Attachment 188389 Details for Bug 223962 – Document vulnerability in curl

[patch] Document vulnerability in curl

vuxml.patch (text/plain), 1.56 KB, created by VK on 2017-11-29 10:48:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: VK

Created: 2017-11-29 10:48:36 UTC

Size: 1.56 KB

patch

obsolete

>Index: security/vuxml/vuln.xml
>===================================================================
>--- security/vuxml/vuln.xml	(revision 455099)
>+++ security/vuxml/vuln.xml	(working copy)
>@@ -58,6 +58,39 @@
> * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="5e1d8d78-d4ef-11e7-a633-009c02a2ab30">
>+ <topic>curl -- multiple vulnerabilities</topic>
>+ <affects>
>+ <package>
>+	<name>curl</name>
>+	<range><ge>7.21.0</ge><le>7.56.1</le></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	curl developers report:
>+	<blockquote cite="https://curl.haxx.se/docs/security.html">
>+	 CVE-2017-8816: NTLM buffer overflow via integer overflow.
>+	 CVE-2017-8817: FTP wildcard out of bounds read.
>+	 CVE-2017-8818: SSL out of buffer access.
>+	 Please refer to the CVE list for details.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+	<url>https://curl.haxx.se/docs/adv_2017-12e7.html</url>
>+	<url>https://curl.haxx.se/docs/adv_2017-ae72.html</url>
>+	<url>https://curl.haxx.se/docs/adv_2017-af0a.html</url>
>+	<cvename>CVE-2017-8816</cvename>
>+	<cvename>CVE-2017-8817</cvename>
>+	<cvename>CVE-2017-8818</cvename>
>+ </references>
>+ <dates>
>+ <discovery>2017-11-29</discovery>
>+ <entry>2017-11-29</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="0d369972-d4ba-11e7-bfca-005056925db4">
> <topic>borgbackup -- remote users can override repository restrictions</topic>
> <affects>

Actions: View | Diff

Attachments on bug 223962: 188389