FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
3563fae5-f60c-11e8-b513-5404a68ad561uriparser -- Multiple vulnerabilities

The upstream project reports:

* Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx* Commit 864f5d4c127def386dd5cc926ad96934b297f04e Thanks to Google Autofuzz team for the report!

* Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx* Commit f76275d4a91b28d687250525d3a0c5509bbd666f Thanks to Google Autofuzz team for the report!

* Fixed: Protect uriResetUri* against acting on NULL input Commit f58c25069cf4a986fe17a80c5b38687e31feb539


Discovery 2018-10-27
Entry 2018-12-02
uriparser
< 0.9.0

CVE-2018-19198
CVE-2018-19199
CVE-2018-19200
https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog
924bd4f8-11e7-11e9-9fe8-5404a68ad561uriparser -- Out-of-bounds read

Upstream project reports:

Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6 addresses with embedded IPv4 address, e.g. "//[::44.1"; mitigated if passed parameter afterLast points to readable memory containing a '\0' byte.


Discovery 2019-01-02
Entry 2019-01-06
uriparser
< 0.9.1

https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog
b927b654-7146-11ec-ad4b-5404a68ad561uriparser -- Multiple vulnerabilities

Upstream project reports:

Fix a bug affecting both uriNormalizeSyntax* and uriMakeOwner* functions where the text range in .hostText would not be duped using malloc but remain unchanged (and hence "not owned") for URIs with an IPv4 or IPv6 address hostname; depending on how an application uses uriparser, this could lead the application into a use-after-free situation. As the second half, fix uriFreeUriMembers* functions that would not free .hostText memory for URIs with an IPv4 or IPv6 address host; also, calling uriFreeUriMembers* multiple times on a URI of this very nature would result in trying to free pointers to stack (rather than heap) memory. Fix functions uriNormalizeSyntax* for out-of-memory situations (i.e. malloc returning NULL) for URIs containing empty segments (any of user info, host text, query, or fragment) where previously pointers to stack (rather than heap) memory were freed.


Discovery 2022-01-06
Entry 2022-01-09
uriparser
< 0.9.6

CVE-2021-46141
CVE-2021-46142
https://github.com/uriparser/uriparser/blob/uriparser-0.9.6/ChangeLog