mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-12-17 03:25:46 +00:00
Code Issues Releases Activity

Added vxvml entry for security/dropbear

Browse Source 
PR:		220158
Submitted by:	Piotr Kubaj <pkubaj@anongoth.pl> (maintainer)
Reviewed by:	lifanov (mentor)
Approved by:	lifanov (mentor)
MFH:		2017Q3
Security:	http://www.vuxml.org/freebsd/60931f98-55a7-11e7-8514-589cfc0654e1.html
Differential Revision:	https://reviews.freebsd.org/D11400
This commit is contained in:
Richard Gallamore 2017-07-03 19:29:39 +00:00
parent 940e6e7742
commit 1a9c9614ed
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=444984
1 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
security/vuxml/vuln.xml
View File

@ -58,6 +58,41 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="60931f98-55a7-11e7-8514-589cfc0654e1">
<topic>Dropbear -- two vulnerabilities</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2017.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnston reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Fix double-free in server TCP listener cleanup A double-free in
the server could be triggered by an authenticated user if dropbear
is running with -a (Allow connections to forwarded ports from any
host) This could potentially allow arbitrary code execution as root
by an authenticated user.</p>
<p>Fix information disclosure with ~/.ssh/authorized_keys symlink.
Dropbear parsed authorized_keys as root, even if it were a symlink.
The fix is to switch to user permissions when opening authorized_keys.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2017-9078</cvename>
<cvename>CVE-2017-9079</cvename>
</references>
<dates>
<discovery>2017-05-18</discovery>
<entry>2017-07-03</entry>
</dates>
</vuln>
<vuln vid="6e4e35c3-5fd1-11e7-9def-b499baebfeaf">
<topic>smarty3 -- shell injection in math</topic>
<affects>