Date: Wed, 01 Sep 2010 16:16:36 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security <oss-security@...ts.openwall.com>, Marc Delisle <Marc.Delisle@...epsherbrooke.qc.ca>, Michal Cihar <michal@...ar.com> Subject: CVE Request -- phpMyAdmin - v3.6.6 -- XSS attack using debugging messages (CVE-2010-3056 discussion) Hi Steve, vendors, on 2010-08-30 phpMyAdmin published PMASA-2010-6 addressing one XSS:  http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php Summary (from ): XSS attack using debugging messages. Description (from ): It was possible to conduct a XSS attack using error messages in PHP backtrace. Affected versions (from ): For 3.x: versions before 3.3.6 are affected. Branch 2.11.x is not affected by this Upstream commit: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=133a77fac7d31a38703db2099a90c1b49de62e37 phpMyAdmin upstream seems to reference CVE-2010-3056 as CVE id to this flaw. But CVE-2010-3056 was previously assigned to:  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3056  https://bugzilla.redhat.com/show_bug.cgi?id=625877  http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php which affected both (from ): For 2.11.x: versions before 22.214.171.124 are affected. For 3.x: versions before 126.96.36.199 are affected. so this is different issue and new CVE id should be allocated (due different affected versions). Could you please allocate one? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Resposne Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.