From owner-svn-ports-head@freebsd.org Wed May 13 20:44:19 2020 Return-Path: Delivered-To: svn-ports-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 93AF42FF8A4; Wed, 13 May 2020 20:44:19 +0000 (UTC) (envelope-from sunpoet@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 49Mmqk6gJWz4bpW; Wed, 13 May 2020 20:44:18 +0000 (UTC) (envelope-from sunpoet@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 8FCE8274C3; Wed, 13 May 2020 20:44:18 +0000 (UTC) (envelope-from sunpoet@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 04DKiITQ004016; Wed, 13 May 2020 20:44:18 GMT (envelope-from sunpoet@FreeBSD.org) Received: (from sunpoet@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 04DKiIeo004015; Wed, 13 May 2020 20:44:18 GMT (envelope-from sunpoet@FreeBSD.org) Message-Id: <202005132044.04DKiIeo004015@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: sunpoet set sender to sunpoet@FreeBSD.org using -f From: Sunpoet Po-Chuan Hsieh Date: Wed, 13 May 2020 20:44:18 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r535178 - head/security/vuxml X-SVN-Group: ports-head X-SVN-Commit-Author: sunpoet X-SVN-Commit-Paths: head/security/vuxml X-SVN-Commit-Revision: 535178 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 May 2020 20:44:19 -0000 Author: sunpoet Date: Wed May 13 20:44:17 2020 New Revision: 535178 URL: https://svnweb.freebsd.org/changeset/ports/535178 Log: Document typo3 vulnerability Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed May 13 20:42:38 2020 (r535177) +++ head/security/vuxml/vuln.xml Wed May 13 20:44:17 2020 (r535178) @@ -58,6 +58,108 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + typo3 -- multiple vulnerabilities + + + typo3-9-php72 + typo3-9-php73 + typo3-9-php74 + 9.5.17 + + + typo3-10-php72 + typo3-10-php73 + typo3-10-php74 + 10.4.2 + + + + +

Typo3 News:

+
CVE-2020-11063: TYPO3-CORE-SA-2020-001: Information Disclosure in + Password Reset
+
It has been discovered that time-based attacks can be used with the + password reset functionality for backend users. This allows an attacker + to verify whether a backend user account with a given email address + exists or not.
+
+
CVE-2020-11064: TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form + Engine
+
It has been discovered that HTML placeholder attributes containing + data of other database records are vulnerable to cross-site scripting. A + valid backend user account is needed to exploit this vulnerability.
+
+
CVE-2020-11065: TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link + Handling
+
It has been discovered that link tags generated by typolink + functionality are vulnerable to cross-site scripting - properties being + assigned as HTML attributes have not been parsed correctly.
+
+
CVE-2020-11066: TYPO3-CORE-SA-2020-004: Class destructors causing + side-effects when being unserialized
+
Calling unserialize() on malicious user-submitted content can result + in the following scenarios:
+
- trigger deletion of arbitrary directory in file system (if writable + for web server)
+
- trigger message submission via email using identity of web site + (mail relay)
+
Another insecure deserialization vulnerability is required to actually + exploit mentioned aspects.
+
+
CVE-2020-11067: TYPO3-CORE-SA-2020-005: Insecure Deserialization in + Backend User Settings
+
It has been discovered that backend user settings (in $BE_USER->uc) are + vulnerable to insecure deserialization. In combination with + vulnerabilities of 3rd party components this can lead to remote code + execution. A valid backend user account is needed to exploit this + vulnerability.
+
+
CVE-2020-11069: TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to + Backend User Interface
+
It has been discovered that the backend user interface and install tool + are vulnerable to same-site request forgery. A backend user can be + tricked into interacting with a malicious resource an attacker + previously managed to upload to the web server - scripts are then + executed with the privileges of the victims’ user session.
+
In a worst case scenario new admin users can be created which can + directly be used by an attacker. The vulnerability is basically a + cross-site request forgery (CSRF) triggered by a cross-site scripting + vulnerability (XSS) - but happens on the same target host - thus, it’ + actually a same-site request forgery (SSRF).
+
Malicious payload such as HTML containing JavaScript might be provided + by either an authenticated backend user or by a non-authenticated user + using a 3rd party extension - e.g. file upload in a contact form with + knowing the target location.
+
The attacked victim requires an active and valid backend or install + tool user session at the time of the attack to be successful.
+

+ + + + https://typo3.org/article/typo3-1042-and-9517-security-releases-published + https://get.typo3.org/release-notes/9.5.17 + https://get.typo3.org/release-notes/10.4.2 + https://typo3.org/security/advisory/typo3-core-sa-2020-001 + https://typo3.org/security/advisory/typo3-core-sa-2020-002 + https://typo3.org/security/advisory/typo3-core-sa-2020-003 + https://typo3.org/security/advisory/typo3-core-sa-2020-004 + https://typo3.org/security/advisory/typo3-core-sa-2020-005 + https://typo3.org/security/advisory/typo3-core-sa-2020-006 + CVE-2020-11063 + CVE-2020-11064 + CVE-2020-11065 + CVE-2020-11066 + CVE-2020-11067 + CVE-2020-11069 + + + 2020-05-12 + 2020-05-13 + + + FreeBSD -- Insufficient cryptodev MAC key length check