svn commit: r502721 - head/security/vuxml
Carlo Strub
cs at FreeBSD.org
Sun May 26 13:55:40 UTC 2019
Author: cs
Date: Sun May 26 13:55:39 2019
New Revision: 502721
URL: https://svnweb.freebsd.org/changeset/ports/502721
Log:
Serendipity -- XSS
Security: CVE-2019-11870
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Sun May 26 13:54:01 2019 (r502720)
+++ head/security/vuxml/vuln.xml Sun May 26 13:55:39 2019 (r502721)
@@ -58,6 +58,32 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="3ba87032-7fbd-11e9-8a5f-c85b76ce9b5a">
+ <topic>serendipity -- XSS</topic>
+ <affects>
+ <package>
+ <name>serendipity</name>
+ <range><lt>2.1.5</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>MITRE:</p>
+ <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11870">
+ <p>Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html</url>
+ <cvename>CVE-2019-11870</cvename>
+ </references>
+ <dates>
+ <discovery>2019-05-01</discovery>
+ <entry>2019-05-26</entry>
+ </dates>
+ </vuln>
+
<vuln vid="36b905ad-7fbb-11e9-8a5f-c85b76ce9b5a">
<topic>sqlite3 -- use after free</topic>
<affects>
More information about the svn-ports-head
mailing list