Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 16 May 2013 18:31:59 +0300
From: Henri Salo <henri@...v.fi>
To: "Christey, Steven M." <coley@...re.org>
Cc: oss-security@...ts.openwall.com;, plugins@...dpress.org
Subject: Re: WordPress plugins vulnerable to CVE-2013-1808

On Thu, Mar 28, 2013 at 03:44:09PM +0000, Christey, Steven M. wrote:
> Henri,
> 
> It appears that CVE-2013-1463 was previously assigned to an issue that was claimed to exist in WP-Table Reloaded and fixed by that module developer, but the attack vector involves the id parameter to js/tabletools/zeroclipboard.swf, so this is likely a duplicate.  Can you confirm?
> 
> If this is a duplicate, we have an unusual situation for how to resolve it.  The older CVE, CVE-2013-1463, is much more widely used than the newer CVE-2013-1808, which would argue for keeping the older CVE-2013-1463.  However, because that older CVE focuses on the wrong product, and CVE-2013-1808 is referenced in Red Hat's Bugzilla and thus "more authoritative," this would argue for keeping CVE-2013-1808.
> 
> - Steve

I'm not sure if wp-table-reloaded used custom version of the zeroclipboard or
not, but by looking at the checksums so did other plugins too. Let's REJECT
CVE-2013-1463 and use CVE-2013-1808.

http://osvdb.org/90374

---
Henri Salo

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.