Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 27 Jul 2008 18:39:48 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: Re: CVE request: punbb < 1.2.19

On Mon, 21 Jul 2008, Hanno [utf-8] Böck wrote:

>     *  Fixed an SMTP command injection vulnerability, discovered by Stefan
> Esser.


>     * Fixed an XSS issue in include/parser.php, discovered by Dan Crowley.
>     * Fixed several potential XSS vectors in moderate.php.

Combined, these are CVE-2008-3336

>     * Fixed issue with database returning the same user on multiple pages of
> the userlist, noticed by hcgtv.

This sounds like a usability issue, not a security issue.

- Steve

Name: CVE-2008-3335
Status: Candidate
Reference: CONFIRM:

Unspecified vulnerability in PunBB before 1.2.19 allows remote
attackers to inject arbitrary SMTP commands via unknown vectors.

Name: CVE-2008-3336
Status: Candidate
Reference: CONFIRM:

Multiple cross-site scripting (XSS) vulnerabilities in PunBB before
1.2.19 allow remote attackers to inject arbitrary web script or HTML
via (1) include/parser.php and (2) moderate.php.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.