8644 2015-11-04 17:01:37 +0000 Multiple CVEs on 2.0 release 2016-02-18 16:05:16 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 2.0 x86 Multiple RESOLVED FIXED Medium normal 2.0.1 1 stanciux.mihail akuster meta.mr.watcher meta.watcher stanciux.mihail --- New (Never tested) Don't know oldest_to_newest 56204 0 stanciux.mihail 2015-11-04 17:01:37 +0000 Apologies if classification isn't proper, I wasn't sure where this should go. While looking into automating a CVE check tool to be run on our QA infrastructure found the following CVEs present in the project: readline 6.3 (0 patched, 1 issues) ------------ * CVE-2014-2524 : The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file. busybox 1.15.1 (0 patched, 2 issues) ------------ * CVE-2011-2716 : The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options. * CVE-2013-1813 : util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors. expat 2.1.0 (0 patched, 1 issues) ------------ * CVE-2013-0340 : expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. 56244 1 akuster 2015-11-05 16:39:12 +0000 Mihail, Thanks for informing us of these issues. We do prefer one bug per package or cve. Each CVE gets a CVSS scoring which will affect the priority of a bug. This allows us to manage resources better. thanks 56254 2 akuster 2015-11-06 01:40:29 +0000 (In reply to comment #0) > Apologies if classification isn't proper, I wasn't sure where this should go. > > While looking into automating a CVE check tool to be run on our QA > infrastructure found the following CVEs present in the project: > > readline 6.3 (0 patched, 1 issues) > ------------ > * CVE-2014-2524 : The _rl_tropen function in util.c in GNU readline before > 6.3 patch 3 allows local users to create or overwrite arbitrary files via a > symlink attack on a /var/tmp/rltrace.[PID] file. Readline fixed via: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/recipes-core/readline?h=master-next&id=9a02df0e932106bcb3dda0a7a2eb1113719fb4ee in master and Jethro. Informed Fido maintainer to backport. > > > busybox 1.15.1 (0 patched, 2 issues) > ------------ > * CVE-2011-2716 : The DHCP client (udhcpc) in BusyBox before 1.20.0 allows > remote DHCP servers to execute arbitrary commands via shell metacharacters > in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) > TFTP_SERVER_NAME host name options. > > * CVE-2013-1813 : util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 > permissions for parent directories when creating nested directories under > /dev/, which allows local users to have unknown impact and attack vectors. > CVE-2011-2716: affects 1.20 and below. Master, Jethro nor Dizzy affected. CVE-2013-1813: Affects 1.21 and below. Master, Jethro nor Dizzy affected. > > expat 2.1.0 (0 patched, 1 issues) > ------------ > * CVE-2013-0340 : expat 2.1.0 and earlier does not properly handle entities > expansion unless an application developer uses the XML_SetEntityDeclHandler > function, which allows remote attackers to cause a denial of service > (resource consumption), send HTTP requests to intranet servers, or read > arbitrary files via a crafted XML document, aka an XML External Entity (XXE) > issue. NOTE: it could be argued that because expat already provides the > ability to disable external entity expansion, the responsibility for > resolving this issue lies with application developers; according to this > argument, this entry should be REJECTed, and each affected application would > need its own CVE. Expat response: https://bugzilla.yoctoproject.org/show_bug.cgi?id=8609 59212 3 akuster 2016-02-18 16:05:16 +0000 fido updated http://cgit.openembedded.org/openembedded-core/commit/meta/recipes-core/readline?h=fido&id=7f2e2d57c7496547b7970377547482ead2e152cf