[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20111204200746.2bc22fe0@laverne>
Date: Sun, 4 Dec 2011 20:07:46 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-request: Serendipity
'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability
Am Thu, 01 Dec 2011 13:24:19 -0700
schrieb Kurt Seifried <kseifried@...hat.com>:
> My mistake, this should have been merged into CVE-2011-4090, it's the
> same vuln type (XSS) and the same version of Serendipity,
> CVE-2011-4365 is a bad assignment and should be marked as a duplicate
> of CVE-2011-4090.
I'd disagree on that.
CVE-2011-4090 is in an (optional) plugin, while CVE-2011-4365 is an
issue in the main s9y code.
Although the plugin is shipped with the core s9y, the impact is quite
different. For 4090, you only need to care if you do something with the
karma-plugin.
--
Hanno Böck mail/jabber: hanno@...eck.de
GPG: BBB51E42 http://www.hboeck.de/
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
