diff options
| author | remko <remko@FreeBSD.org> | 2007-09-20 20:04:29 +0800 |
|---|---|---|
| committer | remko <remko@FreeBSD.org> | 2007-09-20 20:04:29 +0800 |
| commit | 329f370908d2048518ce1b92a5507ac368c14a54 (patch) | |
| tree | 1462356991c9b41dd35b9852fd4bbf771136bc11 | |
| parent | f9c7be0d209bb6b2da2a8c6a8e1f1394f61df557 (diff) | |
| download | freebsd-ports-gnome-329f370908d2048518ce1b92a5507ac368c14a54.tar.gz freebsd-ports-gnome-329f370908d2048518ce1b92a5507ac368c14a54.tar.zst freebsd-ports-gnome-329f370908d2048518ce1b92a5507ac368c14a54.zip | |
Document bugzilla -- "createmailregexp" security bypass vulnerability,
marking all versions as vulnerable till we know what version is the
one fixed in our CVS repository.
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 5a19ed6a3855..73df5d9c6e8c 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="f8d3689e-6770-11dc-8be8-02e0185f8d72"> + <topic>bugzilla -- "createmailregexp" security bypass vulnerability</topic> + <affects> + <package> + <name>bugzilla</name> + <range><gt>0</gt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Bugzilla development team reports:</p> + <blockquote cite="http://www.bugzilla.org/security/3.0.1/"> + <p>Bugzilla::WebService::User::offer_account_by_email does + not check the "createemailregexp" parameter, and thus + allows users to create accounts who would normally be + denied account creation. The "emailregexp" parameter is + still checked. If you do not have the SOAP::Lite Perl + module installed on your Bugzilla system, your system is + not vulnerable (because the Bugzilla WebService will not + be enabled).</p> + </blockquote> + </body> + </description> + <references> + <url>http://www.bugzilla.org/security/3.0.1/</url> + </references> + <dates> + <discovery>2007-09-18</discovery> + <entry>2007-09-20</entry> + </dates> + </vuln> + <vuln vid="14ad2a28-66d2-11dc-b25f-02e0185f8d72"> <topic>konquerer -- address bar spoofing</topic> <affects> |