Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 11: 2009-8507 Moderate Update for ViewVC XSS Vulnerability Fix

fedora
Calendar Grey August 12, 2009
Dist Fedora Esm H88
The Fedora 11 release addresses security vulnerabilities linked to XSS in ViewVC, boosts encoding recognition capabilities, and refines the management of error responses.
CHANGES in 1.1.2: - security fix: validate the 'view' parameter to avoid XSS attack - security fix: avoid printing illegal parameter names and values - add optional support f...

Summary

ViewVC is a browser interface for CVS and Subversion version control

repositories. It generates templatized HTML to present navigable directory,

revision, and change log listings. It can display specific versions of files

as well as diffs between those versions. Basically, ViewVC provides the bulk

of the report-like functionality you expect out of your version control tool,

but much more prettily than the average textual command-line program output.

Update Information:

CHANGES in 1.1.2: - security fix: validate the 'view' parameter to avoid XSS attack - security fix: avoid printing illegal parameter names and values - add optional support for character encoding detection (issue #400) - fix username case handling in svnauthz module (issue #419) - fix cvsdbadmin/svnadmin rebuild error on missing repos (issue #420) - don't drop leading blank lines from colorized file contents (issue #422) - add file.ezt template logic for optionally hiding binary file contents Also includes: Install and populate mimetypes.conf. This should hopefully help when colouring syntax using pygments. Install and populate mimetypes.conf.

Topics%20covered

Topics Covered

security advisory software update Fedora XSS attack error handling ViewVC encoding detection

Change Log

* Wed Aug 12 2009 Bojan Smojver - 1.1.2-2 - fix replacement of varius config variables * Wed Aug 12 2009 Bojan Smojver - 1.1.2-1 - bump up to 1.1.2 - security fix: validate the 'view' parameter to avoid XSS attack - security fix: avoid printing illegal parameter names and values * Tue Aug 11 2009 Bojan Smojver - 1.1.1-2 - install mimetypes.conf - populate mimetypes.conf with what pygments understands * Thu Jun 4 2009 Bojan Smojver - 1.1.1-1 - Bump up to 1.1.1 * Thu May 14 2009 Bojan Smojver - 1.1.0-1 - Final 1.1.0

References


[ 1 ] Bug #516958 - default viewvc.conf changed, paths need fixing https://bugzilla.redhat.com/show_bug.cgi?id=516958 [ 2 ] Bug #514909 - RFE: mimetypes.conf should be in /etc/viewvc/ https://bugzilla.redhat.com/show_bug.cgi?id=514909 [ 3 ] Bug #514773 - syntax highlighting not working https://bugzilla.redhat.com/show_bug.cgi?id=514773

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update viewvc' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
important
Lowest
Low
Medium
High
Critical

Name: viewvc
Product: Fedora 11
Version: 1.1.2
Release: 2.fc11
URL: https://www.viewvc.org/
Summary: Browser interface for CVS and SVN version control repositories

Topics%20covered

Topics Covered

security advisory software update Fedora XSS attack error handling ViewVC encoding detection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here