Date: Fri, 24 Aug 2012 22:29:42 -0400 (EDT) From: "Steven M. Christey" <coley@...-smtp.mitre.org> To: oss-security@...ts.openwall.com cc: Henri Salo <henri@...v.fi>, Moritz Muehlenhoff <jmm@...ian.org> Subject: Re: CVE-request: Roundcube XSS issues On Mon, 20 Aug 2012, Kurt Seifried wrote: >> 2, Issue 2a: Description: Stored XSS in e-mail body. Ticket: >> http://trac.roundcube.net/ticket/1488613 Upstream patch: >> >> [snip] >> >> Issue 2b: Self XSS in e-mail body (Signature). Ticket: >> http://trac.roundcube.net/ticket/1488613 Upstream patch: >[snip] > > Please use CVE-2012-3508 for these two issues (same version, same type > of vuln so cve merge). Further investigation into ticket 1488613 shows that the developer thinks that issue 2b doesn't need a backport to 0.7. This would suggest a SPLIT based on different affected versions. Plus it's not immediately clear whether this "self XSS" is really an XSS or not - if I can modify my own signature, then I already have the "privileges" on my browser to run script. But, if this "self XSS" is really just reflected XSS, then that's a security issue to worry about. This requires expertise in the Roundcube codebase to answer for sure, though. So, we should probably SPLIT this CVE. CVE-2012-3508 - Issue 2a - Stored XSS in e-mail body (new) CVE-2012-4668 - Issue 2b - Self XSS in e-mail body (Signature) - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.