oss-security - Re: viewvc: CVE request: XSS and illegal characters while printing name-value pairs

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 16 Oct 2009 10:29:04 +0200
From: Ludwig Nussel <ludwig.nussel@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: viewvc: CVE request: XSS and illegal characters
 while printing name-value pairs

Thomas Biege wrote:
> Version 1.1.2 (released 11-Aug-2009)
> 
>   * security fix: validate the 'view' parameter to avoid XSS attack
>   * security fix: avoid printing illegal parameter names and values
> 
> http://viewvc.tigris.org/source/browse/*checkout*/viewvc/tags/1.1.2/CHANGES

CVE request dropped off the radar I guess.

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.