From owner-freebsd-ports-bugs@FreeBSD.ORG Mon Sep 3 20:50:02 2007 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5B87016A41A for ; Mon, 3 Sep 2007 20:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 3D5A813C49D for ; Mon, 3 Sep 2007 20:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.1/8.14.1) with ESMTP id l83Ko2Xp017277 for ; Mon, 3 Sep 2007 20:50:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.1/8.14.1/Submit) id l83Ko2OK017275; Mon, 3 Sep 2007 20:50:02 GMT (envelope-from gnats) Resent-Date: Mon, 3 Sep 2007 20:50:02 GMT Resent-Message-Id: <200709032050.l83Ko2OK017275@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nick Barkas Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5840516A419 for ; Mon, 3 Sep 2007 20:44:16 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 32F4113C467 for ; Mon, 3 Sep 2007 20:44:16 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.1/8.14.1) with ESMTP id l83KiGOa091542 for ; Mon, 3 Sep 2007 20:44:16 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.1/8.14.1/Submit) id l83KiGpv091541; Mon, 3 Sep 2007 20:44:16 GMT (envelope-from nobody) Message-Id: <200709032044.l83KiGpv091541@www.freebsd.org> Date: Mon, 3 Sep 2007 20:44:16 GMT From: Nick Barkas To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: ports/116060: [patch] security/vuxml update for vulnerabilities in devel/bugzilla and other bugzilla ports X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Sep 2007 20:50:02 -0000 >Number: 116060 >Category: ports >Synopsis: [patch] security/vuxml update for vulnerabilities in devel/bugzilla and other bugzilla ports >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Mon Sep 03 20:50:01 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Nick Barkas >Release: 7.0-CURRENT >Organization: Three Rings Design >Environment: FreeBSD freebsd-current.localdomain 7.0-CURRENT-200706 FreeBSD 7.0-CURRENT-200706 #0: Sun Jun 3 18:41:02 UTC 2007 root@almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: http://www.bugzilla.org/security/2.20.4/ lists a number of vulnerabilities in Bugzilla. This is an update to the VuXML document to notify users of Bugzilla ports about these. >How-To-Repeat: >Fix: Patch attached with submission follows: diff -urN vuxml.orig/vuln.xml vuxml/vuln.xml --- vuxml.orig/vuln.xml Mon Sep 3 21:58:32 2007 +++ vuxml/vuln.xml Mon Sep 3 22:38:29 2007 @@ -34,6 +34,53 @@ --> + + bugzilla -- multiple vulnerabilities + + + bugzilla + ja-bugzilla + 3.0.1 + + + bugzilla2 + 2.22.3 + + + + +

A Bugzilla Security Advisory reports:

+
+

This advisory covers three security issues that have recently been + fixed in the Bugzilla code:

+
    +
  • A possible cross-site scripting (XSS) vulnerability when filing + bugs using the guided form.
    • +
  • When using email_in.pl, insufficiently escaped data may be + passed to sendmail.
    • +
  • Users using the WebService interface may access Bugzilla's + time-tracking fields even if they normally cannot see them.
    • +
+

We strongly advise that 2.20.x and 2.22.x users should upgrade to + 2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or + below, should upgrade to 3.0.1.

+
+ + + + http://www.bugzilla.org/security/2.20.4/ + CVE-2007-4538 + CVE-2007-4539 + CVE-2007-4543 + 25425 + http://secunia.com/advisories/26584 + + + 2007-8-23 + 2007-9-3 + + + fetchmail -- denial of service on reject of local warning message >Release-Note: >Audit-Trail: >Unformatted: