mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2024-11-28 01:06:17 +00:00
Code Issues Releases Activity

Document a jQuery related XSS security fix in rt4.4.4 and rt4.2.16

Browse Source 
Note: the release notes also mention 3 other security issues in perl
modules depended on by these packages.  Of those, vulnerabilities in
the Email::Address and Email::Address::List perl modules have already
been addressed in their respective ports, while the third: HTML::Gumbo
is not currently in the ports at all.
This commit is contained in:
Matthew Seaman 2019-03-06 07:31:17 +00:00
parent b7e945f9df
commit b1515acacc
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=494780
1 changed files with 40 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
security/vuxml/vuln.xml
View File

@ -58,6 +58,46 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42">
<topic>rt -- XSS via jQuery</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.16</lt></range>
</package>
<package>
<name>rt44</name>
<range><ge>4.4.0</ge><lt>4.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical reports:</p>
<blockquote cite="https://docs.bestpractical.com/release-notes/rt/4.4.4">
<p>The version of jQuery used in RT 4.2 and 4.4 has a
Cross-site Scripting (XSS) vulnerability when using
cross-domain Ajax requests. This vulnerability is assigned
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251">CVE-2015-9251</a>. RT
does not use this jQuery feature so it is not directly
vulnerable. jQuery version 1.12 no longer receives official
updates, however a fix was posted with recommendations for
applications to patch locally, so RT will follow this
recommendation and ship with a patched version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.bestpractical.com/release-notes/rt/4.4.4</url>
<url>https://docs.bestpractical.com/release-notes/rt/4.2.16</url>
<cvename>CVE-2015-9251</cvename>
</references>
<dates>
<discovery>2019-03-05</discovery>
<entry>2019-03-06</entry>
</dates>
</vuln>
<vuln vid="526d9642-3ae7-11e9-a669-8c164582fbac">
<topic>slixmpp -- improper access control</topic>
<affects>