Bug 201105 - games/wesnoth: [security] Wesnoth authentication information disclosure (CVE-2015-5069,CVE-2015-5070)
Summary: games/wesnoth: [security] Wesnoth authentication information disclosure (CVE-...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Xin LI
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-25 12:58 UTC by Jason Unovitch
Modified: 2015-07-01 00:10 UTC (History)
3 users (show)

See Also:
ports: maintainer-feedback+

Attachments
security/vuxml entry for wesnoth CVE-2015-5069,CVE-2015-5070 (2.12 KB, patch)
2015-06-30 02:16 UTC, Jason Unovitch 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jason Unovitch freebsd_committer freebsd_triage 2015-06-25 12:58:33 UTC 
See thread:  http://openwall.com/lists/oss-security/2015/06/25/12
Comment 1 Torsten Zühlsdorff 2015-06-29 08:31:45 UTC 
Please note that new version 1.12.4 (and not 1.12.3 like in the link described) fixes the security-issue.
Comment 2 Jason Unovitch freebsd_committer freebsd_triage 2015-06-30 02:16:28 UTC 
Created attachment 158174 [details]
security/vuxml entry for wesnoth CVE-2015-5069,CVE-2015-5070

# make validate
/bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy"
>>> Validating...
/usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml
>>> Successful.
Checking if tidy differs...
... seems okay
Checking for space/tab...
... seems okay
/usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml

# env PKG_DBDIR=/usr/ports/security/vuxml pkg audit wesnoth-1.12.4,1
0 problem(s) in the installed packages found.

# env PKG_DBDIR=/usr/ports/security/vuxml pkg audit wesnoth-1.12.2,1
wesnoth-1.12.2,1 is vulnerable:
wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension
CVE: CVE-2015-5070
CVE: CVE-2015-5069
WWW: https://vuxml.FreeBSD.org/freebsd/2a8b7d21-1ecc-11e5-a4a5-002590263bf5.html

1 problem(s) in the installed packages found.
Comment 3 Jason Unovitch freebsd_committer freebsd_triage 2015-06-30 02:17:46 UTC 
This PR depends on maintainer update for wesnoth-1.12.4,1 in bug 201192.
Comment 4 Xin LI freebsd_committer freebsd_triage 2015-07-01 00:10:06 UTC 
Committed, thanks!
Comment 5 commit-hook freebsd_committer freebsd_triage 2015-07-01 00:10:09 UTC 
A commit references this bug:

Author: delphij
Date: Wed Jul  1 00:09:33 UTC 2015
New revision: 391017
URL: https://svnweb.freebsd.org/changeset/ports/391017

Log:
  Document games/wesnoth authentication information disclosure vulnerability.

  PR:		201105
  Submitted by:	Jason Unovitch

Changes:
  head/security/vuxml/vuln.xml