kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document dovecot issue

Browse source 
Submitted by:	Roger Marquis <marquis@roble.com>
This commit is contained in:
Steve Wills 2018-01-26 14:37:23 +00:00
parent f610844383
commit 47d8ff45e3
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=459994
1 changed files with 32 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
security/vuxml/vuln.xml
View file

@ -58,6 +58,38 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="92b8b284-a3a2-41b1-956c-f9cf8b74f500">
<topic>dovecot -- abort of SASL authentication results in a memory leak</topic>
<affects>
<package>
<name>dovecot</name>
<range><gt>2.0</gt><lt>2.2.33</lt></range>
<range><ge>2.3</ge><le>2.3.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Pedro Sampaio reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1532768">
<p>A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of
SASL authentication results in a memory leak in Dovecot auth client
used by login processes. The leak has impact in high performance
configuration where same login processes are reused and can cause the
process to crash due to memory exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15132</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1532768</url>
<url>https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch</url>
</references>
<dates>
<discovery>2018-01-09</discovery>
<entry>2018-01-26</entry>
</dates>
</vuln>
<vuln vid="0cbf0fa6-dcb7-469c-b87a-f94cffd94583">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>