Bug 170041

Summary:	www-apps/trac-0.10.3.1 security release (XSS)
Product:	Gentoo Security	Reporter:	Julien Allanos (RETIRED) <dju>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1
Whiteboard:	B4 [noglsa] Falco
Package list:		Runtime testing required:	---

Description Julien Allanos (RETIRED) gentoo-dev

2007-03-08 22:59:52 UTC

Trac 0.10.3.1 is a security release:

* Always send "Content-Disposition: attachment" headers where
   potentially unsafe (user provided) content is available for download.
   This behaviour can be altered using the "render_unsafe_content"
   option in the "attachment" and "browser" sections of trac.ini.
* Fixed XSS vulnerability in "download wiki page as text" in
   combination with Microsoft IE. Reported by Yoshinori Oota, Business
   Architects Inc.

x86 and ppc stable required, thanks all.

Comment 1 Christian Faulhammer (RETIRED) gentoo-dev

2007-03-09 07:22:34 UTC

x86 runs just fine, thus goes stable.

Comment 2 Tobias Scherbaum (RETIRED) gentoo-dev

2007-03-20 20:25:37 UTC

ppc stable

Comment 3 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev

2007-03-20 21:10:34 UTC

I tend to vote NO.

Comment 4 Pierre-Yves Rofes (RETIRED) gentoo-dev

2007-03-25 11:46:36 UTC

voting no

Comment 5 Raphael Marichez (Falco) (RETIRED) gentoo-dev

2007-03-26 22:26:17 UTC

another no, closing. Feel free to reopen if you disagree