From owner-svn-ports-all@freebsd.org Tue Sep 26 21:32:57 2017 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C0EA8E2278A; Tue, 26 Sep 2017 21:32:57 +0000 (UTC) (envelope-from swills@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 9B36A778A7; Tue, 26 Sep 2017 21:32:57 +0000 (UTC) (envelope-from swills@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v8QLWuLK063977; Tue, 26 Sep 2017 21:32:56 GMT (envelope-from swills@FreeBSD.org) Received: (from swills@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v8QLWuEw063975; Tue, 26 Sep 2017 21:32:56 GMT (envelope-from swills@FreeBSD.org) Message-Id: <201709262132.v8QLWuEw063975@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: swills set sender to swills@FreeBSD.org using -f From: Steve Wills Date: Tue, 26 Sep 2017 21:32:56 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r450699 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: swills X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 450699 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Sep 2017 21:32:57 -0000 Author: swills Date: Tue Sep 26 21:32:56 2017 New Revision: 450699 URL: https://svnweb.freebsd.org/changeset/ports/450699 Log: Document sugarcrm issue Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Sep 26 20:35:45 2017 (r450698) +++ head/security/vuxml/vuln.xml Tue Sep 26 21:32:56 2017 (r450699) @@ -58,6 +58,41 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + sugarcrm -- multiple vulnerabilities + + + sugarcrm + 6.5.26 + + + + +

sugarcrm developers reports:

+
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.
+
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.
+
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.
+

+ + + + https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ + https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/ + https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ + https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/ + https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ + https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/ + CVE-2017-14508 + CVE-2017-14509 + CVE-2017-14510 + + + 2017-9-17 + 2017-9-26 + + + libzip -- denial of service