Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 06 Dec 2010 19:44:06 -0600
From: Raphael Geissert <>
Subject: CVE requests: IO::Socket::SSL, cakephp, collectd, gnash, ocrodjvu, hypermail, libcloud, piwigo


Could CVE ids be assigned for the following issues? thanks in advance.

IO::Socket::SSL: unexpected fallback to VERIFY_NONE if certificate file(s) 
are not specified.

cakephp: code execution via unserialize() call with untrusted data

collectd: DoS via the RRDtool and RRDCacheD plugins

gnash: insecure handling of temp files at build-time

ocrodjvu: insecure handling of temp files

hypermail: XSS

libcloud: "doesn't verify ssl certificate"
It appears that what it doesn't verify is the certificate's CN. From the 
references provided in the Debian bug report it looks like it is a 
widespread issue on the SSL implementations in Python.
Not sure how MITRE would like to handle those.

a1) CSRF
a2) SQL injection
a3) stored XSS
(the issues mentioned by the exploit-db entry appear to be the same that 
were fixed in 2.1.3)
b) search.php SQL injection
c) CSRF in the admin panel:
(the exploit-db entry details two other issues, but are "admin-only" -- feel 
free to assign or ignore those.)

Raphael Geissert - Debian Developer -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.