kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document security issues fixed Libidn 1.33

Browse source 
PR:		211407
Reported by:	Piotr Kubaj <pkubaj@anongoth.pl>
Security:	CVE-2015-8948
Security:	CVE-2016-6261
Security:	CVE-2016-6262
Security:	CVE-2016-6263
Security:	https://vuxml.FreeBSD.org/freebsd/cb5189eb-572f-11e6-b334-002590263bf5.html
This commit is contained in:
Jason Unovitch 2016-07-31 15:14:57 +00:00
parent 24bd1478d8
commit 56365fadf7
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=419388
1 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
security/vuxml/vuln.xml
View file

@ -58,6 +58,41 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="cb5189eb-572f-11e6-b334-002590263bf5">
<topic>libidn -- mulitiple vulnerabilities</topic>
<affects>
<package>
<name>libidn</name>
<range><lt>1.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Josefsson reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html">
<p>libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.</p>
<p>idn: Solve out-of-bounds-read when reading one zero byte as input.
Also replaced fgets with getline.</p>
<p>libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was
always documented to only accept UTF-8 data, but now it doesn't
crash when presented with such data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6261</cvename>
<cvename>CVE-2015-8948</cvename>
<cvename>CVE-2016-6262</cvename>
<cvename>CVE-2016-6263</cvename>
<url>https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/07/21/4</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-31</entry>
</dates>
</vuln>
<vuln vid="6fb8a90f-c9d5-4d14-b940-aed3d63c2edc">
<topic>The GIMP -- Use after Free vulnerability</topic>
<affects>