[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 6 Aug 2010 19:15:02 +0200
From: Alex Legler <a3li@...too.org>
To: oss-security <oss-security@...ts.openwall.com>
Subject: CVE request: uzbl before 2010.08.05: User-assisted execution of
arbitrary commands caused by faulty default config
Please assign a CVE for the following issue:
"With shell code in hyperlinks on a page, one of the sample (uzbl-core)
resp. default (uzbl-browser) button bindings (binding for mousebutton2)
would execute this code. This commit fixes that issue.
Note that just upgrading your uzbl is not enough. If you have an
existing config, the change will not be automatically applied. So be
sure you have this change in your config."
Source: http://www.uzbl.org/news.php?id=29
Upstream bug: http://www.uzbl.org/bugs/index.php?do=details&task_id=240
Thanks,
Alex
--
Alex Legler | Gentoo Security / Ruby
a3li@...too.org | a3li@...ber.ccc.de
Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
