Date: Thu, 30 Sep 2010 15:55:09 -0400 (EDT) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Cc: coley <coley@...re.org> Subject: Re: CVE request: Horde Gollem <1.1.2 XSS in view.php Please use CVE-2010-3447 Thanks. -- JB ----- "Alex Legler" <a3li@...too.org> wrote: > Hi, > > while there seem to be CVE IDs for most of the issues fixed in the > latest Horde packages, I cannot find one for this issue: > > From http://bugs.horde.org/ticket/9191: > "http://localhost/horde/gollem/view.php?actionID=view_file&type=txt&file=<script>alert("XSS")</script>&dir=../baddir/&driver=file > Vulnerable file : view.php (Line 32 - 46)" > > Fixed in git (and released in 1.1.2): > http://lists.horde.org/archives/commits/2010-August/004747.html > http://lists.horde.org/archives/announce/2010/000565.html > > Thanks, > Alex > -- > Alex Legler <a3li@...too.org> > Gentoo Security/Ruby
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.