FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-01-31 07:40:04 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28	glibc -- getaddrinfo stack-based buffer overflow Fabio Olive Leite reports: A stack-based buffer overflow was found in libresolv when invoked from nss_dns, allowing specially crafted DNS responses to seize control of EIP in the DNS client. The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or AF_INET6 in some cases) triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by __res_nquery. Discovery 2016-02-16 Entry 2016-02-18 linux_base-c6 linux_base-c6_64 < 6.7_1 linux_base-f10 >= 0 CVE-2015-7547 ports/207272 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547 https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/ https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html

VuXML ID

Description

2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28

glibc -- getaddrinfo stack-based buffer overflow

Fabio Olive Leite reports:

A stack-based buffer overflow was found in libresolv when invoked from nss_dns, allowing specially crafted DNS responses to seize control of EIP in the DNS client. The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or AF_INET6 in some cases) triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by __res_nquery.

Discovery 2016-02-16
Entry 2016-02-18
linux_base-c6
linux_base-c6_64

< 6.7_1

linux_base-f10

>= 0

CVE-2015-7547
ports/207272
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547
https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/
https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html