oss-security - CVE request: Openfire <3.6.3 XSS vulnerabilities

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Wed, 4 Feb 2009 15:19:25 +0100
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: Openfire <3.6.3 XSS vulnerabilities

Openfire before 3.6.3 contains several reflected and persistent 
Cross-Site Scripting vulnerabilties, also possibly leading to 
server-side code execution, and a directory traversal.

https://bugs.gentoo.org/show_bug.cgi?id=257585
http://www.coresecurity.com/content/openfire-multiple-vulnerabilities
http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
http://www.igniterealtime.org/issues/browse/JM-1506

SVN revisions r10939 r10938 r10937 r10936 on 
http://svn.igniterealtime.org/svn/repos/openfire/trunk/ contain the 
fixes.

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.