diff options
| author | stas <stas@FreeBSD.org> | 2010-08-18 14:36:26 +0800 |
|---|---|---|
| committer | stas <stas@FreeBSD.org> | 2010-08-18 14:36:26 +0800 |
| commit | aeaaf88bcd782775ac4cbcd6061686817c4e852a (patch) | |
| tree | b114a44b07001342d0298ed687c0e151a8d73e84 /security | |
| parent | 14e1fa34f3421307da866f34ab138c95859ece06 (diff) | |
| download | freebsd-ports-gnome-aeaaf88bcd782775ac4cbcd6061686817c4e852a.tar.gz freebsd-ports-gnome-aeaaf88bcd782775ac4cbcd6061686817c4e852a.tar.zst freebsd-ports-gnome-aeaaf88bcd782775ac4cbcd6061686817c4e852a.zip | |
- Document recent WEBrick XSS vulnerability in ruby.
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 13d0e66429ae..5e3d6c6ca698 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,40 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="34e0316a-aa91-11df-8c2e-001517289bf8"> + <topic>ruby -- UTF-7 encoding XSS vulnerability in WEBrick</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby+pthreads</name> + <name>ruby+pthreads+oniguruma</name> + <name>ruby+oniguruma</name> + <range><ge>1.8.*,1</ge><lt>1.8.7.248_3,1</lt></range> + <range><ge>1.9.*,1</ge><lt>1.9.1.430,1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The official ruby site reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/"> + <p>WEBrick have had a cross-site scripting vulnerability that allows + an attacker to inject arbitrary script or HTML via a crafted URI. + This does not affect user agents that strictly implement HTTP/1.1, + however, some user agents do not.</p> + </blockquote> + </body> + </description> + <references> + <bid>40895</bid> + <cvename>CVE-2010-0541</cvename> + <url>http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/</url> + </references> + <dates> + <discovery>2010-08-16</discovery> + <entry>2008-08-17</entry> + </dates> + </vuln> + <vuln vid="b74a8076-9b1f-11df-9f58-021e8c343e76"> <topic>isolate -- local root exploit</topic> <affects> |