Index: vuln.xml =================================================================== RCS file: /home/pcvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.2141 diff -u -r1.2141 vuln.xml --- vuln.xml 19 Apr 2010 07:13:42 -0000 1.2141 +++ vuln.xml 19 Apr 2010 10:32:26 -0000 @@ -34,6 +34,117 @@ --> + + curl -- libcurl buffer overflow vulnerability + + + curl + + 7.10.5 + 7.20.0 + + + + + +

The cURL project reports in a security advisory:

+
+

Using the affected libcurl version to download compressed + content over HTTP, an application can ask libcurl to + automatically uncompress data. When doing so, libcurl + can wrongly send data up to 64K in size to the callback + which thus is much larger than the documented maximum + size.

+

An application that blindly trusts libcurl's max limit + for a fixed buffer size or similar is then a possible + target for a buffer overflow vulnerability.

+
+ + + + CVE-2010-0734 + http://curl.haxx.se/docs/adv_20100209.html + http://www.debian.org/security/2010/dsa-2023 + http://www.openwall.com/lists/oss-security/2010/02/09/5 + + + 2010-02-09 + 2010-04-19 + + + + + ejabberd -- queue overload denial of service vulnerability + + + ejabberd + 2.1.3 + + + + +

The Red Hat security response team reports:

+
+

A remotely exploitable DoS from XMPP client to ejabberd + server via too many "client2server" messages (causing the + message queue on the server to get overloaded, leading + to server crash) has been found.

+
+ + + + 38003 + CVE-2010-0305 + http://secunia.com/advisories/38337 + http://support.process-one.net/browse/EJAB-1173 + http://www.openwall.com/lists/oss-security/2010/01/29/1 + http://xforce.iss.net/xforce/xfdb/56025 + + + 2010-01-29 + 2010-04-19 + + + + + irssi -- multiple vulnerabilities + + + irssi + 0.8.15 + + + zh-irssi + 0.8.15 + + + irssi-devel + 20100325 + + + + +

Two vulnerabilities have found in irssi. The first issue can allow + man-in-the-middle attacks due to a missing comparison of + SSL server hostnames and the certificate domain names + (e.g. CN).

+

A second vulnerability, related to nick matching code, + can be triggered by remote attackers in order to crash + an irsii client upon leaving a channel.

+ + + + CVE-2010-1155 + CVE-2010-1156 + http://xforce.iss.net/xforce/xfdb/57790 + http://xforce.iss.net/xforce/xfdb/57791 + + + 2010-04-16 + 2010-04-19 + + + krb5 -- remote denial of service vulnerability