Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Dec 2010 15:02:23 +0100
From: Jan Lieskovsky <>
To: "Steven M. Christey" <>
CC: oss-security <>,
        Earl Hood <>,
        "non customers" <>
Subject: CVE Request -- MHonArc: Improper escaping of certain HTML sequences

Hello Steve, vendors,

   MHonArc, a Perl mail-to-HTML converter, failed to
properly escape certain HTML sequences. A remote
attacker could provide a specially-crafted email
message and trick the local user to convert it
into HTML format. Subsequent preview of such
message might potentially execute arbitrary HTML
or scripting code (XSS).


Public PoC:

Further issue note:
MHonArc properly escapes for example:

<script>alert("elsa");</script> =>


But fails to do the same example for a string in the form of:

<scr<body>ipt>alert("elsa");</scr<body>ipt> =>


Affected versions: Issue confirmed in latest MHonArc-2.6.16 version

Could you allocate a CVE id for this issue?

Thanks && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ