Date: Tue, 7 Oct 2014 15:13:51 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: "New Class of Vulnerability in Perl Web Applications" Hi, I feel this is worth bringing in here (and I wish someone wrote a proper mailing list posting with this info, to have it properly archived): New Class of Vulnerability in Perl Web Applications http://blog.gerv.net/2014/10/new-class-of-vulnerability-in-perl-web-applications/ "While perl may have a particularly subtle manifestation, this is not Perl-specific." http://www.reddit.com/r/netsec/comments/2ihen0/new_class_of_vulnerability_in_perl_web/ Bugzilla 4.0.14, 4.2.10, 4.4.5, and 4.5.5 Security Advisory http://www.bugzilla.org/security/4.0.14/ Bug 1074812 - (CVE-2014-1572) [SECURITY] The 'realname' parameter is not correctly filtered on user account creation, leading to user data override https://bugzilla.mozilla.org/show_bug.cgi?id=1074812 http://www.opennet.ru/opennews/art.shtml?num=40766 (Russian) Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.