From nobody Fri Dec 06 16:57:01 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Y4cqd6n76z5gXmc; Fri, 06 Dec 2024 16:57:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Y4cqd63GZz4Ycj; Fri, 6 Dec 2024 16:57:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1733504221; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=L3gEBwfE3UCdkAD3bASaioirmHxIPGLoFHz9IYk8tsw=; b=ZGvpHteVzuPHUDb755DU16TKBUrHf6beDHb3eXeDVtBK+7r6JvFyrLu1uvFm361DOqTiZR Esk3UJL+0ki/amgZ50cryXaH0dX1/ZiSpCDtDIdRvfk9zyEfKwfVOJczU6h8XZEzAOl21D 1YcZxHInJvmMY2cmYHln107sVuNIWMAp37YUkBIqxDvZzhFMDSrqtfACmbnmt//Ojz0gVa pKeUILurIr6N/Uu8QGnSePnZguiHKJ3INa/y2CNgSAc+6meMpj0gDTeDfHC2poboDCVNQW mSp3ejz5Xc/c3bhDmn9yUiGoXqNeygcR1CpuvqS724tPh9yqfGTcHPpuQsGJYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1733504221; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=L3gEBwfE3UCdkAD3bASaioirmHxIPGLoFHz9IYk8tsw=; b=kHaCgU9y9ohhjyJc4w3nVfHOL+gFuqjBr/ggxPocYvRQ6X9wGNTtVQ013cbbe7gIbNtHL4 zzncDcDbtVx+1eKqcaP87b25kGVVxFhnKiOuWlMYcpoos3LIYw7uetQQmpKn0nDRXS8NI7 vkBM4hGR4rzrmWMlxGmyhNzSppoP/0fj2V8Erxjx2Q5JQMQQm60QIlLWWcKcwmF0ir6EE8 8TNONQKOUnwCOHzfPov8R0J73hdgG534W851rEaY7JlvUiGIKOs75d2W6P5BoXmWgxL1kI Kpn8VJvvtHlULaJ3LMXB/YxUl4Z+7XJUB39IvIRs5djvgZsmzvn+/yTfTJ23Aw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1733504221; a=rsa-sha256; cv=none; b=SFTVc3TlwtBKxX98qJehBC/B4CgPLkk6sy7/8tAx8mzjD6ihzMLXObDfWVrQv1uKhWNgxB ys2AnFK2IGsrqo5rwmqVK29zV8Qd23l40zhbggh2x+MFClE8tbJwdaqcnnlTtc2r9/JM+0 tUvdKMax4RPYlkQm4WG+Ni25tnnF8474cyrDbiCrCTBbcbJ4kSYdh6Z9Agm1FwxKnxRmeT DKdD9uAZHxj8m1ZUEJCfr/pnXjPt921uTLhyjnEjs6Y5OD7TGARMp4DzCA3RSV9IjQT+Pe wZqEmxmE6W62uVDKzxhbsh7KjTgfC3XHHx01MHEZxY4l7hdOrYxxAh0jxfMaPw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Y4cqd5W5Nzm4R; Fri, 6 Dec 2024 16:57:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4B6Gv1nb055693; Fri, 6 Dec 2024 16:57:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4B6Gv1EA055690; Fri, 6 Dec 2024 16:57:01 GMT (envelope-from git) Date: Fri, 6 Dec 2024 16:57:01 GMT Message-Id: <202412061657.4B6Gv1EA055690@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: "Jason E. Hale" Subject: git: d1aaee3f16d3 - main - security/vuxml: Document gstreamer1-plugins* < 1.24.10 List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhale X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d1aaee3f16d38da210b3f2cba880804386ce32b4 Auto-Submitted: auto-generated The branch main has been updated by jhale: URL: https://cgit.FreeBSD.org/ports/commit/?id=d1aaee3f16d38da210b3f2cba880804386ce32b4 commit d1aaee3f16d38da210b3f2cba880804386ce32b4 Author: Jason E. Hale AuthorDate: 2024-12-06 16:49:34 +0000 Commit: Jason E. Hale CommitDate: 2024-12-06 16:56:56 +0000 security/vuxml: Document gstreamer1-plugins* < 1.24.10 --- security/vuxml/vuln/2024.xml | 257 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 257 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 64143e0bf797..8114c8efcc33 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,260 @@ + + gstreamer1-plugins-vorbis -- Stack buffer-overflow in Vorbis decoder + + + gstreamer1-plugins-vorbis + 1.24.10 + + + + +

The GStreamer Security Center reports:

+
+

Stack buffer-overflow in Vorbis decoder that can cause crashes for + certain input files.

+
+ + + + CVE-2024-47538 + https://gstreamer.freedesktop.org/security/sa-2024-0022.html + + + 2024-12-03 + 2024-12-06 + + + + + gstreamer1-plugins-opus -- Stack buffer-overflow in Opus decoder + + + gstreamer1-plugins-opus + 1.24.10 + + + + +

The GStreamer Security Center reports:

+
+

Stack buffer-overflow in Opus decoder that can cause crashes for + certain input files.

+
+ + + + CVE-2024-47607 + https://gstreamer.freedesktop.org/security/sa-2024-0024.html + + + 2024-12-03 + 2024-12-06 + + + + + gstreamer1-plugins-ogg -- Out-of-bounds write in Ogg demuxer + + + gstreamer1-plugins-ogg + 1.24.10 + + + + +

The GStreamer Security Center reports:

+
+

An out-of-bounds write in the Ogg demuxer that can cause crashes + for certain input files.

+
+ + + + CVE-2024-47615 + https://gstreamer.freedesktop.org/security/sa-2024-0026.html + + + 2024-12-03 + 2024-12-06 + + + + + gstreamer1-plugins-jpeg -- NULL-pointer dereferences in JPEG decoder + + + gstreamer1-plugins-jpeg + 1.24.10 + + + + +

The GStreamer Security Center reports:

+
+

Insufficient error handling in the JPEG decoder that can lead to + NULL-pointer dereferences, and that can cause crashes for certain + input files.

+
+ + + + CVE-2024-47599 + https://gstreamer.freedesktop.org/security/sa-2024-0016.html + + + 2024-12-03 + 2024-12-06 + + + + + gstreamer1-plugins-gdkpixbuf -- NULL-pointer dereference + + + gstreamer1-plugins-gdkpixbuf + 1.24.10 + + + + +

The GStreamer Security Center reports:

+
+

A NULL-pointer dereference in the gdk-pixbuf decoder that can + cause crashes for certain input files.

+
+ + + + CVE-2024-47613 + https://gstreamer.freedesktop.org/security/sa-2024-0025.html + + + 2024-12-03 + 2024-12-06 + + + + + gstreamer1-plugins-good -- multiple vulnerabilities + + + gstreamer1-plugins-good + 1.24.10 + + + + +

The GStreamer Security Center reports:

+
+

20 security bugs.

+
    +
  • CVE-2024-47537: Integer overflow in MP4/MOV sample table parser leading to out-of-bounds writes
    • +
  • CVE-2024-47598: MP4/MOV sample table parser out-of-bounds read
    • +
  • CVE-2024-47539: MP4/MOV Closed Caption handling out-of-bounds write
    • +
  • CVE-2024-47543: MP4/MOV demuxer out-of-bounds read
    • +
  • CVE-2024-47545: Integer overflow in MP4/MOV demuxer that can result in out-of-bounds read
    • +
  • CVE-2024-47544: NULL-pointer dereferences in MP4/MOV demuxer CENC handling
    • +
  • CVE-2024-47597: Out-of-bounds reads in MP4/MOV demuxer sample table parser
    • +
  • CVE-2024-47546: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads
    • +
  • CVE-2024-47606: Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes
    • +
  • CVE-2024-47596: Integer underflow in MP4/MOV demuxer that can lead to out-of-bounds reads
    • +
  • CVE-2024-47540: Usage of uninitialized stack memory in Matroska/WebM demuxer
    • +
  • CVE-2024-47602: NULL-pointer dereferences and out-of-bounds reads in Matroska/WebM demuxer
    • +
  • CVE-2024-47601: NULL-pointer dereference in Matroska/WebM demuxer
    • +
  • CVE-2024-47603: NULL-pointer dereference in Matroska/WebM demuxer
    • +
  • CVE-2024-47775: Out-of-bounds read in WAV parser
    • +
  • CVE-2024-47776: Out-of-bounds read in WAV parser
    • +
  • CVE-2024-47777: Out-of-bounds read in WAV parser
    • +
  • CVE-2024-47778: Out-of-bounds read in WAV parser
    • +
  • CVE-2024-47774: Integer overflow in AVI subtitle parser that leads to out-of-bounds reads
    • +
  • CVE-2024-47834: Use-after-free in Matroska demuxer
    • +
+
+ + + + CVE-2024-47537 + https://gstreamer.freedesktop.org/security/sa-2024-0005.html + CVE-2024-47598 + https://gstreamer.freedesktop.org/security/sa-2024-0006.html + CVE-2024-47539 + https://gstreamer.freedesktop.org/security/sa-2024-0007.html + CVE-2024-47543 + https://gstreamer.freedesktop.org/security/sa-2024-0009.html + CVE-2024-47545 + https://gstreamer.freedesktop.org/security/sa-2024-0010.html + CVE-2024-47544 + https://gstreamer.freedesktop.org/security/sa-2024-0011.html + CVE-2024-47597 + https://gstreamer.freedesktop.org/security/sa-2024-0012.html + CVE-2024-47546 + https://gstreamer.freedesktop.org/security/sa-2024-0013.html + CVE-2024-47606 + https://gstreamer.freedesktop.org/security/sa-2024-0014.html + CVE-2024-47596 + https://gstreamer.freedesktop.org/security/sa-2024-0015.html + CVE-2024-47540 + https://gstreamer.freedesktop.org/security/sa-2024-0017.html + CVE-2024-47602 + https://gstreamer.freedesktop.org/security/sa-2024-0019.html + CVE-2024-47601 + https://gstreamer.freedesktop.org/security/sa-2024-0020.html + CVE-2024-47603 + https://gstreamer.freedesktop.org/security/sa-2024-0021.html + CVE-2024-47775 + https://gstreamer.freedesktop.org/security/sa-2024-0027.html + CVE-2024-47776 + https://gstreamer.freedesktop.org/security/sa-2024-0027.html + CVE-2024-47777 + https://gstreamer.freedesktop.org/security/sa-2024-0027.html + CVE-2024-47778 + https://gstreamer.freedesktop.org/security/sa-2024-0027.html + CVE-2024-47835 + https://gstreamer.freedesktop.org/security/sa-2024-0028.html + CVE-2024-47834 + https://gstreamer.freedesktop.org/security/sa-2024-0030.html + + + 2024-12-03 + 2024-12-06 + + + + + gstreamer1-plugins -- multiple vulnerabilities + + + gstreamer1-plugins + 1.24.10 + + + + +

The GStreamer Security Center reports:

+
+

3 security bugs.

+
    +
  • CVE-2024-47542: ID3v2 parser out-of-bounds read and NULL-pointer dereference
    • +
  • CVE-2024-47600: Out-of-bounds read in gst-discoverer-1.0 commandline tool
    • +
  • CVE-2024-47541: Out-of-bounds write in SSA subtitle parser
    • +
+
+ + + + CVE-2024-47542 + https://gstreamer.freedesktop.org/security/sa-2024-0008.html + CVE-2024-47600 + https://gstreamer.freedesktop.org/security/sa-2024-0018.html + CVE-2024-47541 + https://gstreamer.freedesktop.org/security/sa-2024-0023.html + + + 2024-12-03 + 2024-12-06 + + + zabbix -- SQL injection in user.get API