From 905faf4bc81dfe42b0129efc8ef2003d7024aabf Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Sat, 2 Dec 2017 14:50:59 +0100 Subject: [PATCH] security/vuxml: sync with upstream Taken from: HardenedBSD --- security/vuxml/vuln.xml | 66 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 9e794bb7a81..9af22c88af8 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,72 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + wordpress -- multiple issues + + + wordpress + fr-wordpress + 4.9.1,1 + + + de-wordpress + zh_CN-wordpress + zh_TW-wordpress + ja-wordpress + ru_RU-wordpress + 4.9.1 + + + + +

wordpress developers reports:

+
+

Use a properly generated hash for the newbloguser key instead of a determinate substring.

+

Add escaping to the language attributes used on html elements.

+

Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.

+

Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.

+
+ + + + https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/ + + + 2017-11-29 + 2017-12-01 + + + + + asterisk -- DOS Vulnerability in Asterisk chan_skinny + + + asterisk13 + 13.18.3 + + + + +

The Asterisk project reports:

+
+

If the chan_skinny (AKA SCCP protocol) channel driver + is flooded with certain requests it can cause the asterisk + process to use excessive amounts of virtual memory + eventually causing asterisk to stop processing requests + of any kind.

+
+ + + + https://downloads.asterisk.org/pub/security/AST-2017-013.html + + + 2017-11-30 + 2017-12-01 + + + exim -- remote DoS attack in BDAT processing