FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  365592
Date:      2014-08-21
Time:      19:46:21Z
Committer: zi

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
9ccfee39-3c3b-11df-9edc-000f20797edemozilla -- multiple vulnerabilities

Mozilla Project reports:

MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy

MFSA 2010-23 Image src redirect to mailto: URL opens email editor

MFSA 2010-22 Update NSS to support TLS renegotiation indication

MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy

MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop

MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray

MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView

MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection

MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)


Discovery 2010-03-30
Entry 2010-03-30
seamonkey
gt 2.0 lt 2.0.4

thunderbird
ge 3.0 lt 3.0.4

firefox
gt 3.5.*,1 lt 3.5.9,1

gt 3.*,1 lt 3.0.19,1

linux-firefox
lt 3.0.19,1

linux-firefox-devel
lt 3.5.9

nss
linux-f10-nss
lt 3.12.5

CVE-2010-0181
CVE-2009-3555
CVE-2010-0179
CVE-2010-0178
CVE-2010-0177
CVE-2010-0176
CVE-2010-0175
CVE-2010-0174
CVE-2010-0173
http://www.mozilla.org/security/announce/2010/mfsa2010-24.html
http://www.mozilla.org/security/announce/2010/mfsa2010-23.html
http://www.mozilla.org/security/announce/2010/mfsa2010-22.html
http://www.mozilla.org/security/announce/2010/mfsa2010-21.html
http://www.mozilla.org/security/announce/2010/mfsa2010-20.html
http://www.mozilla.org/security/announce/2010/mfsa2010-19.html
http://www.mozilla.org/security/announce/2010/mfsa2010-18.html
http://www.mozilla.org/security/announce/2010/mfsa2010-17.html
http://www.mozilla.org/security/announce/2010/mfsa2010-16.html
aa5bc971-d635-11e0-b3cf-080027ef73ecnss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl

Heather Adkins, Google's Information Security Manager, reported that Google received

[...] reports of attempted SSL man-in-the-middle (MITM) attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The attacker used a fraudulent SSL certificate issued by DigiNotar, a root certificate authority that should not issue certificates for Google (and has since revoked it). [...]

VASCO Data Security International Inc., owner of DigiNotar, issued a press statement confirming this incident:

On July 19th 2011, DigiNotar detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains, including Google.com. [...] an external security audit concluded that all fraudulently issued certificates were revoked. Recently, it was discovered that at least one fraudulent certificate had not been revoked at the time. [...]

Mozilla, maintainer of the NSS package, from which FreeBSD derived ca_root_nss, stated that they:

revoked our trust in the DigiNotar certificate authority from all Mozilla software. This is not a temporary suspension, it is a complete removal from our trusted root program. Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort.

Three central issues informed our decision:

  1. Failure to notify. [...]
  2. The scope of the breach remains unknown. [...]
  3. The attack is not theoretical.

Discovery 2011-07-19
Entry 2011-09-03
Modified 2011-09-06
nss
lt 3.12.11

ca_root_nss
lt 3.12.11

firefox
gt 3.6.*,1 lt 3.6.22,1

gt 4.0.*,1 lt 6.0.2,1

seamonkey
lt 2.3.2

linux-firefox
lt 3.6.22,1

thunderbird
gt 3.1.* lt 3.1.14

gt 5.0.* lt 6.0.2

linux-thunderbird
lt 3.1.14

linux-seamonkey
lt 2.3.2

http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx
http://www.mozilla.org/security/announce/2011/mfsa2011-34.html
http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html
aa5bc971-d635-11e0-b3cf-080027ef73ecnss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl

Heather Adkins, Google's Information Security Manager, reported that Google received

[...] reports of attempted SSL man-in-the-middle (MITM) attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The attacker used a fraudulent SSL certificate issued by DigiNotar, a root certificate authority that should not issue certificates for Google (and has since revoked it). [...]

VASCO Data Security International Inc., owner of DigiNotar, issued a press statement confirming this incident:

On July 19th 2011, DigiNotar detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains, including Google.com. [...] an external security audit concluded that all fraudulently issued certificates were revoked. Recently, it was discovered that at least one fraudulent certificate had not been revoked at the time. [...]

Mozilla, maintainer of the NSS package, from which FreeBSD derived ca_root_nss, stated that they:

revoked our trust in the DigiNotar certificate authority from all Mozilla software. This is not a temporary suspension, it is a complete removal from our trusted root program. Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort.

Three central issues informed our decision:

  1. Failure to notify. [...]
  2. The scope of the breach remains unknown. [...]
  3. The attack is not theoretical.

Discovery 2011-07-19
Entry 2011-09-03
Modified 2011-09-06
nss
lt 3.12.11

ca_root_nss
lt 3.12.11

firefox
gt 3.6.*,1 lt 3.6.22,1

gt 4.0.*,1 lt 6.0.2,1

seamonkey
lt 2.3.2

linux-firefox
lt 3.6.22,1

thunderbird
gt 3.1.* lt 3.1.14

gt 5.0.* lt 6.0.2

linux-thunderbird
lt 3.1.14

linux-seamonkey
lt 2.3.2

http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx
http://www.mozilla.org/security/announce/2011/mfsa2011-34.html
http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html