[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4F45B0EA-41C2-4A0B-9B97-9DF10AA14E9D@bishopfox.com>
Date: Wed, 10 Feb 2016 15:26:47 +0000
From: Shubham Shah <sshah@...hopfox.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"cve-assign@...re.org" <cve-assign@...re.org>
CC: Joe DeMesy <jdemesy@...hopfox.com>, Michael Morris <michael@...eux.com>
Subject: CVE Request: Textual IRC Client <= 5.2.7 Remote Command Execution
Hi,
We would like to request a CVE for a remote command execution vulnerability in the Textual IRC client <= 5.2.7 for OS X.
An attacker is able to send messages to users of the Textual IRC Client 5.2.7 and below in order to inject arbitrary JavaScript within Textual’s web view upon limited user interaction. Unspecified attack vectors could allow for an attacker to achieve remote command execution on a victim’s machine, through the Textual IRC client.
The vendor has released a fix as seen in the following GitHub commit:
https://github.com/Codeux-Software/Textual/commit/422a6c8f7e750df506adaebb2db4bfa23f6aaa37
A patch has been released by the vendor and this security vulnerability has been fixed in Textual 5.2.8 as seen in the release notes:
https://www.codeux.com/textual/help/Release-Notes%3A-Version-5.2.8.kb
The release notes will be updated to include any CVE’s assigned for this remote command execution vulnerability.
This vulnerability was found by Shubham Shah and Joe DeMesy of Bishop Fox.
Thanks,
Shubham Shah
Senior SECURITY ANALYST
Email: sshah@...hopfox.com
Phone: +61 0412 609 761
Fax: (480) 383-6401
WWW.BISHOPFOX.COM
Content of type "text/html" skipped
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4512 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
