frugalware-1.2 (Locris)
Mar 8, 2010
frugalware-1.1 (Getorin)
Sep 7, 2009
frugalware-1.0 (Anacreon)
Mar 22, 2009
frugalware-0.9 (Solaria)
Sep 9, 2008
frugalware-0.8 (Kalgan)
Mar 11, 2008
frugalware-0.7 (Sayshell)
Oct 13, 2007
frugalware-0.6 (Terminus)
Mar 22, 2007
frugalware-0.5 (Siwenna)
Sep 14, 2006
frugalware-0.4 (Wanda)
Mar 30, 2006
frugalware-0.3 (Trantor)
Oct 13, 2005
frugalware-0.2 (Aurora)
Apr 28, 2005
frugalware-0.1 (Genesis)
Nov 02, 2004
Donate to support our development efforts.
|
|
|
|
|
|
| Пакет: | drupal6-i18n |
| Дата: | 2010-03-12 |
| Опубликовано: | Miklos Vajna |
| Уязвимая версия: | 6.x_1.2-1 |
| Неподверженная уязвимости версия: | 6.x_1.3-1locris1 |
| Запись в трекере ошибок: | http://bugs.frugalware.org/task/4134 |
| CVE: | No CVE references, see http://drupal.org/node/731632. |
| Описание: | See FSA641 for details. |
| Пакет: | drupal-i18n |
| Дата: | 2010-03-12 |
| Опубликовано: | Miklos Vajna |
| Уязвимая версия: | 5.x_2.5-1 |
| Неподверженная уязвимости версия: | 5.x_2.6-1locris1 |
| Запись в трекере ошибок: | http://bugs.frugalware.org/task/4134 |
| CVE: | No CVE references, see http://drupal.org/node/731632. |
| Описание: | A vulnerability has been reported in the Internationalization module for Drupal, which can be exploited by malicious users to compromise a vulnerable system. Certain unspecified input is not properly sanitised before being used to translate the text. This can be exploited to execute arbitrary PHP code by passing a malicious string to the input filter. |
| Пакет: | drupal6 |
| Дата: | 2010-03-11 |
| Опубликовано: | Miklos Vajna |
| Уязвимая версия: | 6.15-1 |
| Неподверженная уязвимости версия: | 6.16-1locris1 |
| Запись в трекере ошибок: | http://bugs.frugalware.org/task/4133 |
| CVE: | No CVE references, see http://drupal.org/node/731710. |
| Описание: | See FSA639 for details. |
| Пакет: | drupal |
| Дата: | 2010-03-11 |
| Опубликовано: | Miklos Vajna |
| Уязвимая версия: | 5.21-1 |
| Неподверженная уязвимости версия: | 5.22-2locris1 |
| Запись в трекере ошибок: | http://bugs.frugalware.org/task/4132 |
| CVE: | No CVE references, see http://drupal.org/node/731710. |
| Описание: | Some vulnerabilities have been reported in Drupal, which can be exploited by malicious users to conduct script insertion attacks and bypass certain security restrictions. 1) Input passed via the "langcode", "name", and "native" parameters in the languages interface while using the Locale module is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires "administer languages" permissions. 2) An error in the handling of certain sessions can be exploited to maintain an open session despite the user being blocked. |
| Пакет: | wordpress |
| Дата: | 2010-03-10 |
| Опубликовано: | Miklos Vajna |
| Уязвимая версия: | 2.9.1-1 |
| Неподверженная уязвимости версия: | 2.9.2-1locris1 |
| Запись в трекере ошибок: | http://bugs.frugalware.org/task/4131 |
| CVE: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0682 |
| Описание: | A vulnerability has been discovered in WordPress, which can be exploited by malicious users to bypass certain security restrictions. The vulnerability is caused due to WordPress not properly restricting access to trashed posts, which can be exploited to e.g. view a trashed post by accessing it's page directly. Successful exploitation requires a valid user account. |
| Пакет: | xar |
| Дата: | 2010-03-09 |
| Опубликовано: | Miklos Vajna |
| Уязвимая версия: | 1.5.2-1 |
| Неподверженная уязвимости версия: | 1.5.2-2locris1 |
| Запись в трекере ошибок: | http://bugs.frugalware.org/task/4128 |
| CVE: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0055 |
| Описание: | Braden Thomas from Apple has discovered a signature verification bypass issue in xar. The issue is that xar_open assumes that the checksum is stored at offset 0, but xar_signature_copy_signed_data uses xar property "checksum/offset" to find the offset to the checksum when validating the signature. As a result, a modified xar archive can pass signature validation by putting the checksum for the modified TOC at offset 0, pointing "checksum/offset" at the non-modified checksum at a higher offset, and using the original non-modified signature. |