aae2-00304881ac9a"> <topic>FreeType 2 -- Heap overflow vulnerability</topic> <affects> |