diff options
| author | Kurt Jaeger <pi@FreeBSD.org> | 2023-10-04 18:39:36 +0000 |
|---|---|---|
| committer | Kurt Jaeger <pi@FreeBSD.org> | 2023-10-04 18:40:54 +0000 |
| commit | 3c178fb0a6bb19511eaa55e27e2c5018ab1fd216 (patch) | |
| tree | 88b063ec201c526c65495329c6fd263ad20f7d2f | |
| parent | 30f95474c0b3d27a8549d948813d8e6e327be601 (diff) | |
| download | ports-3c178fb0a6bb19511eaa55e27e2c5018ab1fd216.tar.gz ports-3c178fb0a6bb19511eaa55e27e2c5018ab1fd216.zip | |
security/vuxml: add entry for recent libspf2 CVE-2023-42118
PR: 274215
| -rw-r--r-- | security/vuxml/vuln/2023.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 3b38d51b8144..0d5609c3614a 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,35 @@ + <vuln vid="915855ad-283d-4597-b01e-e0bf611db78b"> + <topic>libspf2 -- Integer Underflow Remote Code Execution</topic> + <affects> + <package> + <name>libspf2</name> + <range><le>1.2.11</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Trendmicro ZDI reports:</p> + <blockquote cite="https://www.zerodayinitiative.com/advisories/ZDI-23-1472/"> + <p>Integer Underflow Remote Code Execution Vulnerability</p> + <p>The specific flaw exists within the parsing of SPF macros. + When parsing SPF macros, the process does not properly + validate user-supplied data, which can result in an integer + underflow before writing to memory. An attacker can leverage + this vulnerability to execute code in the context of the + service account.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2023-42118</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42118</url> + </references> + <dates> + <discovery>2022-06-06</discovery> + <entry>2023-10-04</entry> + </dates> + </vuln> + <vuln vid="4e45c45b-629e-11ee-8290-a8a1599412c6"> <topic>chromium -- type confusion in v8</topic> <affects> |