diff options
| author | tz <tz@FreeBSD.org> | 2017-08-23 20:54:48 +0800 |
|---|---|---|
| committer | tz <tz@FreeBSD.org> | 2017-08-23 20:54:48 +0800 |
| commit | b43393c507d587c5aa5be6f9f8bb62d7ad3f7680 (patch) | |
| tree | 06b08a4e05ef33bca312b8e8f70b6d427c2e762e | |
| parent | 1c8680eee90e655d645e2631f2d9aa2e62b77c32 (diff) | |
| download | freebsd-ports-gnome-b43393c507d587c5aa5be6f9f8bb62d7ad3f7680.tar.gz freebsd-ports-gnome-b43393c507d587c5aa5be6f9f8bb62d7ad3f7680.tar.zst freebsd-ports-gnome-b43393c507d587c5aa5be6f9f8bb62d7ad3f7680.zip | |
Document vulnerabilities of mail/phpmailer
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index dceddcc18c38..4edaefbb5b8d 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,38 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="c5d79773-8801-11e7-93f7-d43d7e971a1b"> + <topic>phpmailer -- XSS in code example and default exeception handler</topic> + <affects> + <package> + <name>phpmailer</name> + <range><lt>5.2.24</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>PHPMailer reports:</p> + <blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24"> + <p>Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The + code_generator.phps example did not filter user input prior to output. This + file is distributed with a .phps extension, so it it not normally executable + unless it is explicitly renamed, so it is safe by default. There was also an + undisclosed potential XSS vulnerability in the default exception handler + (unused by default). Patches for both issues kindly provided by Patrick + Monnerat of the Fedora Project.</p> + </blockquote> + </body> + </description> + <references> + <url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24</url> + <cvename>CVE-2017-11503</cvename> + </references> + <dates> + <discovery>2017-07-27</discovery> + <entry>2017-08-23</entry> + </dates> + </vuln> + <vuln vid="3531141d-a708-477c-954a-2a0549e49ca9"> <topic>salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master</topic> <affects> |