[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <898557088.423211291672299220.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 6 Dec 2010 16:51:39 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE request: vanilla forums before 2.0.10, xss
Use CVE-2010-4264 for the XSS. The commit is here:
https://github.com/vanillaforums/Garden/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece
As for the "linkbait" issue, I have no clue. Nothing in git seems to
point at that.
Steve, does MITRE have a precedent for such a thing?
Thanks.
--
JB
----- "Hanno Böck" <hanno@...eck.de> wrote:
> Hi,
>
> http://vanillaforums.org/discussion/13119/vanilla-2.0.10-released/p1
>
> Two sound like security:
> #
> # Added SafeStyles configuration to prevent XSS linkjacking
> # Patched potential linkbait vulnerability in dispatcher
>
> (although I don't know what a linkbait vulnerability is, maybe someone
> wants
> to enlighten me)
>
> --
> Hanno Böck Blog: http://www.hboeck.de/
> GPG: 3DBD3B20 Jabber/Mail: hanno@...eck.de
>
> http://schokokeks.org - professional webhosting
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
