Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 31 Jan 2015 08:41:53 -0500 (EST)
From: cve-assign@...re.org
To: henri@...v.fi
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: phpbb3 CSRF and CSS injection

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> https://wiki.phpbb.com/Release_Highlights/3.0.13

> https://tracker.phpbb.com/browse/PHPBB3-13531
> https://github.com/phpbb/phpbb/pull/3316
> "CSS Injection via Relative Path Overwrite. Thanks to James Kettle for bringing
> this to our attention"

Use CVE-2015-1431.


> https://tracker.phpbb.com/browse/PHPBB3-13526
> https://github.com/phpbb/phpbb/pull/3311
> "The ucp_pm_options form key is now properly validated. Thanks to FBNeal and
> lampsys who reported this independently."

Use CVE-2015-1432.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJUzNs2AAoJEKllVAevmvmsNr8IAL8lCP4ttRCxvmCV/83hKvwY
Tb+Flg8mrnl70GI4u7QWrzPjAfBaZNwSOc1/MfSsa0j91Zy4MjE+jkp/yPlfpT4t
7j811JhVGG2BOF0sCWhFis/O/EfzmVMAlZrYm56+zlQZ5HVarWpBu5SjwVVLO51y
DLQK+9tshTBDSaYaKAC1ksJQMlafU1ADbHH61e88Pu4hbAVSJZ68OM8+rwSNZY+e
gE3b5DonuEwSUCP+hW8R2jaf/0U+imv2FLCPWkqlg2NXQUW+wNbL+GeT9JM/hqrL
Jxb4Nx7I7jaJuiuXzIQ3xrwagYVS7/avtsXoANumANlc0qIwl+Ib0uz1ttCxHR8=
=VJhc
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ