diff options
| author | ohauer <ohauer@FreeBSD.org> | 2012-11-28 04:09:34 +0800 |
|---|---|---|
| committer | ohauer <ohauer@FreeBSD.org> | 2012-11-28 04:09:34 +0800 |
| commit | aa2e9c5c0f2bde4a951e87ab3c58db77ce2495e3 (patch) | |
| tree | 9f8dfb171e0e1cd0c69d59bb6b157e4022b468fa | |
| parent | aeea63821f40ea3614ef780c12775e12ac15ebc5 (diff) | |
| download | freebsd-ports-gnome-aa2e9c5c0f2bde4a951e87ab3c58db77ce2495e3.tar.gz freebsd-ports-gnome-aa2e9c5c0f2bde4a951e87ab3c58db77ce2495e3.tar.zst freebsd-ports-gnome-aa2e9c5c0f2bde4a951e87ab3c58db77ce2495e3.zip | |
- document www/yahoo-ui security issue and mark port forbidden [1]
pet portlint (maintainer is already notified)
- adjust CVE entries for bugzilla (CVE-2012-5475 was rejected) [2]
Feature safe: yes
Security: CVE-2012-5881 [1][2]
CVE-2012-5882 [1][2]
CVE-2012-5883 [2]
Approved by: glarkin (implicit) [1]
| -rw-r--r-- | security/vuxml/vuln.xml | 39 | ||||
| -rw-r--r-- | www/yahoo-ui/Makefile | 6 |
2 files changed, 42 insertions, 3 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 126277e16a19..cff07e9c3461 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,40 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="aa4f86af-3172-11e2-ad21-20cf30e32f6d"> + <topic>YUI JavaScript library -- JavaScript injection exploits in Flash components</topic> + <affects> + <package> + <name>yahoo-ui</name> + <range><lt>3.0.0</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The YUI team reports:</p> + <blockquote cite="http://yuilibrary.com/support/20121030-vulnerability/"> + <h1>Vulnerability in YUI 2.4.0 through YUI 2.9.0</h1> + <p>A XSS vulnerability has been discovered in some YUI 2 .swf files + from versions 2.4.0 through 2.9.0. This defect allows JavaScript + injection exploits to be created against domains that host affected + YUI .swf files.</p> + <p>If your site loads YUI 2 from a CDN (yui.yahooapis.com, + ajax.googleapis.com, etc.) and not from your own domain, you + are not affected. YUI 3 is not affected by this issue.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2012-5881</cvename> + <cvename>CVE-2012-5882</cvename> + <url>http://yuilibrary.com/support/20121030-vulnerability/</url> + </references> + <dates> + <discovery>2012-10-30</discovery> + <entry>2012-12-27</entry> + </dates> + </vuln> + <vuln vid="4d64fc61-3878-11e2-a4eb-00262d5ed8ee"> <topic>chromium -- multiple vulnerabilities</topic> <affects> @@ -450,13 +484,16 @@ Note: Please add new entries to the beginning of this file. <url>https://bugzilla.mozilla.org/show_bug.cgi?id=802204</url> <cvename>CVE-2012-4189</cvename> <url>https://bugzilla.mozilla.org/show_bug.cgi?id=790296</url> - <cvename>CVE-2012-5475</cvename> + <cvename>CVE-2012-5881</cvename> + <cvename>CVE-2012-5882</cvename> + <cvename>CVE-2012-5883</cvename> <url>https://bugzilla.mozilla.org/show_bug.cgi?id=808845</url> <url>http://yuilibrary.com/support/20121030-vulnerability/</url> </references> <dates> <discovery>2012-11-13</discovery> <entry>2012-11-14</entry> + <modified>2012-11-27</modified> </dates> </vuln> diff --git a/www/yahoo-ui/Makefile b/www/yahoo-ui/Makefile index 21c71634301b..17c363066f0c 100644 --- a/www/yahoo-ui/Makefile +++ b/www/yahoo-ui/Makefile @@ -10,13 +10,15 @@ DISTNAME= yui_${PORTVERSION}r1 MAINTAINER= glarkin@FreeBSD.org COMMENT= The Yahoo! User Interface (YUI) Library +LICENSE= BSD + +FORBIDDEN= CVE-2012-5881 Cross-site scripting (XSS) vulnerability in the Flash component infrastructure + USE_ZIP= yes WRKSRC= ${WRKDIR}/yui NO_BUILD= yes -LICENSE= BSD - OPTIONS= APACHE "Configure for Apache-2.x" off \ MINIMAL "Do not install documentation and examples" off |