diff options
| author | Xin LI <delphij@FreeBSD.org> | 2007-10-01 21:04:45 +0000 |
|---|---|---|
| committer | Xin LI <delphij@FreeBSD.org> | 2007-10-01 21:04:45 +0000 |
| commit | c28f02d4c52c68a9756fd2d78e5f6af816461aea (patch) | |
| tree | e1780c2abe1c9b5b7903598f9cc07bae001212ed /security/vuxml/vuln.xml | |
| parent | 63b375a206ee37cc1044033d4e418cc9e45b0a29 (diff) | |
| download | ports-c28f02d4c52c68a9756fd2d78e5f6af816461aea.tar.gz ports-c28f02d4c52c68a9756fd2d78e5f6af816461aea.zip | |
Notes
Diffstat (limited to 'security/vuxml/vuln.xml')
| -rw-r--r-- | security/vuxml/vuln.xml | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 0103d73c5120..ff441bb36e6a 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,35 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="15ec9123-7061-11dc-b372-001921ab2fa4"> + <topic>id3lib -- insecure temporary file creation</topic> + <affects> + <package> + <name>id3lib</name> + <range><gt>0</gt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Debian Bug report log reports:</p> + <blockquote cite="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=438540"> + <p>When tagging file $foo, a temporary copy of the file is + created, and for some reason, libid3 doesn't use mkstemp + but just creates $foo.XXXXXX literally, without any checking.</p> + <p>This would silently truncate and overwrite an existing $foo.XXXXXX.</p> + </blockquote> + </body> + </description> + <references> + <bid>25372</bid> + <cvename>CVE-2007-4460</cvename> + </references> + <dates> + <discovery>2007-08-20</discovery> + <entry>2007-10-01</entry> + </dates> + </vuln> + <vuln vid="c9c14242-6843-11dc-82b6-02e0185f8d72"> <topic>mediawiki -- cross site scripting vulnerability</topic> <affects> |