diff options
| author | brnrd <brnrd@FreeBSD.org> | 2017-04-05 22:34:15 +0800 |
|---|---|---|
| committer | brnrd <brnrd@FreeBSD.org> | 2017-04-05 22:34:15 +0800 |
| commit | 191d83e366512b08e4a20ee17dc3fae6779b7273 (patch) | |
| tree | 22b0067a6967ace6382f93b6914a5a958af22f22 /security | |
| parent | 786c05b9151733dd0c7c6a87fd8b523def001ff5 (diff) | |
| download | freebsd-ports-gnome-191d83e366512b08e4a20ee17dc3fae6779b7273.tar.gz freebsd-ports-gnome-191d83e366512b08e4a20ee17dc3fae6779b7273.tar.zst freebsd-ports-gnome-191d83e366512b08e4a20ee17dc3fae6779b7273.zip | |
security/vuxml: Document curl vulnerability
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 7ef296b091b1..87e53edf822b 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,39 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="04f29189-1a05-11e7-bc6e-b499baebfeaf"> + <topic> -- </topic> + <affects> + <package> + <name>curl</name> + <range><ge>6.5</ge><lt>7.54.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The cURL project reports:</p> + <blockquote cite="https://curl.haxx.se/docs/adv_20170403.html"> + <p>There were two bugs in curl's parser for the command line option + --write-out (or -w for short) that would skip the end of string + zero byte if the string ended in a % (percent) or \ (backslash), + and it would read beyond that buffer in the heap memory and it + could then potentially output pieces of that memory to the + terminal or the target file etc..</p> + <p>This flaw only exists in the command line tool.</p> + <p>We are not aware of any exploit of this flaw.</p> + </blockquote> + </body> + </description> + <references> + <url>https://curl.haxx.se/docs/adv_20170403.html</url> + <cvename>CVE-2017-7407</cvename> + </references> + <dates> + <discovery>2017-04-03</discovery> + <entry>2017-04-05</entry> + </dates> + </vuln> + <vuln vid="dc880d6c-195d-11e7-8c63-0800277dcc69"> <topic>django -- multible vulnerabilities</topic> <affects> |