Date: Fri, 3 May 2013 19:39:16 +0200 From: Salvatore Bonaccorso <carnil@...ian.org> To: oss-security@...ts.openwall.com, kseifried@...hat.com Cc: Mark Panaghiston <markp@...pyworm.com>, hello@...pyworm.com Subject: Re: Re: CVE-2013-1942 jPlayer 2.2.19 XSS Hi Kurt Have a question about the CVE assignments for these issues: On Mon, Apr 29, 2013 at 01:30:09PM -0600, Kurt Seifried wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 04/20/2013 11:19 AM, Mark Panaghiston wrote: > > jPlayer 2.3.0 has been released that officially fixes this issue: > > > > http://www.jplayer.org/ https://github.com/happyworm/jPlayer > > > > Tagged as *2.3.0* on GitHub. > > https://github.com/happyworm/jPlayer/commit/c1c7a4dfa63bb6684d3670202e4a65d400dfce86 > > > > Full Release Notes for jPlayer 2.3.0: > > http://www.jplayer.org/2.3.0/release-notes/ > > > > In particular these fixes addressed security issues. Listed with > > their GitHub commits for code reference: > > > > [2.2.20] Security Fix: The Flash SWF had a security vulnerability > > that enabled XSS (Cross Site Scripting). Reported by Malte Batram. > > Security reference CVE-2013-1942 > > <https://access.redhat.com/security/cve/>. > > https://github.com/happyworm/jPlayer/commit/e8ca190f7f972a6a421cb95f09e138720e40ed6d > > Sorry > > > for the late reply. Please use CVE-2013-2022 for this issue. In  CVE-2013-1942 was assigned, referencing the same commit.  http://marc.info/?l=oss-security&m=136570964825921&w=2 Should CVE-2013-1942 thus only be used for owncloud reference, and CVE-2013-2022 and CVE-2013-2023 on other side for jplayer itself? Thanks a lot in advance for clarification! Regards, Salvatore
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.