[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1313683700.15727.27.camel@localhost.localdomain>
Date: Fri, 19 Aug 2011 02:08:17 +1000
From: David Hicks <d@...id.au>
To: oss-security@...ts.openwall.com
Subject: CVE request: MantisBT <1.2.7 search.php multiple XSS vulnerabilities
Original vulnerability report by Net.Edit0r (Net.Edit0r@....net) from
BlACK Hat Group [http://black-hg.org] is available at:
http://packetstormsecurity.org/files/104149
MantisBT bug report for full details of the issue:
http://www.mantisbt.org/bugs/view.php?id=13245
Please note that the second SQL injection vulnerability identified by
Net.Edit0r is not reproducible (refer to the MantisBT bug report above
for reasons why).
A patch for 1.2.6 is available at:
https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93b
MantisBT 1.2.7 is currently being packaged and will be available shortly
through usual channels for distributions and standalone users to pick
up.
Bug reports cross-posted elsewhere:
Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=379739
Fedora/Red Hat: https://bugzilla.redhat.com/show_bug.cgi?id=731777
Debian: Submitted (queued)
Ubuntu: https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857
Thanks,
David Hicks
MantisBT Developer
mantisbt.org, #mantishelp on freenode
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
