mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-02-03 11:12:13 +00:00
Code Issues Releases Activity

security/vuxml: Mark php72, php73, and php74 vulnerable as per:

Browse Source 
https://www.php.net/ChangeLog-7.php#PHP_7_4
    https://www.php.net/ChangeLog-7.php#PHP_7_3
    https://www.php.net/ChangeLog-7.php#PHP_7_2

The phar_parse_zipfile function had [a] use-after-free vulnerability
because of [a] mishandling of the actual_alias variable.

Security:	CVE-2020-7068
This commit is contained in:
Craig Leres 2020-08-27 20:50:21 +00:00
parent 18782e8107
commit 1eab12760e
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=546691
1 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
security/vuxml/vuln.xml
View File

@ -58,6 +58,42 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="ee261034-b95e-4479-b947-08b0877e029f">
<topic>php72 -- use of freed hash key</topic>
<affects>
<package>
<name>php72</name>
<range><lt>7.2.33</lt></range>
</package>
<package>
<name>php73</name>
<range><lt>7.3.21</lt></range>
</package>
<package>
<name>php74</name>
<range><lt>7.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>grigoritchy at gmail dot com reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=79797">
<p>The phar_parse_zipfile function had use-after-free
vulnerability because of mishandling of the actual_alias
variable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7068</url>
<cvename>CVE-2020-7068</cvename>
</references>
<dates>
<discovery>2020-07-06</discovery>
<entry>2020-08-27</entry>
</dates>
</vuln>
<vuln vid="d73bc4e6-e7c4-11ea-a878-e09467587c17">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>