Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 10 Feb 2016 15:26:47 +0000
From: Shubham Shah <sshah@...hopfox.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
	"cve-assign@...re.org" <cve-assign@...re.org>
CC: Joe DeMesy <jdemesy@...hopfox.com>, Michael Morris <michael@...eux.com>
Subject: CVE Request: Textual IRC Client <= 5.2.7 Remote Command Execution

Hi,

We would like to request a CVE for a remote command execution vulnerability in the Textual IRC client <= 5.2.7 for OS X. 

An attacker is able to send messages to users of the Textual IRC Client 5.2.7 and below in order to inject arbitrary JavaScript within Textual’s web view upon limited user interaction. Unspecified attack vectors could allow for an attacker to achieve remote command execution on a victim’s machine, through the Textual IRC client.

The vendor has released a fix as seen in the following GitHub commit:

https://github.com/Codeux-Software/Textual/commit/422a6c8f7e750df506adaebb2db4bfa23f6aaa37

A patch has been released by the vendor and this security vulnerability has been fixed in Textual 5.2.8 as seen in the release notes:

https://www.codeux.com/textual/help/Release-Notes%3A-Version-5.2.8.kb

The release notes will be updated to include any CVE’s assigned for this remote command execution vulnerability.

This vulnerability was found by Shubham Shah and Joe DeMesy of Bishop Fox.

Thanks,

Shubham Shah
Senior SECURITY ANALYST

Email: sshah@...hopfox.com
Phone: +61 0412 609 761
Fax: (480) 383-6401

WWW.BISHOPFOX.COM



[ CONTENT OF TYPE text/html SKIPPED ]

[ CONTENT OF TYPE application/pkcs7-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ