Date: Fri, 7 Feb 2014 10:39:41 -0800 From: Galen Charlton <gmc@...library.com> To: oss-security@...ts.openwall.com Subject: CVE request: multiple issues in Koha Hi, As current release manager for Koha, I'd like to request CVE number(s) for the following issues that were addressed in a security release yesterday. Release announcement: http://koha-community.org/security-release-february-2014/ Issues fixed with the release:  tools/pdfViewer.pl could be used to read arbitrary files on the server (http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660)  the staff interface help editor could be used to modify or create arbitrary files on the server (http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661)  member-picupload.pl could be used to write to arbitrary files on the server (http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662)  the MARC framework import/export function did not require authentication, and could be used to perform unexpected SQL commands (http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666) Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc@...library.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.