[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <1376548089.474034.550206332.3566.14@securityteam.typo3.org>
Date: Thu, 15 Aug 2013 08:28:09 +0200
From: TYPO3 Security Team <security@...o3.org>
To: kseifried@...hat.com
CC: Henri Salo <henri@...v.fi>, oss-security@...ts.openwall.com
Subject: Re: [Ticket#2013081510000021]
CVE request: TYPO3 remote code execution by arbitrary file creation
TYPO3-CORE-SA-201 [...]
Dear Kurt,
08/15/2013 05:10 - Kurt Seifried wrote:
> so it sounds like embedded third party software, there appear to be
> some older CVE's for flowplayer, I'm guessing it might be one of
> these? Can the typo3 people please provide details (e.g. code patches)
> of exactly what they fixed?
Yes, third party software flowplayer and Audio Player. Here are the changes:
https://review.typo3.org/22711
https://review.typo3.org/22710
The related older CVEs are already mentioned in the advisory, namely:
CVE-2011-3642, CVE-2013-1464
> For the second one "Vulnerable subcomponent: Backend File Upload /
> File Abstraction Layer" code execution please use CVE-2013-4250 for
> this issue.
Thanks. I updated the advisory accordingly.
Regards,
Helmut Hummel
Member of the TYPO3 Security Team
--
TYPO3 Security Team homepage: http://typo3.org/teams/security/
E-Mail: security@...o3.org
Please note: When replying to this e-mail, please leave the header intact.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
