Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 04 May 2013 17:22:36 -0500
From: John Lightsey <>
Subject: CVE Request: YaBB 2.5.2 and earlier arbitrary code execution

Hi everyone,

Yet another Bulletin Board (YaBB) 2.5.2 and earlier allow arbitrary code
execution through a combination of file uploads with predictable
locations and unsanitized use of the "guestlanguage" cookie in file paths.

This problem is similar to CVE-2007-3295.


The vulnerability can be mitigated by setting the $enable_guestlanguage
variable to 0 in the YaBB configuration or applying the patch provided
in the links.

Download attachment "signature.asc" of type "application/pgp-signature" (901 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.