Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 6 Jan 2012 18:02:20 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: redmine issues

Hi,
please assign three CVE IDs for the following issues in Redmine:

These need to be CVE-2011-* IDs:

The announcement can be found here: http://www.redmine.org/news/49

--------
This release also fixes 3 security issues reported by joernchen of
Phenoelit:

* logged in users may be able to access private data (affected
versions: 1.0.x)

* persistent XSS vulnerability in textile formatter (affected
versions: all previous releases)

* remote command execution in bazaar repository adapter (affected
versions: 0.9.x, 1.0.x)
--------

This was already fixed in a Debian security update some time ago,
but never received a CVE ID:
http://lists.debian.org/debian-security-announce/2011/msg00131.html

Patches can be found in the Debian patch tracker:
http://patch-tracker.debian.org/package/redmine/1.0.1-2

Cheers,
        Moritz

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.