From f84028328bca3e9b445fa7dddcbcefd7a737ec1b Mon Sep 17 00:00:00 2001 From: niels Date: Wed, 5 May 2010 19:12:36 +0000 Subject: - Added mediawiki and lxr vulnerabilities - Fixed vlc topic format (lower case, portname first) PR: ports/146337 Approved by: itetcu (mentor, implicit) Security: http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html Security: http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com --- security/vuxml/vuln.xml | 69 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 68 insertions(+), 1 deletion(-) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index b2cc72de74c0..9f8fcb35dc2d 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,8 +34,74 @@ Note: Please add new entries to the beginning of this file. --> + + mediawiki -- authenticated CSRF vulnerability + + + mediawiki + 1.15.3 + + + + +

A MediaWiki security announcement reports:

+
+

MediaWiki was found to be vulnerable to login CSRF. + An attacker who controls a user account on the target + wiki can force the victim to log in as the attacker, + via a script on an external website.

+

If the wiki is configured to allow user scripts, say + with "$wgAllowUserJs = true" in LocalSettings.php, then + the attacker can proceed to mount a phishing-style + attack against the victim to obtain their password.

+
+ + + + CVE-2010-1150 + http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html + https://bugzilla.wikimedia.org/show_bug.cgi?id=23076 + + + 2010-04-07 + 2010-05-05 + + + + + lxr -- multiple XSS vulnerabilities + + + lxr + 0.9.6 + + + + +

Dan Rosenberg reports:

+
+

There are several cross-site scripting vulnerabilities + in LXR. These vulnerabilities could allow an attacker + to execute scripts in a user's browser, steal cookies + associated with vulnerable domains, redirect the user + to malicious websites, etc.

+
+ + + + CVE-2009-4497 + ports/146337 + http://secunia.com/advisories/38117 + http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com + + + 2010-01-05 + 2010-05-05 + + + - Unintended code execution with specially crafted data in VLC + vlc -- unintended code execution with specially crafted data vlc @@ -58,6 +124,7 @@ Note: Please add new entries to the beginning of this file. 2010-04-19 2010-05-01 + 2010-05-05 -- cgit