Date: Thu, 27 Jun 2013 18:04:51 +0200 From: Raphael Geissert <geissert@...ian.org> To: oss-security@...ts.openwall.com Cc: jmd@...epnet.net, moyo@...epnet.net Subject: CVE request: GLPI, multiple issues Hi, [CC'ing upstream for complimentary information] Multiple SQL injections have been reported in GLPI: http://packetstormsecurity.com/files/122097/GLPI-0.83.8-SQL-Injection.html (note that the original advisory was hosted at www.zeroscience.mk but it 404s as of the time of writing) And a local file inclusion vulnerability was also reported: http://packetstormsecurity.com/files/122087/GLPI-0.83.7-Parameter-Traversal-Arbitrary-File-Access.html (same note as for the above issue) I'm not aware of related commits or bug reports other than the following (but this is me trying to connect dots): https://forge.indepnet.net/issues/4372 which was marked as fixed at least in (0.83.9): https://forge.indepnet.net/projects/glpi/versions/915 But the bug report also refers to the fix in trunk and the 0.85 branch. Could CVE ids be assigned please? Note that this is a different request than the one for the one about the use of unserialize on untrusted data. Thanks in advance, -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.