Index: vuln.xml =================================================================== --- vuln.xml (revision 443944) +++ vuln.xml (working copy) @@ -58,6 +58,41 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + Dropbear -- two vulnerabilities + + + dropbear + 2017.75 + + + + +

Matt Johnston reports:

+
Fix double-free in server TCP listener cleanup A double-free in + the server could be triggered by an authenticated user if dropbear + is running with -a (Allow connections to forwarded ports from any + host) This could potentially allow arbitrary code execution as root + by an authenticated user.
+
Fix information disclosure with ~/.ssh/authorized_keys symlink. + Dropbear parsed authorized_keys as root, even if it were a symlink. + The fix is to switch to user permissions when opening authorized_keys. +
+

+ + + + https://matt.ucc.asn.au/dropbear/CHANGES + CVE-2017-9078 + CVE-2017-9079 + + + 2017-05-18 + 2017-06-20 + + + Apache httpd -- several vulnerabilities