[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120106170220.GA4241@pisco.westfalen.local>
Date: Fri, 6 Jan 2012 18:02:20 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: redmine issues
Hi,
please assign three CVE IDs for the following issues in Redmine:
These need to be CVE-2011-* IDs:
The announcement can be found here: http://www.redmine.org/news/49
--------
This release also fixes 3 security issues reported by joernchen of
Phenoelit:
* logged in users may be able to access private data (affected
versions: 1.0.x)
* persistent XSS vulnerability in textile formatter (affected
versions: all previous releases)
* remote command execution in bazaar repository adapter (affected
versions: 0.9.x, 1.0.x)
--------
This was already fixed in a Debian security update some time ago,
but never received a CVE ID:
http://lists.debian.org/debian-security-announce/2011/msg00131.html
Patches can be found in the Debian patch tracker:
http://patch-tracker.debian.org/package/redmine/1.0.1-2
Cheers,
Moritz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
