Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 8 Jul 2008 13:18:37 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE request: mybb


On Sun, 6 Jul 2008, Hanno [utf-8] Böck wrote:

> MyBB 1.2.13 release announcement:
> "MyBB 1.2.13 is a security update to the MyBB 1.2 series. It fixes 1 HIGH risk
> and 1 Medium risk security vulnerability."
>
> http://community.mybboard.net/showthread.php?tid=31666
>
> No further details though...


The forum post linked to a security-only patch that provides some pretty
good hints.

======================================================
Name: CVE-2008-3069
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3069
Reference: CONFIRM:http://community.mybboard.net/attachment.php?aid=9272
Reference: CONFIRM:http://community.mybboard.net/showthread.php?tid=31666

Multiple cross-site scripting (XSS) vulnerabilities in MyBB before
1.2.13 allow remote attackers to inject arbitrary web script or HTML
via unspecified parameters to (1) portal.php and (2)
inc/functions_post.php.


======================================================
Name: CVE-2008-3070
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3070
Reference: CONFIRM:http://community.mybboard.net/attachment.php?aid=9272
Reference: CONFIRM:http://community.mybboard.net/showthread.php?tid=31666

Unspecified vulnerability in inc/datahandler/user.php in MyBB before
1.2.13 has unknown impact and attack vectors related to the
$user['language'] variable, probably related to SQL injection.


======================================================
Name: CVE-2008-3071
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3071
Reference: CONFIRM:http://community.mybboard.net/attachment.php?aid=9272
Reference: CONFIRM:http://community.mybboard.net/showthread.php?tid=31666

Directory traversal vulnerability in inc/class_language.php in MyBB
before 1.2.13 has unknown impact and attack vectors related to the
$language variable.


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.