svn commit: r331887 - in head: security/vuxml www/mod_pagespeed

Mon Oct 28 18:48:23 UTC 2013

Author: swills
Date: Mon Oct 28 18:48:22 2013
New Revision: 331887
URL: http://svnweb.freebsd.org/changeset/ports/331887

Log:
  - Update www/mod_pagespeed to 1.2.24.2,1
  - Document security issue in mod_pagespeed

Modified:
  head/security/vuxml/vuln.xml
  head/www/mod_pagespeed/Makefile
  head/www/mod_pagespeed/distinfo

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Mon Oct 28 18:46:29 2013	(r331886)
+++ head/security/vuxml/vuln.xml	Mon Oct 28 18:48:22 2013	(r331887)
@@ -51,6 +51,35 @@ Note:  Please add new entries to the beg
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="4e23644c-cb93-4f83-9e20-5bc07ad9b39f">
+    <topic>mod_pagespeed -- critical cross-site scripting (XSS) vulnerability</topic>
+    <affects>
+      <package>
+	<name>mod_pagespeed</name>
+	<range><lt>1.2.24.2,1</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>mod_pagespeed developers report:</p>
+	<blockquote cite="https://groups.google.com/forum/#!msg/mod-pagespeed-announce/oo015UHRxMc/JcAuf1hE8L8J">
+	  <p>Various versions of mod_pagespeed are subject to critical
+	     cross-site scripting (XSS) vulnerability, CVE-2013-6111. This
+	     permits a hostile third party to execute JavaScript in users'
+	     browsers in context of the domain running mod_pagespeed, which
+	     could permit theft of users' cookies or data on the site.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2013-6111</cvename>
+    </references>
+    <dates>
+      <discovery>2013-10-04</discovery>
+      <entry>2013-10-28</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="cd082cc6-1548-4b8d-a3aa-a007be611a29">
     <cancelled/>
   </vuln>

Modified: head/www/mod_pagespeed/Makefile
==============================================================================
--- head/www/mod_pagespeed/Makefile	Mon Oct 28 18:46:29 2013	(r331886)
+++ head/www/mod_pagespeed/Makefile	Mon Oct 28 18:48:22 2013	(r331887)
@@ -2,7 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	mod_pagespeed
-PORTVERSION=	1.2.24.1
+PORTVERSION=	1.2.24.2
 PORTREVISION=	0
 PORTEPOCH=	1
 CATEGORIES=	www

Modified: head/www/mod_pagespeed/distinfo
==============================================================================
--- head/www/mod_pagespeed/distinfo	Mon Oct 28 18:46:29 2013	(r331886)
+++ head/www/mod_pagespeed/distinfo	Mon Oct 28 18:48:22 2013	(r331887)
@@ -1,2 +1,2 @@
-SHA256 (mod_pagespeed_source_1.2.24.1.tar.xz) = b9f13957de30004b03397df5ded9a234d31542e7f0e8df219aa19c215cf0caaf
-SIZE (mod_pagespeed_source_1.2.24.1.tar.xz) = 12151988
+SHA256 (mod_pagespeed_source_1.2.24.2.tar.xz) = 17769ce144a6ea8234d36f1b6184b181c244a6a904a328ee178f895391f603f1
+SIZE (mod_pagespeed_source_1.2.24.2.tar.xz) = 12441180
