047bb6ad21
The following security issues are fixed with this update: * Resolve buffer overflow when handling "config" file requests (CVE-2016-2054) * Restrict "config" files to regular files inside the $XYMONHOME/etc/ directory (symlinks disallowed) (CVE-2016-2055). Also, require that the initial filename end in '.cfg' by default * Resolve shell command injection vulnerability in useradm and chpasswd CGIs (CVE-2016-2056) * Tighten permissions on the xymond BFQ used for message submission to restrict access to the xymon user and group. It is now 0620. (CVE-2016-2057) * Restrict javascript execution in current and historical status messages by the addition of appropriate Content-Security-Policy headers to prevent XSS attacks. (CVE-2016-2058) * Fix CVE-2015-1430, a buffer overflow in the acknowledge.cgi script. Thank you to Mark Felder for noting the impact and Martin Lenko for the original patch. * Mitigate CVE-2014-6271 (bash 'Shell shock' vulnerability) by eliminating the shell script CGI wrappers Please refer to https://sourceforge.net/projects/xymon/files/Xymon/4.3.25/Changes/download for further information on fixes and new features.
15 lines
985 B
Text
15 lines
985 B
Text
$NetBSD: distinfo,v 1.14 2016/02/16 05:58:57 spz Exp $
|
|
|
|
SHA1 (xymon-4.3.25.tar.gz) = 049bf7e908032e9780e3c67fd5e10dd399c811f3
|
|
RMD160 (xymon-4.3.25.tar.gz) = 1c8315e88a5b418d77e7c6e1c4f5f2e034f049e3
|
|
SHA512 (xymon-4.3.25.tar.gz) = c438ecaac18ca64222643fa361254e7c7a27c60ca3bb27fc092da8182e7c1c7862677b544e4d634ae73bbaa7954a3bb0920ce570d99e8ffd899419119075a940
|
|
Size (xymon-4.3.25.tar.gz) = 2996840 bytes
|
|
SHA1 (patch-aa) = c44f791ef6005c809127175cb563bd8f0ac74642
|
|
SHA1 (patch-ab) = db0c5808cfad75aaf37217509399597191236180
|
|
SHA1 (patch-ac) = e36db5081c7461eeec32a9be6e480c8d9643ea41
|
|
SHA1 (patch-ad) = 7519eaeecab9f5d4b6956e0fd426548ec7990a0b
|
|
SHA1 (patch-ae) = 218ef05eb3d51d779230c357d731b2f904d4559f
|
|
SHA1 (patch-af) = 5e71a56cf827f9b30147dd577c295f10c150cd27
|
|
SHA1 (patch-build_Makefile.FreeBSD) = e58b50f35068cba6fed89cc21bcc4eb7d30efd23
|
|
SHA1 (patch-client_xymonclient-netbsd.sh) = 739a201806144ef0e34c1f668ad3a4d9e2b9f9fb
|
|
SHA1 (patch-configure) = 305a74a2383dcd37ea93456272d4254483023aa5
|