Bug 123373 - [patch] Fix security issue in graphics/swfdec (update to 0.6.6)
Summary: [patch] Fix security issue in graphics/swfdec (update to 0.6.6)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Henrik Brix Andersen
Depends on:
Reported: 2008-05-03 20:00 UTC by Henrik Brix Andersen
Modified: 2008-05-08 19:20 UTC (History)
1 user (show)

See Also:

swfdec.diff (2.31 KB, patch)
2008-05-03 20:00 UTC, Henrik Brix Andersen
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Henrik Brix Andersen 2008-05-03 20:00:06 UTC
From http://secunia.com/advisories/29915/ :

"A vulnerability has been reported in swfdec, which can be exploited
by malicious people to disclose sensitive information.

The vulnerability is caused due to swfdec not properly restricting
untrusted sandboxes from reading local files, which can be exploited
to disclose the content of arbitrary local files by e.g. tricking a
user into visiting a malicious website.

The vulnerability is reported in versions prior to 0.6.4."

The files/patch-swfdec-gtk_swfdec_gtk_system.c patch is not needed
with this release.

Fix: The patch below updates graphics/swfdec to version 0.6.6. It also
fixes a problem with inclusion of bsd.port.*.mk (.pre.mk must be
included prior to testing OPTIONS).
Comment 1 Edwin Groothuis freebsd_committer 2008-05-03 20:00:15 UTC
Responsible Changed
From-To: freebsd-ports-bugs->alexbl

Over to maintainer (via the GNATS Auto Assign Tool)
Comment 2 Henrik Brix Andersen freebsd_committer 2008-05-08 17:00:00 UTC
Responsible Changed
From-To: alexbl->brix

I will handle this (security/maintainer-timeout).
Comment 3 dfilter service freebsd_committer 2008-05-08 19:12:11 UTC
brix        2008-05-08 18:12:05 UTC

  FreeBSD ports repository

  Modified files:
    graphics/swfdec      Makefile distinfo 
  Removed files:
    graphics/swfdec/files patch-swfdec-gtk_swfdec_gtk_system.c 
  - Update to version 0.6.6 (security update)
  - Fix problem with inclusion of bsd.port.*.mk (.pre.mk must be
    included prior to testing OPTIONS)
  PR:             ports/123373
  Submitted by:   myself
  Approved by:    maintainer-timeout, linimon (portmgr), erwin (mentor)
  Security:       http://www.vuxml.org/freebsd/5ef12755-1c6c-11dd-851d-0016d325a0ed.html
  Revision  Changes    Path
  1.53      +5 -3      ports/graphics/swfdec/Makefile
  1.19      +3 -3      ports/graphics/swfdec/distinfo
  1.2       +0 -16     ports/graphics/swfdec/files/patch-swfdec-gtk_swfdec_gtk_system.c (dead)
cvs-all@freebsd.org mailing list
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
Comment 4 Henrik Brix Andersen freebsd_committer 2008-05-08 19:12:46 UTC
State Changed
From-To: open->closed