From nobody Wed Jun 12 02:27:44 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VzTwJ5JxJz5NVQJ; Wed, 12 Jun 2024 02:27:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4VzTwJ4kJbz3xZc; Wed, 12 Jun 2024 02:27:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1718159264; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6pKBSE5EMNp+ZRYhThtNOwtIRoM/o0Gwz3udBURBixs=; b=RInQOg7bUNjH1hRybhHueAlSlzuFFiIYCJSoTswbkfJ1SqPh8FUbgZ9RDbfAFMfmNDAXB0 1VEboGHvFf5iARvtfsTO+DwizRLenYxb3X4CykJFojRvN6Uv2I9tqVqiadF+J4hKhIjPzq wZhcsqfYUxn5/oXts1Oj1eOhsBv9zrLI1CKtbEjpd61pI6hUXsU9cVzy3SQHHuoYJDQpM+ +wJqsTHBzGPypOuCTvjt2yh3K8/J4lTlQvkPdVoOUrwgrjJXzEft3L92eeN6dkzKDiRlA+ jlxrYPhvtUoGkVVgcy8TRRKgaK3BvLe2c6dAsOkxjznKS3urY7ErWTecbxXS/Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1718159264; a=rsa-sha256; cv=none; b=suqtZxYPBZaW10kHthx8eIMW+z36ncnOCUiVcJYBzVBdb6FLKiZd3uK/t/W6oiqlxbkFzd joS89NiW6uUUPDVxP0EOXWvvBcjt8h7VM8eBTPMosqQJBsrcRIgKzmHeuLlazRqBRPaDrd jnv5uD5yLdK+PcAamp12jxiXPNvyiASa8BM+Y4n1wf93bHhrsb9zyvD40Qdx1BXlTmG0fK 2jD7g09M50fCoeR3OKoKGWFB+nSTWzLLH4PT0WCJZyvroPs/YiG24dOPtixpqgCc9SOHhA FGWbZIdaZ4nIP8aF9KUwkUh8bIqXBM4y55+a2ryo7lTwYg/HZ8FEbG7128e3Nw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1718159264; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6pKBSE5EMNp+ZRYhThtNOwtIRoM/o0Gwz3udBURBixs=; b=x+zYv0I+xCHP0V6IWqokYm2yBps4ziA6BfyKjWnScylVDAOgaqv3w725Y5lmg1aqx1w9oa WWhfhg/5iqGhOSouBSsjw0fOUFOZc5t1IpJMCY2Y0Cor7mwBd+LoSehr+ZjFq7wQXbpWlK BT/XJc4jzD75um7Zaey6Ujy1g8X6BsfYW48GoBpzij3HrJcOj7Dgz/86SE/0/vZzaFQEf2 6K2gOw3FhQXwVXN/4/evLHXK7nB0FDQoRjwXmA9DlRTVkSaLdOuYGF5sSvYJTDbfscP2M5 SeMDy7kXIDsmXTuM1Iqb9mNeK2wyo6UQkXHJTPagywYJa+NjfI7242WD5fNuhQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4VzTwJ4DSJzZv3; Wed, 12 Jun 2024 02:27:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 45C2Rih1094265; Wed, 12 Jun 2024 02:27:44 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 45C2RikL094262; Wed, 12 Jun 2024 02:27:44 GMT (envelope-from git) Date: Wed, 12 Jun 2024 02:27:44 GMT Message-Id: <202406120227.45C2RikL094262@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: "Jason E. Hale" Subject: git: 7dd32faead42 - main - security/vuxml: Document plasma[56]-plasma-workspace vuln List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhale X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7dd32faead42f30b3a5c3f7e600c840dd8a7b84e Auto-Submitted: auto-generated The branch main has been updated by jhale: URL: https://cgit.FreeBSD.org/ports/commit/?id=7dd32faead42f30b3a5c3f7e600c840dd8a7b84e commit 7dd32faead42f30b3a5c3f7e600c840dd8a7b84e Author: Jason E. Hale AuthorDate: 2024-06-11 21:36:15 +0000 Commit: Jason E. Hale CommitDate: 2024-06-12 02:27:36 +0000 security/vuxml: Document plasma[56]-plasma-workspace vuln --- security/vuxml/vuln/2024.xml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 13ed7aba8c18..3391ea929e0a 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,38 @@ + + plasma[56]-plasma-workspace -- Unauthorized users can access session manager + + + plasma5-plasma-workspace + 5.27.11.1 + + + plasma6-plasma-workspace + 6.0.4_2 + + + + +

David Edmundson reports:

+
+

KSmserver, KDE's XSMP manager, incorrectly allows connections via ICE + based purely on the host, allowing all local connections. This allows + another user on the same machine to gain access to the session + manager.

+

A well crafted client could use the session restore feature to execute + arbitrary code as the user on the next boot.

+
+ + + + CVE-2024-36041 + https://kde.org/info/security/advisory-20240531-1.txt + + + 2024-05-31 + 2024-06-11 + + + Composer -- Multiple command injections via malicious git/hg branch names