mykola/opnsense-ports
1
0
Fork 0
forked from Lainports/opnsense-ports
Code Pull requests Activity

security/vuxml: sync with upstream

Browse source 
Taken from: HardenedBSD
This commit is contained in:
Franco Fichtner 2017-12-02 14:50:59 +01:00
parent 3f61c1c0d8
commit 905faf4bc8
1 changed files with 66 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
security/vuxml/vuln.xml
View file

@ -58,6 +58,72 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="a2589511-d6ba-11e7-88dd-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru_RU-wordpress</name>
<range><lt>4.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/">
<p>Use a properly generated hash for the newbloguser key instead of a determinate substring.</p>
<p>Add escaping to the language attributes used on html elements.</p>
<p>Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.</p>
<p>Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-01</entry>
</dates>
</vuln>
<vuln vid="e91cf90c-d6dd-11e7-9d10-001999f8d30b">
<topic>asterisk -- DOS Vulnerability in Asterisk chan_skinny</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If the chan_skinny (AKA SCCP protocol) channel driver
is flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests
of any kind.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-013.html</url>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2017-12-01</entry>
</dates>
</vuln>
<vuln vid="75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- remote DoS attack in BDAT processing</topic>
<affects>