FreshPorts -- The Place For Ports If you buy from Amazon USA, please support us by using this link.
Follow us
Blog
Twitter

I am looking for an LTO tape library. Do you have one to spare?
Commit found by message id
Tue, 10 Apr 2012
[ 05:15:48 ohauer ] Original commit 
bugzilla devel  Deleted files touched by this commit  This port version is marked as vulnerable. Bug-tracking system developed by Mozilla Project
bugzilla german  Deleted files touched by this commit  An older version of this port was marked as vulnerable. German localization for Bugzilla
bugzilla-ru russian  Deleted files touched by this commit Russian localization for Bugzilla
- update to 4.0.5

Vulnerability Details
=====================

Class:       Cross-Site Request Forgery
Versions:    4.0.2 to 4.0.4, 4.1.1 to 4.2rc2
Fixed In:    4.0.5, 4.2
Description: Due to a lack of validation of the enctype form
             attribute when making POST requests to xmlrpc.cgi,
             a possible CSRF vulnerability was discovered. If a user
             visits an HTML page with some malicious HTML code in it,
             an attacker could make changes to a remote Bugzilla installation
             on behalf of the victim's account by using the XML-RPC API
             on a site running mod_perl. Sites running under mod_cgi
             are not affected. Also the user would have had to be
             already logged in to the target site for the vulnerability
             to work.
References:  https://bugzilla.mozilla.org/show_bug.cgi?id=725663
CVE Number:  CVE-2012-0453

Approved by:    skv (implicit)

Number of ports [& non-ports] in this commit: 3

Showing files for just one port: devel/bugzilla

show all files

hide all files


2 files found
ActionRevisionLinksFile
modify 1.92 View diff View revision /ports/head/devel/bugzilla/Makefile
modify 1.49 View diff View revision /ports/head/devel/bugzilla/distinfo
Login
User Login
Create account

Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD

This site
What is FreshPorts?
About the authors
FAQ
How big is it?
The latest upgrade!
Privacy
Forums
Blog
Contact

Search
Enter Keywords:
 
more...

Latest Vulnerabilities
phpmyadminSep 13
ossec-hids-clientSep 11
ossec-hids-localSep 11
ossec-hids-serverSep 11
chromiumSep 09
trafficserverSep 05
apache22*Sep 03
apache22-event-mpm*Sep 03
apache22-itk-mpm*Sep 03
apache22-peruser-mpm*Sep 03
apache22-worker-mpm*Sep 03
chromiumAug 26
fileAug 21
py-djangoAug 21
py-django-develAug 21

5 vulnerabilities affecting 12 ports have been reported in the past 14 days

* - modified, not new

All vulnerabilities


Ports
Home
Categories
Deleted ports
Sanity Test Failures
Newsfeeds


Statistics
Graphs
NEW Graphs (Javascript)
Traffic

Calculated hourly:
Port count 24092
Broken 121
Deprecated 93
Ignore 386
Forbidden 17
Restricted 205
No CDROM 94
Vulnerable 21
Expired 7
Set to expire 88
Interactive 0
new 24 hours 0
new 48 hours6
new 7 days49
new fortnight137
new month245


Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD
Valid HTML, CSS, and RSS.
Copyright © 2000-2014 Dan Langille. All rights reserved.