sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-07-18 17:59:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Document textproc/freexl security vulnerabilities.

Browse source 
PR:		222130
Submitted by:	lbartoletti@tuxfamily.org (maintainer)
This commit is contained in:
Guido Falsi 2017-10-14 10:46:24 +00:00
parent d0d1bab2ed
commit 659c3fc16e
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=452053
1 changed files with 31 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
security/vuxml/vuln.xml
View file

@ -58,6 +58,37 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="555cd806-b031-11e7-a369-14dae9d59f67">
<topic>Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco TALOS reports:</p>
<blockquote cite="http://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430">
<p>An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
<blockquote cite="https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431">
<p>An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430</url>
<cvename>CVE-2017-2923</cvename>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431</url>
<cvename>CVE-2017-2924</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="ed73829d-af6d-11e7-a633-009c02a2ab30">
<topic>FFmpeg -- multiple vulnerabilities</topic>
<affects>