kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

security/vuxml: Document openssl-devel vulnerability

Browse source 
- While here fix whitespace on 077bbadf-f2f4-11e6-92a7-902b34361349
This commit is contained in:
Bernard Spil 2017-02-16 12:42:51 +00:00
parent 8c721ca46d
commit 249eccc6fd
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=434209
1 changed files with 35 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
security/vuxml/vuln.xml
View file

@ -58,6 +58,39 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="1a802ba9-f444-11e6-9940-b499baebfeaf">
<topic>openssl -- crash on handshake</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20170216.txt">
<p>Severity: High<br/>
During a renegotiation handshake if the Encrypt-Then-Mac
extension is negotiated where it was not in the original
handshake (or vice-versa) then this can cause OpenSSL to
crash (dependent on ciphersuite). Both clients and servers
are affected.<br/>
This issue does not affect OpenSSL version 1.0.2.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20170216.txt</url>
<cvename>CVE-2017-3733</cvename>
</references>
<dates>
<discovery>2017-02-16</discovery>
<entry>2017-02-16</entry>
</dates>
</vuln>
<vuln vid="077bbadf-f2f4-11e6-92a7-902b34361349">
<topic>diffoscope -- arbitrary file write</topic>
<affects>
@ -71,8 +104,8 @@ Notes:
<p>Ximin Luo reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723">
<p>[v67] introduced a security hole where diffoscope may write to
arbitrary locations on disk depending on the contents of an
untrusted archive.</p>
arbitrary locations on disk depending on the contents of an
untrusted archive.</p>
</blockquote>
</body>
</description>