Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 10 Nov 2012 06:42:01 -0500 (EST)
From: Jan Lieskovsky <>
Cc: "Steven M. Christey" <>,
        Michel Alexandre Salim <>,
        Richard Jones <>,
        Ralf Schlatterbeck <>
Subject: CVE Request -- roundup: Multiple XSS flaws plus other security
 related fixes corrected in upstream 1.4.20 version

Hello Kurt, Steve, vendors,

  Roundup upstream has released new upstream 1.4.20 version,
correcting multiple cross-site scripting (XSS) flaws (and
couple of other security related issues):

More from [1] (plus relevant tickets inlined too, where
possible to find out):
[A] * issue2550729: Fix password history display for anydbm backend,
thanks to Ralf Hemmecke for reporting. (Ralf)

[B] * issue2550684 Fix XSS vulnerability when username contains HTML code,
thanks to Thomas Arendsen Hein for reporting and patch. (Ralf)

[C] * issue2550711 Fix XSS vulnerability in @action parameter,
thanks to "om" for reporting. (Ralf)

[D] * Fix wrong execute permissions on some files,
thanks to Cheer Xiao for the patch. (Ralf)

[E] * Fix another XSS with the "otk" parameter,
thanks to Jesse Ruderman for reporting. (Ralf)

[F] * Mark cookies HttpOnly and -- if https is used -- secure. Fixes issue2550689,
but is untested if this really works in browsers. Thanks to Joseph Myers for reporting. (Ralf)

[G] * Fix another XSS with the ok- and error message, see issue2550724. We solve this differently
from the proposals in the bug-report by not allowing any html-tags in ok/error messages
anymore. Thanks to David Benjamin for the bug-report and to Ezio Melotti for several proposed fixes. (Ralf)

Cc-ed Ralf Schlatterbeck on this post too to clarify, if issues [A] and [D]
would also have security implications / IOW if those would be security flaws too.
Ralf please clarify. Thank you, Jan.

Could you allocate CVE ids for these (once clarified)?

Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ