Bug 170041 – www-apps/trac-0.10.3.1 security release (XSS)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Julien Allanos (RETIRED) 2007-03-08 22:59:52 UTC]

Trac 0.10.3.1 is a security release:

* Always send "Content-Disposition: attachment" headers where
   potentially unsafe (user provided) content is available for download.
   This behaviour can be altered using the "render_unsafe_content"
   option in the "attachment" and "browser" sections of trac.ini.
* Fixed XSS vulnerability in "download wiki page as text" in
   combination with Microsoft IE. Reported by Yoshinori Oota, Business
   Architects Inc.

x86 and ppc stable required, thanks all.

[Comment 1 Christian Faulhammer (RETIRED) 2007-03-09 07:22:34 UTC]

x86 runs just fine, thus goes stable.

[Comment 2 Tobias Scherbaum (RETIRED) 2007-03-20 20:25:37 UTC]

ppc stable

[Comment 3 Sune Kloppenborg Jeppesen (RETIRED) 2007-03-20 21:10:34 UTC]

I tend to vote NO.

[Comment 4 Pierre-Yves Rofes (RETIRED) 2007-03-25 11:46:36 UTC]

voting no

[Comment 5 Raphael Marichez (Falco) (RETIRED) 2007-03-26 22:26:17 UTC]

another no, closing. Feel free to reopen if you disagree