[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Dec 2008 15:45:31 +0100
From: Steffen Joeris <steffen.joeris@...lelinux.de>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE id request: php-xajax
Hi
Steven, I am not sure, if you want to assign a new CVE id for this, but since
we did it for several other issues where an incomplete patch was issued, I
guess it can be done here as well.
The patch for CVE-2007-2739 seems incomplete as it doesn't escape "&".
I recommend removing the replace call and using htmlspecialchars() instead.
Also, I seem to be unable to find anything regarding CVE-2007-2740. Did anyone
manage to find a patch or even what kind of issue we are talking about? I
only see the XSS.
Cheers
Steffen
Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
