oss-security - viewvc: CVE request: XSS and illegal characters while printing name-value pairs

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 7 Sep 2009 10:52:34 +0200
From: Thomas Biege <thomas@...e.de>
To: OSS-Security Mailinglist <oss-security@...ts.openwall.com>
Subject: viewvc: CVE request: XSS and illegal characters while printing name-value pairs

Hello,
I do not have any further details, just this changelog entries:

Version 1.1.2 (released 11-Aug-2009)

  * security fix: validate the 'view' parameter to avoid XSS attack
  * security fix: avoid printing illegal parameter names and values

http://viewvc.tigris.org/source/browse/*checkout*/viewvc/tags/1.1.2/CHANGES

-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.