Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Nov 2008 10:59:07 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: hoffie@...too.org, mail@...ianw.de
Subject: Re: GeSHi: Clarification about the recent security
 (non-)issues (SA32559)

Hi Christian!

On Mon, 10 Nov 2008 19:04:08 +0100 Christian Hoffmann
<hoffie@...too.org> wrote:

> These are just my findings after having a quick look at the code, and
> I thought I'd shared them, just in case someone wondered (and please
> protest, if you think I'm wrong).

Thanks for posting your finding!

> JFYI: Dokuwiki and phpBB are examples of software packages, which
> bundle GeSHi. Dokuwiki passes a static string to the mentioned $path
> parameter and is not vulnerable as such. I haven't checked phpBB.

pgfouine too, but it does not override default language files path at
all (set_language_path is only called with $path == '').

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.