Apologies if classification isn't proper, I wasn't sure where this should go. While looking into automating a CVE check tool to be run on our QA infrastructure found the following CVEs present in the project: readline 6.3 (0 patched, 1 issues) ------------ * CVE-2014-2524 : The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file. busybox 1.15.1 (0 patched, 2 issues) ------------ * CVE-2011-2716 : The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options. * CVE-2013-1813 : util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors. expat 2.1.0 (0 patched, 1 issues) ------------ * CVE-2013-0340 : expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Mihail, Thanks for informing us of these issues. We do prefer one bug per package or cve. Each CVE gets a CVSS scoring which will affect the priority of a bug. This allows us to manage resources better. thanks
(In reply to comment #0) > Apologies if classification isn't proper, I wasn't sure where this should go. > > While looking into automating a CVE check tool to be run on our QA > infrastructure found the following CVEs present in the project: > > readline 6.3 (0 patched, 1 issues) > ------------ > * CVE-2014-2524 : The _rl_tropen function in util.c in GNU readline before > 6.3 patch 3 allows local users to create or overwrite arbitrary files via a > symlink attack on a /var/tmp/rltrace.[PID] file. Readline fixed via: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/recipes-core/readline?h=master-next&id=9a02df0e932106bcb3dda0a7a2eb1113719fb4ee in master and Jethro. Informed Fido maintainer to backport. > > > busybox 1.15.1 (0 patched, 2 issues) > ------------ > * CVE-2011-2716 : The DHCP client (udhcpc) in BusyBox before 1.20.0 allows > remote DHCP servers to execute arbitrary commands via shell metacharacters > in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) > TFTP_SERVER_NAME host name options. > > * CVE-2013-1813 : util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 > permissions for parent directories when creating nested directories under > /dev/, which allows local users to have unknown impact and attack vectors. > CVE-2011-2716: affects 1.20 and below. Master, Jethro nor Dizzy affected. CVE-2013-1813: Affects 1.21 and below. Master, Jethro nor Dizzy affected. > > expat 2.1.0 (0 patched, 1 issues) > ------------ > * CVE-2013-0340 : expat 2.1.0 and earlier does not properly handle entities > expansion unless an application developer uses the XML_SetEntityDeclHandler > function, which allows remote attackers to cause a denial of service > (resource consumption), send HTTP requests to intranet servers, or read > arbitrary files via a crafted XML document, aka an XML External Entity (XXE) > issue. NOTE: it could be argued that because expat already provides the > ability to disable external entity expansion, the responsibility for > resolving this issue lies with application developers; according to this > argument, this entry should be REJECTed, and each affected application would > need its own CVE. Expat response: https://bugzilla.yoctoproject.org/show_bug.cgi?id=8609
fido updated http://cgit.openembedded.org/openembedded-core/commit/meta/recipes-core/readline?h=fido&id=7f2e2d57c7496547b7970377547482ead2e152cf