sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-04-28 01:26:39 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security/vuxml: document unit* vulnerabilities

Browse source
This commit is contained in:
Sergey A. Osokin 2025-03-03 13:21:59 -05:00
parent ada34eb197
commit 21c77e23be
1 changed files with 36 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
security/vuxml/vuln/2025.xml
View file

@ -1,3 +1,39 @@
<vuln vid="6af5e3a3-f85a-11ef-95b9-589cfc10a551">
<topic>unit -- potential security issue</topic>
<affects>
<package>
<name>unit</name>
<name>unit-java</name>
<range><ge>1.11.0</ge><lt>1.34.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://mailman.nginx.org/pipermail/unit/2025-March/QVYLJKLBIDWOJ7OLYGT27VUWH7RGBRQM.html">
<p>Unit 1.34.2 fixes two issues in the Java language module websocket code.</p>
<ol>
<li>It addresses a potential security issue where we could get a negative
payload length that could cause the Java language module process(es) to
enter an infinite loop and consume excess CPU. This was a bug carried
over from the initial Java websocket code import. It has been re-issued
a CVE number (CVE-2025-1695).</li>
<li>It addresses an issue whereby decoded payload lengths would be limited
to 32 bits.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2025-1695</cvename>
<url>https://mailman.nginx.org/pipermail/unit/2025-March/QVYLJKLBIDWOJ7OLYGT27VUWH7RGBRQM.html</url>
</references>
<dates>
<discovery>2025-03-03</discovery>
<entry>2025-03-03</entry>
</dates>
</vuln>
<vuln vid="398d1ec1-f7e6-11ef-bb15-002590af0794">
<topic>vim -- Potential code execution</topic>
<affects>