git: ea46c60b62e1 - main - security/vuxml: Document x11/cde local privilege escalation

Mon Aug 9 20:15:54 UTC 2021

The branch main has been updated by cy:

URL: https://cgit.FreeBSD.org/ports/commit/?id=ea46c60b62e15e7370387bcb7b472905a269a566

commit ea46c60b62e15e7370387bcb7b472905a269a566
Author:     Cy Schubert <cy at FreeBSD.org>
AuthorDate: 2021-08-09 18:15:59 +0000
Commit:     Cy Schubert <cy at FreeBSD.org>
CommitDate: 2021-08-09 20:15:04 +0000

    security/vuxml: Document x11/cde local privilege escalation
    
    Security:       CVE-2020-2696, VU#308289
---
 security/vuxml/vuln-2021.xml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml
index 284a47041149..165f010a6519 100644
--- a/security/vuxml/vuln-2021.xml
+++ b/security/vuxml/vuln-2021.xml
@@ -1,3 +1,34 @@
+  <vuln vid="848bdd06-f93a-11eb-9f7d-206a8a720317">
+    <topic>x11/cde -- Local privilege escalation via CDE dtsession</topic>
+    <affects>
+      <package>
+	<name>cde</name>
+	<range><lt>2.4.0</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Marco Ivaldi (marco.ivaldi () mediaservice net) reports:</p>
+	<blockquote cite="https://seclists.org/bugtraq/2020/Jan/22">
+	  <p>A buffer overflow in the CheckMonitor() function in the Common
+	  Desktop Environment 2.3.1 and earlier and 1.6 and earlier,
+	  as distributed with Oracle Solaris 10 1/13 (Update 11) and
+	  earlier, allows local users to gain root privileges via a long
+	  palette name passed to dtsession in a malicious .Xdefaults
+	  file.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2020-2696</cvename>
+      <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2696</url>
+    </references>
+    <dates>
+      <discovery>2020-01-15</discovery>
+      <entry>2021-08-09</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="880552c4-f63f-11eb-9d56-7186043316e9">
     <topic>go -- net/http: panic due to racy read of persistConn after handler panic</topic>
     <affects>
