Bug 212380 - security/vuxml: Multiple security vulnerabilities in net/libvncserver
Summary: security/vuxml: Multiple security vulnerabilities in net/libvncserver
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Mark Felder
URL: http://seclists.org/oss-sec/2014/q3/639
Keywords: patch, security
Depends on:
Blocks:
 
Reported: 2016-09-05 00:00 UTC by Sevan Janiyan
Modified: 2016-10-12 01:23 UTC (History)
3 users (show)

See Also:

Attachments
Add multiple vulns entry for libvncserver (1.73 KB, patch)
2016-10-07 11:32 UTC, VK 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sevan Janiyan 2016-09-05 00:00:58 UTC 
CVE-2014-6054 - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6054
Comment 1 VK 2016-10-07 11:32:12 UTC 
Created attachment 175489 [details]
Add multiple vulns entry for libvncserver

It looks to me these issues have been fixed for 0.9.8 and 0.9.9, but I can't get a clear confirmation on that looking at the github commits. We have just recently bumped libvncserver to 0.9.10 (2016-06-24, revision 417416), that version is in the head and 2016-Q4, so I'm marking the vuln for libvncserver < 0.9.10.

Someone please check if I'm wrong.
Comment 2 VK 2016-10-07 11:39:06 UTC 
Quick note, I was looking at the wrong commits (debian backports to 0.9.9), so these issues have been reported a month before 0.9.10 was tagged back in 2014. It is also possible not all of them have been fixed for 0.9.10.
Comment 3 Mark Felder freebsd_committer freebsd_triage 2016-10-12 01:22:17 UTC 
Committed, thanks!
Comment 4 commit-hook freebsd_committer freebsd_triage 2016-10-12 01:22:50 UTC 
A commit references this bug:

Author: feld
Date: Wed Oct 12 01:22:05 UTC 2016
New revision: 423815
URL: https://svnweb.freebsd.org/changeset/ports/423815

Log:
  Document libvncserver vulnerabilities

  PR:		212380
  Security:	CVE-2014-6051
  Security:	CVE-2014-6052
  Security:	CVE-2014-6053
  Security:	CVE-2014-6054
  Security:	CVE-2014-6055

Changes:
  head/security/vuxml/vuln.xml