Bug 564688 – <dev-perl/HTML-Scrubber-0.150.0: XSS vulnerability when function "comment" is enabled (CVE-2015-5667)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2015-11-02 08:25:00 UTC]

From ${URL} :

A cross-site cripting vulnerability was found in HTML::Scrubber Perl module. If the function 
"comment" is enabled, an arbitrary script may be executed on the user's web browser. Affects 
versions 0.14 and earlier.

Upstream patch:

https://github.com/nigelm/html-scrubber/commit/e1978cc37867e85c06a84a4651745235010cd6cd


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Patrice Clement 2015-11-05 22:06:12 UTC]

commit 4e1ccb5 (HEAD, master)
Author: Patrice Clement <[e-mail]>
Date:   Thu Nov 5 21:57:00 2015 +0000

    dev-perl/HTML-Scrubber: Version bump. Fixes security bug 564688.
    
    Package-Manager: portage-2.2.20.1
    Signed-off-by: Patrice Clement <[e-mail]>

 create mode 100644 dev-perl/HTML-Scrubber/HTML-Scrubber-0.150.0.ebuild

Arch teams,

Please stabilise:
=dev-perl/HTML-Scrubber-0.150.0

Target arches:
amd64 ppc ppc64 x86

Thank you.

[Comment 2 Patrice Clement 2015-11-06 12:13:38 UTC]

Please stabilise the following dependencies as well:

dev-perl/Test-NoTabs
dev-perl/Test-EOL
dev-perl/Parse-CPAN-Meta
dev-perl/Test-CPAN-Meta

Same arches and all that jazz. Cheers!

[Comment 3 Agostino Sarubbo 2015-11-06 13:44:05 UTC]

amd64 stable

[Comment 4 Jeroen Roovers (RETIRED) 2015-11-08 06:22:01 UTC]

!!! All ebuilds that could satisfy "dev-perl/Parse-CPAN-Meta" have been masked.
!!! One of the following masked packages is required to complete your request:
- dev-perl/Parse-CPAN-Meta-1.441.700::gentoo (masked by: package.mask)
/world/gentoo/portage/profiles/package.mask:
# Patrice Clement <[e-mail]> (07 Nov 2015)
# Duplicate package since it already exists as virtual/perl-Parse-CPAN-meta.
# Masked for removal in 30 days.

[Comment 5 Jeroen Roovers (RETIRED) 2015-11-08 06:25:21 UTC]

This is why you specify atoms that include a specific version/revision I guess. And the package.mask entry broke the tree.

[Comment 6 Jeroen Roovers (RETIRED) 2015-11-09 04:48:12 UTC]

Stable for PPC64.

[Comment 7 Patrice Clement 2015-11-11 10:35:51 UTC]

I masked dev-perl/Parse-CPAN-Meta and swapped this dependency for virtual/perl-Parse-CPAN-Meta. @ago: if you're seeing a package.mask warning about dev-perl/Parse-CPAN-Meta, ignore it. I didn't know there was a virtual for this package already in Portage. Sorry about the noise.

[Comment 8 Agostino Sarubbo 2015-11-12 10:26:14 UTC]

ppc stable

[Comment 9 Agostino Sarubbo 2015-11-12 10:27:37 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 10 Patrice Clement 2015-11-13 09:28:37 UTC]

commit ddffe62 (HEAD, master)
Author: Patrice Clement <[e-mail]>
Date:   Fri Nov 13 09:25:09 2015 +0000

    dev-perl/HTML-Scrubber: Remove vulnerable version. Fixes security bug 564688.
    
    Package-Manager: portage-2.2.20.1
    Signed-off-by: Patrice Clement <[e-mail]>

 delete mode 100644 dev-perl/HTML-Scrubber/HTML-Scrubber-0.90.0-r1.ebuild

[Comment 11 Andreas K. Hüttel 2015-11-22 22:19:45 UTC]

Nothing to do for us anymore.

[Comment 12 Yury German 2015-11-29 16:57:02 UTC]

Arches and Maintainer(s), Thank you for your work.

No GLSA's for Cross-Site Scripting (XSS) as per policy.
Closing [noglsa].