diff options
| author | mandree <mandree@FreeBSD.org> | 2016-08-30 03:00:36 +0800 |
|---|---|---|
| committer | mandree <mandree@FreeBSD.org> | 2016-08-30 03:00:36 +0800 |
| commit | 080e75a31cc402c26afc1f0c3d6f5b40a1b72348 (patch) | |
| tree | 42cef6fa3531ceb3cb9aea517739f91b1ed58506 /security | |
| parent | 91922d06e54cb0258dbe453463ec6265b331908a (diff) | |
| download | freebsd-ports-gnome-080e75a31cc402c26afc1f0c3d6f5b40a1b72348.tar.gz freebsd-ports-gnome-080e75a31cc402c26afc1f0c3d6f5b40a1b72348.tar.zst freebsd-ports-gnome-080e75a31cc402c26afc1f0c3d6f5b40a1b72348.zip | |
Document mailman < 2.1.23 CVE-2016-6893, insufficient CSRF protection.
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 20acdf0892a2..f55e69298b0e 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,38 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="b11ab01b-6e19-11e6-ab24-080027ef73ec"> + <topic>mailman -- CSRF protection enhancements</topic> + <affects> + <package> + <name>mailman</name> + <range><lt>2.1.23</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Mark Sapiro reports:</p> + <blockquote cite="http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668"> + <p>CSRF protection has been extended to the user options page. This + was actually fixed by Tokio Kikuchi as part of the fix for LP: + #775294 and intended for Mailman 2.1.15, but that fix wasn't + completely merged at the time. The full fix also addresses the + admindb, and edithtml pages as well as the user options page and the + previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.</p> + </blockquote> + </body> + </description> + <references> + <url>http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668</url> + <url>https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html</url> + <cvename>CVE-2016-6893</cvename> + </references> + <dates> + <discovery>2016-08-19</discovery> + <entry>2016-08-29</entry> + </dates> + </vuln> + <vuln vid="e195679d-045b-4953-bb33-be0073ba2ac6"> <topic>libxml2 -- multiple vulnabilities</topic> <affects> |