FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  318453
Date:      2013-05-18
Time:      20:35:07Z
Committer: rakuco

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML ID	Description
7f5ccb1d-439b-11e1-bc16-0023ae8e59f0	tomcat -- Denial of Service The Tomcat security team reports: Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values. Discovery 2011-10-21 Entry 2012-01-17 tomcat gt 5.5.0 lt 5.5.35 tomcat gt 6.0.0 lt 6.0.34 tomcat gt 7.0.0 lt 7.0.23 CVE-2012-0022 http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23
553ec4ed-38d6-11e0-94b1-000c29ba66d2	tomcat -- Cross-site scripting vulnerability The Tomcat security team reports: The HTML Manager interface displayed web applciation provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administartive user when viewing the manager pages. Discovery 2010-11-12 Entry 2011-02-15 Modified 2011-09-30 tomcat gt 5.5.0 lt 5.5.32 tomcat gt 6.0.0 lt 6.0.30 tomcat gt 7.0.0 lt 7.0.6 CVE-2011-0013 http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6
7f5ccb1d-439b-11e1-bc16-0023ae8e59f0	tomcat -- Denial of Service The Tomcat security team reports: Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values. Discovery 2011-10-21 Entry 2012-01-17 tomcat gt 5.5.0 lt 5.5.35 tomcat gt 6.0.0 lt 6.0.34 tomcat gt 7.0.0 lt 7.0.23 CVE-2012-0022 http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23
4ca26574-2a2c-11e2-99c7-00a0d181e71d	tomcat -- Denial of Service The Apache Software Foundation reports: The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers. This issue was identified by Josh Spiewak. Discovery 2012-11-05 Entry 2012-11-08 Modified 2012-11-09 tomcat gt 6.0.0 lt 6.0.36 gt 7.0.0 lt 7.0.28 CVE-2012-2733 http://tomcat.apache.org/security.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html
152e4c7e-2a2e-11e2-99c7-00a0d181e71d	tomcat -- authentication weaknesses The Apache Software Foundation reports: Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved: Tomcat tracked client rather than server nonces and nonce count. When a session ID was present, authentication was bypassed. The user name and password were not checked before when indicating that a nonce was stale. These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances. The first issue was identified by Tilmann Kuhn. The second and third issues were identified by the Tomcat security team during the code review resulting from the first issue. Discovery 2012-11-05 Entry 2012-11-08 Modified 2012-11-09 tomcat gt 5.5.0 lt 5.5.36 gt 6.0.0 lt 6.0.36 gt 7.0.0 lt 7.0.30 CVE-2012-3439 http://tomcat.apache.org/security.html http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html
553ec4ed-38d6-11e0-94b1-000c29ba66d2	tomcat -- Cross-site scripting vulnerability The Tomcat security team reports: The HTML Manager interface displayed web applciation provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administartive user when viewing the manager pages. Discovery 2010-11-12 Entry 2011-02-15 Modified 2011-09-30 tomcat gt 5.5.0 lt 5.5.32 tomcat gt 6.0.0 lt 6.0.30 tomcat gt 7.0.0 lt 7.0.6 CVE-2011-0013 http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6