From owner-svn-ports-all@FreeBSD.ORG Tue Nov 27 20:09:35 2012 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id BCF67B6F; Tue, 27 Nov 2012 20:09:35 +0000 (UTC) (envelope-from ohauer@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id A272E8FC08; Tue, 27 Nov 2012 20:09:35 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.5/8.14.5) with ESMTP id qARK9Znt048161; Tue, 27 Nov 2012 20:09:35 GMT (envelope-from ohauer@svn.freebsd.org) Received: (from ohauer@localhost) by svn.freebsd.org (8.14.5/8.14.5/Submit) id qARK9Z6c048158; Tue, 27 Nov 2012 20:09:35 GMT (envelope-from ohauer@svn.freebsd.org) Message-Id: <201211272009.qARK9Z6c048158@svn.freebsd.org> From: Olli Hauer Date: Tue, 27 Nov 2012 20:09:35 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r307861 - in head: security/vuxml www/yahoo-ui X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Nov 2012 20:09:35 -0000 Author: ohauer Date: Tue Nov 27 20:09:34 2012 New Revision: 307861 URL: http://svnweb.freebsd.org/changeset/ports/307861 Log: - document www/yahoo-ui security issue and mark port forbidden [1] pet portlint (maintainer is already notified) - adjust CVE entries for bugzilla (CVE-2012-5475 was rejected) [2] Feature safe: yes Security: CVE-2012-5881 [1][2] CVE-2012-5882 [1][2] CVE-2012-5883 [2] Approved by: glarkin (implicit) [1] Modified: head/security/vuxml/vuln.xml head/www/yahoo-ui/Makefile Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue Nov 27 19:32:44 2012 (r307860) +++ head/security/vuxml/vuln.xml Tue Nov 27 20:09:34 2012 (r307861) @@ -51,6 +51,40 @@ Note: Please add new entries to the beg --> + + YUI JavaScript library -- JavaScript injection exploits in Flash components + + + yahoo-ui + 3.0.0 + + + + +

The YUI team reports:

+
Vulnerability in YUI 2.4.0 through YUI 2.9.0
+
A XSS vulnerability has been discovered in some YUI 2 .swf files + from versions 2.4.0 through 2.9.0. This defect allows JavaScript + injection exploits to be created against domains that host affected + YUI .swf files.
+
If your site loads YUI 2 from a CDN (yui.yahooapis.com, + ajax.googleapis.com, etc.) and not from your own domain, you + are not affected. YUI 3 is not affected by this issue.
+

+ + + + CVE-2012-5881 + CVE-2012-5882 + http://yuilibrary.com/support/20121030-vulnerability/ + + + 2012-10-30 + 2012-12-27 + + + chromium -- multiple vulnerabilities @@ -450,13 +484,16 @@ Note: Please add new entries to the beg https://bugzilla.mozilla.org/show_bug.cgi?id=802204 CVE-2012-4189 https://bugzilla.mozilla.org/show_bug.cgi?id=790296 - CVE-2012-5475 + CVE-2012-5881 + CVE-2012-5882 + CVE-2012-5883 https://bugzilla.mozilla.org/show_bug.cgi?id=808845 http://yuilibrary.com/support/20121030-vulnerability/ 2012-11-13 2012-11-14 + 2012-11-27 Modified: head/www/yahoo-ui/Makefile ============================================================================== --- head/www/yahoo-ui/Makefile Tue Nov 27 19:32:44 2012 (r307860) +++ head/www/yahoo-ui/Makefile Tue Nov 27 20:09:34 2012 (r307861) @@ -10,13 +10,15 @@ DISTNAME= yui_${PORTVERSION}r1 MAINTAINER= glarkin@FreeBSD.org COMMENT= The Yahoo! User Interface (YUI) Library +LICENSE= BSD + +FORBIDDEN= CVE-2012-5881 Cross-site scripting (XSS) vulnerability in the Flash component infrastructure + USE_ZIP= yes WRKSRC= ${WRKDIR}/yui NO_BUILD= yes -LICENSE= BSD - OPTIONS= APACHE "Configure for Apache-2.x" off \ MINIMAL "Do not install documentation and examples" off