FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  452616
Date:      2017-10-21
Time:      23:01:18Z
Committer: cpm

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
62287f51-d43d-11e4-879c-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and 1.8c1. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.


Discovery 2015-03-18
Entry 2015-03-27
py27-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py32-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py33-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py34-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py27-django-devel
lt 20150326,1

py32-django-devel
lt 20150326,1

py33-django-devel
lt 20150326,1

py34-django-devel
lt 20150326,1

https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
CVE-2015-2316
CVE-2015-2317
3c5579f7-294a-11e4-99f6-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

These releases address an issue with reverse() generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; and a data leak in the administrative interface. We encourage all users of Django to upgrade as soon as possible.


Discovery 2014-08-20
Entry 2014-08-21
py27-django
ge 1.6 lt 1.6.6

py27-django15
ge 1.5 lt 1.5.9

py27-django14
ge 1.4 lt 1.4.14

py32-django
ge 1.6 lt 1.6.6

py32-django15
ge 1.5 lt 1.5.9

py33-django
ge 1.6 lt 1.6.6

py33-django15
ge 1.5 lt 1.5.9

py34-django
ge 1.6 lt 1.6.6

py34-django15
ge 1.5 lt 1.5.9

py27-django-devel
lt 20140821,1

py32-django-devel
lt 20140821,1

py33-django-devel
lt 20140821,1

py34-django-devel
lt 20140821,1

https://www.djangoproject.com/weblog/2014/aug/20/security/
CVE-2014-0480
CVE-2014-0481
CVE-2014-0482
CVE-2014-0483
b0e54dc1-45d2-11e5-adde-14dae9d210b8django -- multiple vulnerabilities

Tim Graham reports:

Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.

Thanks Lin Hua Cheng for reporting the issue.


Discovery 2015-08-18
Entry 2015-08-18
py27-django
py32-django
py33-django
py34-django
lt 1.8.4

py27-django17
py32-django17
py33-django17
py34-django17
lt 1.7.10

py27-django14
py32-django14
py33-django14
py34-django14
lt 1.4.22

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
le 20150709,1

https://www.djangoproject.com/weblog/2015/aug/18/security-releases/
CVE-2015-5963
CVE-2015-5964
dc880d6c-195d-11e7-8c63-0800277dcc69django -- multiple vulnerabilities

Django team reports:

These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

  • Open redirect and possible XSS attack via user-supplied numeric redirect URLs
  • Open redirect vulnerability in django.views.static.serve()

Discovery 2017-04-04
Entry 2017-04-04
py27-django
py33-django
py34-django
py35-django
py36-django
lt 1.8.18

py27-django18
py33-django18
py34-django18
py35-django18
py36-django18
lt 1.8.18

py27-django19
py33-django19
py34-django19
py35-django19
py36-django19
lt 1.9.13

py27-django110
py33-django110
py34-django110
py35-django110
py36-django110
lt 1.10.7

https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
CVE-2017-7233
CVE-2017-7234
9c7b6c20-a324-11e4-879c-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

Today the Django team is issuing multiple releases -- Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our security process. These releases are now available on PyPI and our download page.

These releases address several security issues. We encourage all users of Django to upgrade as soon as possible.


Discovery 2015-01-13
Entry 2015-01-23
Modified 2015-01-24
py27-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py32-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py33-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py34-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py27-django-devel
lt 20150124,1

py32-django-devel
lt 20150124,1

py33-django-devel
lt 20150124,1

py34-django-devel
lt 20150124,1

https://www.djangoproject.com/weblog/2015/jan/13/security/
CVE-2015-0219
CVE-2015-0220
CVE-2015-0221
CVE-2015-0222
59e72db2-cae6-11e3-8420-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and upgrade as soon as possible.


Discovery 2014-04-21
Entry 2014-04-23
Modified 2014-04-30
py26-django
ge 1.6 lt 1.6.3

py27-django
ge 1.6 lt 1.6.3

py31-django
ge 1.6 lt 1.6.3

py32-django
ge 1.6 lt 1.6.3

py33-django
ge 1.6 lt 1.6.3

py34-django
ge 1.6 lt 1.6.3

py26-django15
ge 1.5 lt 1.5.6

py27-django15
ge 1.5 lt 1.5.6

py31-django15
ge 1.5 lt 1.5.6

py32-django15
ge 1.5 lt 1.5.6

py33-django15
ge 1.5 lt 1.5.6

py34-django15
ge 1.5 lt 1.5.6

py26-django14
ge 1.4 lt 1.4.11

py27-django14
ge 1.4 lt 1.4.11

py31-django14
ge 1.4 lt 1.4.11

py32-django14
ge 1.4 lt 1.4.11

py33-django14
ge 1.4 lt 1.4.11

py34-django14
ge 1.4 lt 1.4.11

py26-django-devel
lt 20140423,1

py27-django-devel
lt 20140423,1

https://www.djangoproject.com/weblog/2014/apr/21/security/
CVE-2014-0472
CVE-2014-0473
CVE-2014-0474
cb116651-79db-4c09-93a2-c38f9df46724django -- multiple vulnerabilities

The Django project reports:

Today the Django team released Django 1.10.3, Django 1.9.11, and 1.8.16. These releases addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

  • User with hardcoded password created when running tests on Oracle
  • DNS rebinding vulnerability when DEBUG=True

Discovery 2016-11-01
Entry 2016-11-02
py27-django
py33-django
py34-django
py35-django
lt 1.8.16

py27-django18
py33-django18
py34-django18
py35-django18
lt 1.8.16

py27-django19
py33-django19
py34-django19
py35-django19
lt 1.9.11

py27-django110
py33-django110
py34-django110
py35-django110
lt 1.10.3

https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
CVE-2016-9013
CVE-2016-9014
f9e6c0d1-e4cc-11e5-b2bd-002590263bf5django -- multiple vulnerabilities

Tim Graham reports:

Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

User enumeration through timing difference on password hasher work factor upgrade


Discovery 2016-03-01
Entry 2016-03-08
py27-django
py32-django
py33-django
py34-django
py35-django
lt 1.8.10

py27-django18
py32-django18
py33-django18
py34-django18
py35-django18
lt 1.8.10

py27-django19
py32-django19
py33-django19
py34-django19
py35-django19
lt 1.9.3

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
py35-django-devel
le 20150709,1

CVE-2016-2512
CVE-2016-2513
https://www.djangoproject.com/weblog/2016/mar/01/security-releases/
11c52bc6-97aa-11e5-b8df-14dae9d210b8django -- information leak vulnerability

Tim Graham reports:

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".


Discovery 2015-11-24
Entry 2015-11-30
Modified 2015-12-24
py27-django
py32-django
py33-django
py34-django
lt 1.8.7

py27-django18
py32-django18
py33-django18
py34-django18
lt 1.8.7

py27-django17
py32-django17
py33-django17
py34-django17
lt 1.7.11

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
le 20150709,1

https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
CVE-2015-8213