diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 9a3aa263b27e..3a418a0c9165 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,39 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + openssl -- crash on handshake + + + openssl-devel + 1.1.0e + + + + +

The OpenSSL project reports:

+
+

Severity: High
+ During a renegotiation handshake if the Encrypt-Then-Mac + extension is negotiated where it was not in the original + handshake (or vice-versa) then this can cause OpenSSL to + crash (dependent on ciphersuite). Both clients and servers + are affected.
+ This issue does not affect OpenSSL version 1.0.2. +

+
+ + + + https://www.openssl.org/news/secadv/20170216.txt + CVE-2017-3733 + + + 2017-02-16 + 2017-02-16 + + + diffoscope -- arbitrary file write @@ -71,8 +104,8 @@ Notes:

Ximin Luo reports:

[v67] introduced a security hole where diffoscope may write to - arbitrary locations on disk depending on the contents of an - untrusted archive.

+ arbitrary locations on disk depending on the contents of an + untrusted archive.