From d6bfd6ee75d007c7b441edab7bccbb3a92186502 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Thu, 6 Feb 2025 12:46:38 +0100 Subject: [PATCH] security/vuxml: sync with upstream Taken from: FreeBSD --- security/vuxml/vuln/2025.xml | 314 ++++++++++++++++++++++++++++++++++- 1 file changed, 312 insertions(+), 2 deletions(-) diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index f21059cf40c..09b12d17a4b 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,5 +1,304 @@ + + nginx-devel -- SSL session reuse vulnerability + + + nginx-devel + 1.27.4 + + + nginx + 1.26.3 + + + + +

The nginx development team reports:

+
+

This update fixes the SSL session reuse vulnerability.

+
+ + + + CVE-2025-23419 + + + 2025-02-05 + 2025-02-05 + + + + + qt6-webengine -- Multiple vulnerabilities + + + qt6-webengine + 6.8.2 + + + + +

Qt qtwebengine-chromium repo reports:

+
+

Backports for 9 security bugs in Chromium:

+
    +
  • CVE-2024-12693: Out of bounds memory access in V8
    • +
  • CVE-2024-12694: Use after free in Compositing
    • +
  • CVE-2025-0436: Integer overflow in Skia
    • +
  • CVE-2025-0437: Out of bounds read in Metrics
    • +
  • CVE-2025-0438: Stack buffer overflow in Tracing
    • +
  • CVE-2025-0441: Inappropriate implementation in Fenced Frames
    • +
  • CVE-2025-0443: Insufficient data validation in Extensions
    • +
  • CVE-2025-0447: Inappropriate implementation in Navigation
    • +
  • CVE-2025-0611: Object corruption in V8
    • +
+
+ + + + CVE-2024-12693 + CVE-2024-12694 + CVE-2025-0436 + CVE-2025-0437 + CVE-2025-0438 + CVE-2025-0441 + CVE-2025-0443 + CVE-2025-0447 + CVE-2025-0611 + https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=122-based + + + 2025-01-09 + 2025-02-02 + + + + + chromium -- multiple security fixes + + + chromium + 132.0.6834.159 + + + ungoogled-chromium + 132.0.6834.159 + + + + +

Chrome Releases reports:

+
+

This update includes 2 security fixes:

+
    +
  • [384844003] Medium CVE-2025-0762: Use after free in DevTools. Reported by Sakana.S on 2024-12-18
    • +
+
+ + + + CVE-2025-0762 + https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_28.html + + + 2025-01-18 + 2025-01-31 + + + + + dendrite -- Server-side request forgery vulnerability + + + dendrite + 0.14.1 + + + + +

Dendrite team reports:

+
+

This is a security release, gomatrixserverlib was vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions.

+
+ + + + CVE-2024-52594 + https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822 + + + 2025-01-16 + 2025-01-30 + + + + + FreeBSD -- Uninitialized kernel memory disclosure via ktrace(2) + + + FreeBSD-kernel + 14.214.2_1 + + + + +

Problem Description:

+

In some cases, the ktrace facility will log the contents of + kernel structures to userspace. In one such case, ktrace dumps a + variable-sized sockaddr to userspace. There, the full sockaddr is + copied, even when it is shorter than the full size. This can result + in up to 14 uninitialized bytes of kernel memory being copied out + to userspace.

+

Impact:

+

It is possible for an unprivileged userspace program to leak + 14 bytes of a kernel heap allocation to userspace.

+ + + + CVE-2025-0662 + SA-25:04.ktrace + + + 2025-01-29 + 2025-01-30 + + + + + FreeBSD -- Unprivileged access to system files + + + FreeBSD + 14.214.2_1 + 14.114.1_7 + 13.413.4_3 + + + + +

Problem Description:

+

When etcupdate encounters conflicts while merging files, it + saves a version containing conflict markers in /var/db/etcupdate/conflicts. + This version does not preserve the mode of the input file, and is + world-readable. This applies to files that would normally have + restricted visibility, such as /etc/master.passwd.

+

Impact:

+

An unprivileged local user may be able to read encrypted root + and user passwords from the temporary master.passwd file created + in /var/db/etcupdate/conflicts. This is possible only when conflicts + within the password file arise during an update, and the unprotected + file is deleted when conflicts are resolved.

+ + + + CVE-2025-0374 + SA-25:03.etcupdate + + + 2025-01-29 + 2025-01-30 + + + + + FreeBSD -- Buffer overflow in some filesystems via NFS + + + FreeBSD-kernel + 14.214.2_1 + 14.114.1_7 + 13.413.4_3 + + + + +

Problem Description:

+

In order to export a file system via NFS, the file system must + define a file system identifier (FID) for all exported files. Each + FreeBSD file system implements operations to translate between FIDs + and vnodes, the kernel's in-memory representation of files. These + operations are VOP_VPTOFH(9) and VFS_FHTOVP(9).

+

On 64-bit systems, the implementation of VOP_VPTOFH() in the + cd9660, tarfs and ext2fs filesystems overflows the destination FID + buffer by 4 bytes, a stack buffer overflow.

+

Impact:

+

A NFS server that exports a cd9660, tarfs, or ext2fs file system + can be made to panic by mounting and accessing the export with an + NFS client. Further exploitation (e.g., bypassing file permission + checking or remote kernel code execution) is potentially possible, + though this has not been demonstrated. In particular, release + kernels are compiled with stack protection enabled, and some instances + of the overflow are caught by this mechanism, causing a panic.

+ + + + CVE-2025-0373 + SA-25:02.fs + + + 2025-01-29 + 2025-01-30 + + + + + FreeBSD -- OpenSSH Keystroke Obfuscation Bypass + + + FreeBSD + 14.114.1_7 + + + + +

Problem Description:

+

A logic error in the ssh(1) ObscureKeystrokeTiming feature (on + by default) rendered this feature ineffective.

+

Impact:

+

A passive observer could detect which network packets contain + real keystrokes, and infer the specific characters being transmitted + from packet timing.

+ + + + CVE-2024-39894 + SA-25:01.openssh + + + 2025-01-29 + 2025-01-30 + + + + + oauth2-proxy -- Non-linear parsing of case-insensitive content + + + oauth2-proxy + 7.8.0 + + + + +

Golang reports:

+
+

This update include security fixes:

+
    +
  • CVE-2024-45338: Non-linear parsing of case-insensitive content
    • +
+
+ + + + CVE-2024-45338 + + + 2025-01-14 + 2025-01-30 + + + - Vaultwarden -- Muiltiple vulnerabilities + Vaultwarden -- Multiple vulnerabilities vaultwarden @@ -17,7 +316,10 @@ - https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0 + CVE-2025-24364 + https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797 + CVE-2025-24365 + https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h6cc-rc6q-23j4 2025-01-25 @@ -578,6 +880,10 @@ redis72 7.2.7 + + redis-devel + 7.4.2.20250201 + valkey 8.0.2 @@ -621,6 +927,10 @@ redis62 6.2.17 + + redis-devel + 7.4.2.20250201 + valkey 8.0.2