Add CVE-2018-14404 and CVE-2018-14567 for nokogiri

Author: reedloden

gems/nokogiri/CVE-2018-14404.yml

@@ -0,0 +1,69 @@
+---
+gem: nokogiri
+cve: 2018-14404
+date: 2018-10-04
+url: https://github.com/sparklemotion/nokogiri/issues/1785
+title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
+description: |
+  Nokogiri 1.8.5 has been released.
+
+  This is a security and bugfix release. It addresses two CVEs in upstream
+  libxml2 rated as "medium" by Red Hat, for which details are below.
+
+  If you're using your distro's system libraries, rather than Nokogiri's
+  vendored libraries, there's no security need to upgrade at this time,
+  though you may want to check with your distro whether they've patched this
+  (Canonical has patched Ubuntu packages). Note that these patches are not
+  yet (as of 2018-10-04) in an upstream release of libxml2.
+
+  Full details about the security update are available in Github Issue #1785.
+  [#1785]: https://github.com/sparklemotion/nokogiri/issues/1785
+
+  -----
+
+  [MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404
+  and CVE-2018-14567. Full details are available in #1785. Note that these
+  patches are not yet (as of 2018-10-04) in an upstream release of libxml2.
+
+  -----
+
+  CVE-2018-14404
+
+  Permalink:
+
+  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14404.html
+
+  Description:
+
+  A NULL pointer dereference vulnerability exists in the
+  xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when
+  parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR
+  case. Applications processing untrusted XSL format inputs with the use of
+  the libxml2 library may be vulnerable to a denial of service attack due
+  to a crash of the application
+
+  Canonical rates this vulnerability as "Priority: Medium"
+
+  -----
+
+  CVE-2018-14567
+
+  Permalink:
+
+  https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-14567.html
+
+  Description:
+
+  infinite loop in LZMA decompression
+
+  Canonical rates this vulnerability as "Priority: Medium"
+
+patched_versions:
+  - ">= 1.8.5"
+related:
+  cve:
+    - 2018-14567
+  url:
+    - https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ
+    - https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594
+    - https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74