[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]
Date: Tue, 11 Nov 2008 10:59:07 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: hoffie@...too.org, mail@...ianw.de
Subject: Re: GeSHi: Clarification about the recent security
(non-)issues (SA32559)
Hi Christian!
On Mon, 10 Nov 2008 19:04:08 +0100 Christian Hoffmann
<hoffie@...too.org> wrote:
> These are just my findings after having a quick look at the code, and
> I thought I'd shared them, just in case someone wondered (and please
> protest, if you think I'm wrong).
Thanks for posting your finding!
> JFYI: Dokuwiki and phpBB are examples of software packages, which
> bundle GeSHi. Dokuwiki passes a static string to the mentioned $path
> parameter and is not vulnerable as such. I haven't checked phpBB.
pgfouine too, but it does not override default language files path at
all (set_language_path is only called with $path == '').
--
Tomas Hoger / Red Hat Security Response Team
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ