CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2018-1000825

FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file.

Score
10.0 critical
Published
2018-12-20
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
games/freecolfreecol1.2.0_2unaddressedale@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>freecol</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>FreeCol version <= nightly-2018-08-22 contains a XML External Entity
	(XXE) vulnerability in FreeColXMLReader parser that can result in
	Disclosure of confidential data, denial of service, SSRF, port
	scanning. This attack appear to be exploitable via Freecol file.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2018-1000825</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2018-1000825</url>
    </references>
    <dates>
      <discovery>2018-12-20</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>