Date: Thu, 13 Dec 2012 10:30:54 -0900 From: Beech Rintoul <beech@freebsdnorth.com> To: Eitan Adler <eadler@freebsd.org> Cc: svn-ports-head@freebsd.org, svn-ports-all@freebsd.org, ports-secteam@freebsd.org, Beech Rintoul <beech@freebsd.org>, ports-committers@freebsd.org Subject: Re: svn commit: r308867 - head/www/hastymail2 Message-ID: <201212131030.54563.beech@freebsdnorth.com> In-Reply-To: <CAF6rxgmsHq=GfsPvCkQJQD168RjToYxQ%2BziotvyLWrJgHfeF0w@mail.gmail.com> References: <201212131904.qBDJ4u9M095797@svn.freebsd.org> <CAF6rxgmsHq=GfsPvCkQJQD168RjToYxQ%2BziotvyLWrJgHfeF0w@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 13 December 2012 10:08:45 Eitan Adler wrote: > On 13 December 2012 14:04, Beech Rintoul <beech@freebsd.org> wrote: > > Author: beech > > Date: Thu Dec 13 19:04:56 2012 > > New Revision: 308867 > > URL: http://svnweb.freebsd.org/changeset/ports/308867 > > > > Log: > > - Update to 1.1 final. > > - Security vulnerabilities are fixed in this version. > > Which ones? Is there a vuxml to go along with this? No vuxml and no mention of security vulnerabilities in previous pr's. The website shows the following which doesn't appear anywhere else: Two security issues have been recently discovered in Hastymail. Both are fixed in this latest release. All users are encouraged to upgrade to the 1.1 version to protect themselves from these issues. Remote code execution: In order for this issue to be exploitable sites must have the notices plugin enabled in Hastymail, and register_globals and allow_url_fopen enabled in PHP. It is STRONGLY recommended that you do not have register_globals enabled in PHP. Upgrading to the 1.1 version resolves this bug, or you can update the hastymail2/plugins/notices/test_sounds.php file to the latest version in SVN found here: http://hastymail.svn.sourceforge.net/viewvc/hastymail/trunk/hastymail2/plugins/notices/test_sound.php?revision=2074 XXS exploit on thread view: Shai Rod reported an issue on the thread view page that allows specially crafted message subjects to execute javascript code when viewed on the thread view page. Several files had to be modified to correct this issue so it is recommended that sites upgrade to version 1.1 to mitigate this issue.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201212131030.54563.beech>