kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add a vulnerability entry for lzo2.

Browse source
This commit is contained in:
Matthias Andree 2014-06-26 18:08:02 +00:00
parent 5e20a13809
commit bb9cd2e711
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=359407
1 changed files with 33 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
security/vuxml/vuln.xml
View file

@ -57,6 +57,39 @@ Notes:
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="d1f5e12a-fd5a-11e3-a108-080027ef73ec">
<topic>LZO -- potential buffer overrun when processing malicious input data</topic>
<affects>
<package>
<name>lzo2</name>
<range><lt>2.07</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:</p>
<blockquote>
<p>Fixed a potential integer overflow condition in the "safe"
decompressor variants which could result in a possible buffer
overrun when processing maliciously crafted compressed input
data.</p>
<p>As this issue only affects 32-bit systems and also can only happen
if you use uncommonly huge buffer sizes where you have to decompress
more than 16 MiB (2^24 bytes) compressed bytes within a single
function call, the practical implications are limited.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz</url>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2014-06-26</entry>
</dates>
</vuln>
<vuln vid="1c840eb9-fb32-11e3-866e-b499baab0cbe">
<topic>gnupg -- possible DoS using garbled compressed data packets</topic>
<affects>