Date: Wed, 17 Dec 2008 15:45:31 +0100 From: Steffen Joeris <steffen.joeris@...lelinux.de> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: CVE id request: php-xajax Hi Steven, I am not sure, if you want to assign a new CVE id for this, but since we did it for several other issues where an incomplete patch was issued, I guess it can be done here as well. The patch for CVE-2007-2739 seems incomplete as it doesn't escape "&". I recommend removing the replace call and using htmlspecialchars() instead. Also, I seem to be unable to find anything regarding CVE-2007-2740. Did anyone manage to find a patch or even what kind of issue we are talking about? I only see the XSS. Cheers Steffen Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.