diff options
| author | ohauer <ohauer@FreeBSD.org> | 2015-01-27 04:24:08 +0800 |
|---|---|---|
| committer | ohauer <ohauer@FreeBSD.org> | 2015-01-27 04:24:08 +0800 |
| commit | bb3b03615817cb159f1a663be5fef611a717d121 (patch) | |
| tree | f203967d71d8796d975d5e64689a37715fd48482 /security | |
| parent | 9b9c7fa02d915b4f377f9d7057db52ece1414577 (diff) | |
| download | freebsd-ports-gnome-bb3b03615817cb159f1a663be5fef611a717d121.tar.gz freebsd-ports-gnome-bb3b03615817cb159f1a663be5fef611a717d121.tar.zst freebsd-ports-gnome-bb3b03615817cb159f1a663be5fef611a717d121.zip | |
- document bugzilla security issues
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e36dd776a655..16bdd074a468 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -57,6 +57,42 @@ Notes: --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="dc2d76df-a595-11e4-9363-20cf30e32f6d"> + <topic>Bugzilla multiple security issues</topic> + <affects> + <package> + <name>bugzilla44</name> + <range><lt>4.4.7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Bugzilla Security Advisory</p> + <blockquote cite="http://www.bugzilla.org/security/4.0.15/"> + <h5>Command Injection</h5> + <p>Some code in Bugzilla does not properly utilize 3 arguments form + for open() and it is possible for an account with editcomponents + permissions to inject commands into product names and other + attributes.</p> + <h5>Information Leak</h5> + <p>Using the WebServices API, a user can possibly execute imported + functions from other non-WebService modules. A whitelist has now + been added that lists explicit methods that can be executed via the + API.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2014-8630</cvename> + <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1079065</url> + <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1090275</url> + </references> + <dates> + <discovery>2015-01-21</discovery> + <entry>2015-01-26</entry> + </dates> + </vuln> + <vuln vid="9c7b6c20-a324-11e4-879c-00e0814cab4e"> <topic>django -- multiple vulnerabilities</topic> <affects> |