Document multiple vulnerabilities in flashplugin

[woodsb02]

Summary

Document multiple vulnerabilities in flashplugin

Security: CVE-2016-4273
Security: CVE-2016-4286
Security: CVE-2016-6981
Security: CVE-2016-6982
Security: CVE-2016-6983
Security: CVE-2016-6984
Security: CVE-2016-6985
Security: CVE-2016-6986
Security: CVE-2016-6987
Security: CVE-2016-6989
Security: CVE-2016-6990
Security: CVE-2016-6992

PR: 213698
Approved by: XXX (mentor)

Test Plan

make validate: seems ok
make VID=2482c798-93c6-11e6-846f-bc5ff4fb5ea1 html: file looks good, and displays well in firefox

[woodsb02]

I have been unable to test this change, as I am getting multiple errors when trying to run the 2 testing commands, even both applying this patch:

$ cd /usr/ports/security/vuxml
$ make validate
/bin/sh /zstore/poudriere/ports/default/security/vuxml/files/tidy.sh "/zstore/poudriere/ports/default/security/vuxml/files/tidy.xsl" "/zstore/poudriere/ports/default/security/vuxml/vuln.xml" > "/zstore/poudriere/ports/default/security/vuxml/vuln.xml.tidy"
>>> Validating...
/usr/local/bin/xmllint --valid --noout /zstore/poudriere/ports/default/security/vuxml/vuln.xml
http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd:41: warning: failed to load external entity "http://www.w3.org/TR/xhtml-modularization/DTD/xhtml-datatypes-1.mod"
%xhtml-datatypes.mod;
                     ^
Entity: line 1:
 %xhtml-datatypes.mod;
                      ^
http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd:59: parser warning : PEReference: %URI.datatype; not found
        "xmlns %URI.datatype; #FIXED '%vuxml.xmlns;'"
                                                     ^
http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd:82: warning: failed to load external entity "http://www.w3.org/TR/xhtml-basic/xhtml-basic10.dtd"
%xhtml-basic;
             ^
Entity: line 1:
 %xhtml-basic;
              ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:60: element vuxml: validity error : No declaration for attribute xmlns of element vuxml
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
                                                ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:61: element vuln: validity error : No declaration for attribute vid of element vuln
  <vuln vid="43f1c867-654a-11e6-8286-00248c0c745d">
                                                  ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:62: element topic: validity error : No declaration for element topic
    <topic>Rails 4 -- Possible XSS Vulnerability in Action View</topic>
                                                                       ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:65: element name: validity error : No declaration for element name
        <name>rubygem-actionview</name>
                                       ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:66: element lt: validity error : No declaration for element lt
        <range><lt>4.2.7.1</lt></range>
                               ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:66: element range: validity error : No declaration for element range
        <range><lt>4.2.7.1</lt></range>
                                       ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:67: element gt: validity error : No declaration for element gt
        <range><gt>3.0.0</gt></range>
                             ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:67: element range: validity error : No declaration for element range
        <range><gt>3.0.0</gt></range>
                                     ^
/zstore/poudriere/ports/default/security/vuxml/vuln.xml:68: element package: validity error : No declaration for element package
      </package>
                ^

And much, much more (I cut the output short).

Any ideas what is causing these errors?

[mat]

Have you installed the port before running make validate ?

[woodsb02]

In D8266#171998, @mat wrote:

Have you installed the port before running make validate ?

Yes I had. However, your question prompted a thought for me, and that is that I had tried performing a "tidy up" a few months ago of files in /usr/local/ which had not been installed by packages (at least according to "pkg which"). I realise this has accidentally deleted some necessary files in /usr/local.

All fixed now with "pkg upgrade -f" to reinstall all packages. "make validate" is working again for me :)

Thanks for the prompt.

[woodsb02]

In other news, this patch tests well.

[woodsb02]

security/vuxml/vuln.xml

66 ↗

(On Diff #21450)

I copied this line from other entries for flash, but I can't work out why it is required. I can't find any package with this name. Is it a legacy thing that is no longer required?

[woodsb02]

Is anyone able to have a look at this review for documenting a flash security vulnerability?

[koobs]

The changes look OK to me, but there should probably be a bugzilla issue to cover this and the requisite port/pkg updates in the various ports.

CC #ports-secteam as they may be (hopefully) coordinating the response across the various people/ports.

security/vuxml/vuln.xml

66 ↗

(On Diff #21450)

There's new linux-c7 ports now. This may need an update to cover those

[woodsb02]

• Add linux-c7-flashplugin11 to the list of affected packages
• Update entry date

[woodsb02]

Committed as proposed in this review by feld in r424574.

Not sure why this review wasn't automatically updated, given it was referenced in the commit.

[mat]

In rP424574 it says that it is still being imported, so it may end up here.