|
Lines 58-63
Link Here
|
| 58 |
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.) |
58 |
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.) |
| 59 |
--> |
59 |
--> |
| 60 |
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> |
60 |
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> |
|
|
61 |
<vuln vid="3ee6e521-0d32-11e8-99b0-d017c2987f9a"> |
| 62 |
<topic>mpv -- arbitrary code execution via crafted website</topic> |
| 63 |
<affects> |
| 64 |
<package> |
| 65 |
<name>mpv</name> |
| 66 |
<range><le>0.28.0</le></range> |
| 67 |
</package> |
| 68 |
</affects> |
| 69 |
<description> |
| 70 |
<body xmlns="http://www.w3.org/1999/xhtml"> |
| 71 |
<p>mpv developers report:</p> |
| 72 |
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6360"> |
| 73 |
<p>mpv through 0.28.0 allows remote attackers to execute arbitrary code |
| 74 |
via a crafted web site, because it reads HTML documents containing |
| 75 |
VIDEO elements, and accepts arbitrary URLs in a src attribute without |
| 76 |
a protocol whitelist in player/lua/ytdl_hook.lua. For example, an |
| 77 |
av://lavfi:ladspa=file= URL signifies that the product should call |
| 78 |
dlopen on a shared object file located at an arbitrary local pathname. |
| 79 |
The issue exists because the product does not consider that youtube-dl |
| 80 |
can provide a potentially unsafe URL.</p> |
| 81 |
</blockquote> |
| 82 |
</body> |
| 83 |
</description> |
| 84 |
<references> |
| 85 |
<url>https://github.com/mpv-player/mpv/issues/5456</url> |
| 86 |
<cvename>CVE-2018-6360</cvename> |
| 87 |
</references> |
| 88 |
<dates> |
| 89 |
<discovery>2018-01-28</discovery> |
| 90 |
<entry>2018-02-09</entry> |
| 91 |
</dates> |
| 92 |
</vuln> |
| 93 |
|
| 61 |
<vuln vid="3d0eeef8-0cf9-11e8-99b0-d017c2987f9a"> |
94 |
<vuln vid="3d0eeef8-0cf9-11e8-99b0-d017c2987f9a"> |
| 62 |
<topic>Mailman -- Cross-site scripting (XSS) vulnerability in the web UI</topic> |
95 |
<topic>Mailman -- Cross-site scripting (XSS) vulnerability in the web UI</topic> |
| 63 |
<affects> |
96 |
<affects> |