Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <200812171545.37760.steffen.joeris@skolelinux.de>
Date: Wed, 17 Dec 2008 15:45:31 +0100
From: Steffen Joeris <steffen.joeris@...lelinux.de>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE id request: php-xajax

Hi

Steven, I am not sure, if you want to assign a new CVE id for this, but since 
we did it for several other issues where an incomplete patch was issued, I 
guess it can be done here as well.

The patch for CVE-2007-2739 seems incomplete as it doesn't escape "&".
I recommend removing the replace call and using htmlspecialchars() instead.

Also, I seem to be unable to find anything regarding CVE-2007-2740. Did anyone 
manage to find a patch or even what kind of issue we are talking about? I 
only see the XSS.

Cheers
Steffen

Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.