oss-security - CVE request: simple machines forum

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Sun, 6 Jul 2008 18:31:40 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: CVE request: simple machines forum

http://www.simplemachines.org/community/index.php?P=c3696c2022b54fa50c5f341bf5710aa3&topic=236816.0

"This version addresses a few security issues and fixes some small bugs."

These sound like security issues:
* Sanitation of $topic wasn't always done right.
* Fixed a vulnerability with the use of the html-tag - issue reported by 
Jessica Hope.

Though they don't list which issues are security relevant.

They also don't mention if CVE-2007-5943 is fixed.

-- 
Hanno Böck		Blog:		http://www.hboeck.de/
GPG: 3DBD3B20		Jabber/Mail:	hanno@...eck.de

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.