Vulnerability Details
=====================
Class: Cross-Site Request Forgery
Versions: 4.0.2 to 4.0.4, 4.1.1 to 4.2rc2
Fixed In: 4.0.5, 4.2
Description: Due to a lack of validation of the enctype form
attribute when making POST requests to xmlrpc.cgi,
a possible CSRF vulnerability was discovered. If a user
visits an HTML page with some malicious HTML code in it,
an attacker could make changes to a remote Bugzilla installation
on behalf of the victim's account by using the XML-RPC API
on a site running mod_perl. Sites running under mod_cgi
are not affected. Also the user would have had to be
already logged in to the target site for the vulnerability
to work.
References: https://bugzilla.mozilla.org/show_bug.cgi?id=725663
CVE Number: CVE-2012-0453
Approved by: skv (implicit)
This is an incremental update and should be much easier to handle than
the transition from 4.6.5 to 4.7.2 in the ports tree.
The official release notes can be found at
http://www.kde.org/announcements/announce-4.7.3.php.
Approved by: avilla (mentor), makc (mentor), portmgr (miwi)
Feature safe: yes
had both lines:
Author: ...
WWW: ....
So standardize on that, and move them to the end of the file when necessary.
Also fix some more whitespace, and remove more "signature tags" of varying
forms, like -- name, etc.
s/AUTHOR/Author/
A few other various formatting issues
- Name
em@i.l
or variations thereof. While I'm here also fix some whitespace and other
formatting errors, including moving WWW: to the last line in the file.
4.7.2. The official release notes can be found at:
http://kde.org/announcements/announce-4.7.2.php
This release ships with many improvements. Read more about them here:
http://FreeBSD.kde.org/news.php#itemKDESC472availableinports
We'd like to say thanks to all testers and contributors, especially to
lwhsu@ for his effort on hosting our test packages.
PR: 156293 [1]
159219 [2]
160164 [3]
Submitted by: Oleg Sidorkin <osidorkin@gmail.com> [1]
Alvaro Castillo <gobledb@gmail.com> [2]
dkeav04@gmail.com [3]
Tested by: exp-run via pav
