[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 10 Nov 2012 23:52:36 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Florian Weimer <fw@...eb.enyo.de>,
"security@...o3.org" <security@...o3.org>
Subject: Re: CVE request: TYPO3-CORE-SA-2012-005
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/10/2012 01:14 PM, Florian Weimer wrote:
> <http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/>
>
>
identifies the following vulnerabilities:
You didn't mention the core issues, I assume those need CVE's as well?
Also looking at
Problem Description: Due to missing encoding of user input, the
history module is susceptible to SQL Injection and Cross-Site
Scripting. A valid backend login is required to exploit this
vulnerability.
sounds like one issue (input validation), leading to two possible
outcomes (SQL injection and XSS).
can security@...o3.org provide some light for this and the:
=================
It has been discovered that TYPO3 Core is vulnerable to SQL Injection,
Information Disclosure and Cross-Site Scripting
Component Type: TYPO3 Core
Affected Versions: 4.5.0 up to 4.5.20, 4.6.0 up to 4.6.13, 4.7.0 up to
4.7.5 and development releases of the 6.0 branch.
Vulnerability Types: SQL Injection, Cross-Site Scripting, Information
Disclosure
Overall Severity: Medium
Release Date: November 8, 2012
=================
issues?
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQn0s0AAoJEBYNRVNeJnmT158P/Apd/AJftbvtQAoJAXppKeN2
AYhpQ1mpl3HmwxuS37seK6BH6a4lBa+aC9wk6Aepuvdsw1DvVDaMfmTPkRsaL3T/
7N4P60ZwhOTvXpoOXJx33ze2r68NFYtNyBZUsXBcnvBmpNdYvDfQxgiP8PLHOeiX
Qf0BR0688wdZE6IhwYoAK8TcVxH/xNEK6AFOM/jnx51/ZF3STmTxyJrMFa1A2BNr
MtdnCMS6PFfT+D67LLP5cmc5vQyWhz/qayuCzMIaxABzClAnfCqYjRbvnnbDidLZ
Rprl+t1vW0sZqry5EFZ/74Au10+6toGGuIB5Fyldg1b+RNd9W7e0uBC1deT1DCoi
1AcNKJHJEF01H9MuJiynmZK325uPvTCRw2MBLbuIGY7INxqo4ObH0a5686c3WP8T
+fOQZj759gQxOdnqHzJ5UNS4QGLSaFy1uVFoUzQJ5ENevA1W0dSw33eCbV38jUsu
GmENfaZK/pDwr7TEpsk3ROm5s6dJ8ON3auasQF+ruOWLQlFhUaCicc4RbLdtpqD9
/YCBs5BJy90qQp/068am97LWHnVQMWJWDEGRUlWvHcHLVIv5BIT+oTTo1HRC0RyU
8vnwtWnBm3gPOPvXsyA3bdeW/+NgVfHHQ9OvG2NMrJkY7HLF+60zl+XEIUNvgW6+
QsVvIspnLpBNSoFyThzC
=9xeZ
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
