FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  369658
Date:      2014-09-30
Time:      20:09:32Z
Committer: brd

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
608ed765-c700-11e3-848c-20cf30e32f6dbugzilla -- Cross-Site Request Forgery

A Bugzilla Security Advisory reports:

The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug.

Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue.


Discovery 2014-04-17
Entry 2014-04-18
Modified 2014-04-18
bugzilla40
ge 2.0.0 lt 4.4.3

bugzilla42
ge 2.0.0 lt 4.4.3

bugzilla44
ge 2.0.0 lt 4.4.3

CVE-2014-1517
https://bugzilla.mozilla.org/show_bug.cgi?id=713926
60bfa396-c702-11e3-848c-20cf30e32f6dbugzilla -- Social Engineering

A Bugzilla Security Advisory reports:

Dangerous control characters can be inserted into Bugzilla, notably into bug comments. If the text, which may look safe, is copied into a terminal such as xterm or gnome-terminal, then unexpected commands could be executed on the local machine.


Discovery 2014-04-17
Entry 2014-04-18
Modified 2014-04-18
bugzilla40
ge 2.0.0 lt 4.0.12

bugzilla42
ge 4.1.1 lt 4.2.8

bugzilla44
ge 4.4.0 lt 4.4.3

https://bugzilla.mozilla.org/show_bug.cgi?id=968576