Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 20 Apr 2013 19:36:06 +0200
From: Lukas Reschke <>
To: Mark Panaghiston <>
Cc: Kurt Seifried <>, 
	Open Source Security <>,, 
	"" <>
Subject: Re: CVE-2013-1942 jPlayer 2.2.19 XSS

On Sat, Apr 20, 2013 at 7:19 PM, Mark Panaghiston <> wrote:
> [2.2.23] Security Fix: The Flash SWF had a minor security vulnerability that
> enabled XSS (Cross Site Scripting). Reported by Eugene Dokukin.

As far I can see from this commit this only affected "alert()" and
allowed the display of an alert box. Could you clarify that please?

If so this could be only abused for techniques like social engineering
and should IMHO not handled as a security issue.

@Kurt: What's your opinion on that?

Your Cloud, Your Data, Your Way!

GPG: 0xEB32B77BA406BE99

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.