[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 16 Mar 2012 14:12:19 +0200
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Subject: Joomla! Security News 2012-03-16
Can we assign CVE-identifiers for these two vulnerabilities?
20120304 - Core - Password Change http://developer.joomla.org/security/news/394-20120304-core-password-change.html
20120303 - Core - Privilege Escalation http://developer.joomla.org/security/news/395-20120303-core-privilege-escalation.html
With Joomla you are never safe!
- Henri Salo
----- Forwarded message from Joomla! Developer Network - Security News <no_reply@...mla.org> -----
Date: Fri, 16 Mar 2012 12:09:18 +0000
From: Joomla! Developer Network - Security News <no_reply@...mla.org>
To: henri@...v.fi
Subject: Joomla! Security News
Joomla! Developer Network - Security News
///////////////////////////////////////////
[20120304] - Core - Password Change
Posted: 16 Mar 2012 12:21 AM PDT
http://feedproxy.google.com/~r/JoomlaSecurityNews/~3/JukET1dgfDM/394-20120304-core-password-change.html?utm_source=feedburner&utm_medium=email
Project: Joomla!
SubProject: All
Severity: High
Versions: 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x releases
Exploit type: Password Change
Reported Date: 2012-March-8
Fixed Date: 2012-March-15
Description
Insufficient randomness leads to password reset vulnerability.
Affected Installs
Joomla! versions 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x versions
Solution
Upgrade to version 2.5.3
Reported by George Argyros and Aggelos Kiayias
Contact
The JSST at the Joomla! Security Center.
///////////////////////////////////////////
[20120303] - Core - Privilege Escalation
Posted: 15 Mar 2012 05:00 AM PDT
http://feedproxy.google.com/~r/JoomlaSecurityNews/~3/n5w8L96w-LM/395-20120303-core-privilege-escalation.html?utm_source=feedburner&utm_medium=email
Project: Joomla!
SubProject: All
Severity: High
Versions: 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x releases
Exploit type: Privilege Escalation
Reported Date: 2012-March-12
Fixed Date: 2012-March-15
Description
Programming error allows privilege escalation in some cases.
Affected Installs
Joomla! versions 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x versions
Solution
Upgrade to version 2.5.3
Reported by Jeff Channel
Contact
The JSST at the Joomla! Security Center.
--
You are subscribed to email updates from "Joomla! Developer Network -
Security News."
To stop receiving these emails, you may unsubscribe now: http://feedburner.google.com/fb/a/mailunsubscribe?k=JWlBXz9w0F12fWtPu46jwc9_Jcc
Email delivery powered by Google.
Google Inc., 20 West Kinzie, Chicago IL USA 60610
----- End forwarded message -----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
