svn commit: r492723 - head/security/vuxml
Sunpoet Po-Chuan Hsieh
sunpoet at FreeBSD.org
Mon Feb 11 18:59:53 UTC 2019
Author: sunpoet
Date: Mon Feb 11 18:59:48 2019
New Revision: 492723
URL: https://svnweb.freebsd.org/changeset/ports/492723
Log:
Update openjpeg status
There were 5 vulnerabilities in openjpeg and 4 of them are fixed.
The current status is described in [1] as follows:
- CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.
- CVE-2018-5785 was fixed in r480624.
- CVE-2018-6616 was fixed in r489415.
- CVE-2018-5727 is not fixed yet.
Though I keep committing fixes and updating the status, it does not show in the
"pkg audit" result. Users have to follow the link but apparently few people
would do that. Therefore, I got mails asking if the CVEs are fixed, etc.
I don't know if there's a better way to handle this condition (partly fixed over
several months). Instead of removing fixed CVEs from vuln.xml, I decided to add
a new entry (5efd7a93-2dfb-11e9-9549-e980e869c2e9) which is split from the old
entry (11dc3890-0e64-11e8-99b0-d017c2987f9a). It should be clearer for users if
they only read the "pkg audit" result.
[1] https://www.vuxml.org/freebsd/11dc3890-0e64-11e8-99b0-d017c2987f9a.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Mon Feb 11 18:59:42 2019 (r492722)
+++ head/security/vuxml/vuln.xml Mon Feb 11 18:59:48 2019 (r492723)
@@ -58,6 +58,36 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="5efd7a93-2dfb-11e9-9549-e980e869c2e9">
+ <topic>OpenJPEG -- integer overflow</topic>
+ <affects>
+ <package>
+ <name>openjpeg</name>
+ <range><le>2.3.0_3</le></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>SO-AND-SO reports:</p>
+ <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5727">
+ <p>In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the
+ opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could
+ leverage this vulnerability to cause a denial of service via a crafted
+ bmp file.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2018-5727</url>
+ <url>https://github.com/uclouvain/openjpeg/issues/1053</url>
+ <cvename>CVE-2018-5727</cvename>
+ </references>
+ <dates>
+ <discovery>2017-12-08</discovery>
+ <entry>2019-02-11</entry>
+ </dates>
+ </vuln>
+
<vuln vid="86c89abf-2d91-11e9-bf3e-a4badb2f4699">
<topic>FreeBSD -- File description reference count leak</topic>
<affects>
@@ -6429,39 +6459,36 @@ a PingInterval period.</p>
<affects>
<package>
<name>openjpeg</name>
- <range><le>2.3.0_3</le></range>
+ <range><lt>2.3.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenJPEG reports:</p>
- <blockquote cite="https://github.com/uclouvain/openjpeg/issues?q=is%3Aissue+CVE-2018-5727+OR+CVE-2018-5785+OR+CVE-2018-6616">
+ <blockquote cite="https://github.com/uclouvain/openjpeg/issues?q=is%3Aissue+CVE-2017-17479+OR+CVE-2017-17480+OR+CVE-2018-5785+OR+CVE-2018-6616">
<p>Multiple vulnerabilities have been found in OpenJPEG, the
opensource JPEG 2000 codec. Please consult the CVE list for further
details.</p>
<p>CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.</p>
<p>CVE-2018-5785 was fixed in r480624.</p>
<p>CVE-2018-6616 was fixed in r489415.</p>
- <p>CVE-2018-5727 is not fixed yet.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17479</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17480</url>
- <url>https://nvd.nist.gov/vuln/detail/CVE-2018-5727</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5785</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-6616</url>
<cvename>CVE-2017-17479</cvename>
<cvename>CVE-2017-17480</cvename>
- <cvename>CVE-2018-5727</cvename>
<cvename>CVE-2018-5785</cvename>
<cvename>CVE-2018-6616</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2018-07-27</entry>
- <modified>2019-01-05</modified>
+ <modified>2019-02-11</modified>
</dates>
</vuln>
More information about the svn-ports-all
mailing list