cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/vuxml: add an entry for CVE-2022-4170 in x11/rxvt-unicode

Browse Source 
Security:	CVE-2022-4170
(cherry picked from commit 93b08b54dd)
This commit is contained in:
Thierry Thomas 2023-01-03 11:16:55 +01:00
parent 15b2d393d2
commit 7e559598e0
2 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
security/vuxml/Makefile
View File

@ -10,6 +10,7 @@ DIST_SUBDIR= vuxml
MAINTAINER= ports-secteam@FreeBSD.org
COMMENT= Vulnerability and eXposure Markup Language DTD
WWW= https://vuxml.freebsd.org/
LICENSE= BSD2CLAUSE

29
security/vuxml/vuln/2023.xml
View File

@ -1,3 +1,32 @@
<vuln vid="5b2eac07-8b4d-11ed-8b23-a0f3c100ae18">
<topic>rxvt-unicode is vulnerable to a remote code execution</topic>
<affects>
<package>
<name>rxvt-unicode</name>
<range><lt>9.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marc Lehmann reports:</p>
<blockquote cite="http://lists.schmorp.de/pipermail/rxvt-unicode/2023q1/002638.html">
<p>The biggest issue is resolving CVE-2022-4170, which allows command
execution inside urxvt from within the terminal (that means anything that
can output text in the terminal can start commands in the context of the
urxvt process, even remotely).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2022-4170</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2022-4170</url>
</references>
<dates>
<discovery>2022-12-05</discovery>
<entry>2023-01-03</entry>
</dates>
</vuln>
<vuln vid="86c330fe-bbae-4ca7-85f7-5321e627a4eb">
<topic>gitea -- multiple issues</topic>
<affects>