Date: Wed, 25 Jun 2014 11:56:55 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: CVE request: timthumb remote code execution The timthumb code, used by a countless number of wordpress themes, has (again) a remote code execution vulnerability: http://seclists.org/fulldisclosure/2014/Jun/117 All details there. This affects the very latest upstream version 2.8.13, I just opened an upstream bug: https://code.google.com/p/timthumb/issues/detail?id=485&thanks=485&ts=1403690188 No fix available at the moment. -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ