diff options
| author | remko <remko@FreeBSD.org> | 2006-06-28 03:55:04 +0800 |
|---|---|---|
| committer | remko <remko@FreeBSD.org> | 2006-06-28 03:55:04 +0800 |
| commit | dc35b8b6d3217c61d5e1f5e39c732db58b709673 (patch) | |
| tree | 8f94aa10aebf3978412acd6d396eb720d74dcd04 /security | |
| parent | 672a85971f9eb22d581c58877bd8a1f6f6fc5780 (diff) | |
| download | freebsd-ports-gnome-dc35b8b6d3217c61d5e1f5e39c732db58b709673.tar.gz freebsd-ports-gnome-dc35b8b6d3217c61d5e1f5e39c732db58b709673.tar.zst freebsd-ports-gnome-dc35b8b6d3217c61d5e1f5e39c732db58b709673.zip | |
Document hashcash -- heap overflow vulnerability.
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index daed4d137ff2..af97bfe61c99 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="2be7c122-0614-11db-9156-000e0c2e438a"> + <topic>hashcash -- heap overflow vulnerability</topic> + <affects> + <package> + <name>hashcash</name> + <range><lt>1.22</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Andreas Seltenreich reports that hashcash is prone to a heap + overflow vulnerability. This vulnerability is caused by + improper checking of memory allocations within the + "array_push()" function. An attacker could trigger this + vulnerability by passing a lot of "-r" or "-j" flags from + the command line, this only applies when the application is + configured to allow command line options, or by passing a lot + of resource names when the application was started with the + "-m" flag set. This could lead to a Denial or Service or + could allow remote access to the targeted system.</p> + </body> + </description> + <references> + <url>http://secunia.com/advisories/20800/</url> + <url>http://www.hashcash.org/source/CHANGELOG</url> + </references> + <dates> + <discovery>2006-06-27</discovery> + <entry>2006-06-27</entry> + </dates> + </vuln> + <vuln vid="f900bda8-0472-11db-bbf7-000c6ec775d9"> <topic>gnupg -- user id integer overflow vulnerability</topic> <affects> |