kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

- Document vulnerabilities in typo3.

Browse source 
Security:       b9a347ac-8671-11e2-b73c-0019d18c446a
Obtained from:  http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/
This commit is contained in:
Frederic Culot 2013-03-06 15:56:59 +00:00
parent 27dac82f8c
commit 564cfec669
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=313525
1 changed files with 42 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
security/vuxml/vuln.xml
View file

@ -51,6 +51,48 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="b9a347ac-8671-11e2-b73c-0019d18c446a">
<topic>typo3 -- Multiple vulnerabilities in TYPO3 Core</topic>
<affects>
<package>
<name>typo3</name>
<range><ge>4.5.0</ge><lt>4.5.23</lt></range>
<range><ge>4.6.0</ge><lt>4.6.16</lt></range>
<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
<range><ge>6.0.0</ge><lt>6.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo Security Team reports:</p>
<blockquote cite="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/">
<p>Extbase Framework - Failing to sanitize user input, the Extbase
database abstraction layer is susceptible to SQL Injection. TYPO3
sites which have no Extbase extensions installed are not affected.
Extbase extensions are affected if they use the Query Object Model
and relation values are user generated input. Credits go to Helmut
Hummel and Markus Opahle who discovered and reported the issue.</p>
<p>Access tracking mechanism - Failing to validate user provided
input, the access tracking mechanism allows redirects to arbitrary
URLs. To fix this vulnerability, we had to break existing
behaviour of TYPO3 sites that use the access tracking mechanism
(jumpurl feature) to transform links to external sites. The link
generation has been changed to include a hash that is checked
before redirecting to an external URL. This means that old links
that have been distributed (e.g. by a newsletter) will not work
any more.</p>
</blockquote>
</body>
</description>
<references>
<url>http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/</url>
</references>
<dates>
<discovery>2013-03-06</discovery>
<entry>2013-03-06</entry>
</dates>
</vuln>
<vuln vid="40d5ab37-85f2-11e2-b528-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>