FreshPorts -- The Place For Ports If you buy from Amazon USA, please support us by using this link.
Follow us
Blog
Twitter

I am looking for an LTO tape library. Do you have one to spare?
Commit found by message id
Wed, 14 Nov 2012
[ 19:29:42 ohauer ] Original commit   Revision:307425
bugzilla devel  Deleted files touched by this commit  This port version is marked as vulnerable. Bug-tracking system developed by Mozilla Project
bugzilla3 devel  Deleted Deprecated Expired files touched by this commit  An older version of this port was marked as vulnerable. Bug-tracking system developed by Mozilla Project
bugzilla42 devel  Deleted Forbidden Expired Ignore files touched by this commit  This port version is marked as vulnerable. Bug-tracking system developed by Mozilla Project
vuxml security files touched by this commit Vulnerability and eXposure Markup Language DTD
- bugzilla security updates to version(s)
  3.6.11, 4.0.8, 4.2.4

Summary
=======

The following security issues have been discovered in Bugzilla:

* Confidential product and component names can be disclosed to
  unauthorized users if they are used to control the visibility of
  a custom field.

* When calling the 'User.get' WebService method with a 'groups'
  argument, it is possible to check if the given group names exist
  or not.

* Due to incorrectly filtered field values in tabular reports, it is
  possible to inject code which can lead to XSS.

* When trying to mark an attachment in a bug you cannot see as
  obsolete, the description of the attachment is disclosed in the
  error message.

* A vulnerability in swfstore.swf from YUI2 can lead to XSS.

Feature safe: yes

Security:	CVE-2012-4199
		https://bugzilla.mozilla.org/show_bug.cgi?id=731178

		CVE-2012-4198
		https://bugzilla.mozilla.org/show_bug.cgi?id=781850

		CVE-2012-4189
		https://bugzilla.mozilla.org/show_bug.cgi?id=790296

		CVE-2012-4197
		https://bugzilla.mozilla.org/show_bug.cgi?id=802204

		CVE-2012-5475
		https://bugzilla.mozilla.org/show_bug.cgi?id=808845
		http://yuilibrary.com/support/20121030-vulnerability/

Number of ports [& non-ports] in this commit: 4

Showing files for just one port: devel/bugzilla

show all files

hide all files


6 files found
ActionRevisionLinksFile
modify 307425 View diff View revision /ports/head/devel/bugzilla/Makefile
modify 307425 View diff View revision /ports/head/devel/bugzilla/distinfo
modify 307425 View diff View revision /ports/head/devel/bugzilla3/Makefile
modify 307425 View diff View revision /ports/head/devel/bugzilla3/distinfo
modify 307425 View diff View revision /ports/head/devel/bugzilla42/Makefile
modify 307425 View diff View revision /ports/head/devel/bugzilla42/distinfo
Login
User Login
Create account

Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD

This site
What is FreshPorts?
About the authors
FAQ
How big is it?
The latest upgrade!
Privacy
Forums
Blog
Contact

Search
Enter Keywords:
 
more...

Latest Vulnerabilities
i2pJul 28
i2pJul 28
i2pJul 28
bugzilla44Jul 25
apache22Jul 24
apache22-event-mpmJul 24
apache22-itk-mpmJul 24
apache22-peruser-mpmJul 24
apache22-worker-mpmJul 24
firefoxJul 23
firefox-develJul 23
firefox-esrJul 23
firefox10Jul 23
firefox15Jul 23
firefox3Jul 23

11 vulnerabilities affecting 34 ports have been reported in the past 14 days

* - modified, not new

All vulnerabilities


Ports
Home
Categories
Deleted ports
Sanity Test Failures
Newsfeeds


Statistics
Graphs
NEW Graphs (Javascript)
Traffic

Calculated hourly:
Port count 24397
Broken 181
Deprecated 825
Ignore 516
Forbidden 16
Restricted 263
No CDROM 101
Vulnerable 28
Expired 1
Set to expire 812
Interactive 13
new 24 hours 3
new 48 hours6
new 7 days16
new fortnight38
new month104


Servers and bandwidth provided by
New York Internet, SuperNews, and RootBSD
Valid HTML, CSS, and RSS.
Copyright © 2000-2014 Dan Langille. All rights reserved.