diff options
| author | Thierry Thomas <thierry@FreeBSD.org> | 2005-11-22 19:56:53 +0000 |
|---|---|---|
| committer | Thierry Thomas <thierry@FreeBSD.org> | 2005-11-22 19:56:53 +0000 |
| commit | 2a2d2becd161c8654902b88b1918133d9bb7620e (patch) | |
| tree | a620b8db1db7e344ec24ee313ac92d22b3f0c176 /security | |
| parent | Fix a typo in the plist. (diff) | |
Add an entry for cross site scripting vulnerabilities in Horde's MIME
viewers.
Notes
Notes:
svn path=/head/; revision=149088
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index a942ccc3a6e0..16039d33a8aa 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,40 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + + <vuln vid="873a6542-5b8d-11da-b96e-000fb586ba73"> + <topic>Horde -- Cross site scripting vulnerabilities in MIME viewers.</topic> + <affects> + <package> + <name>horde</name> + <name>horde-php5</name> + <range><lt>3.0.7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Annouce of Horde 3.0.7 (final):</p> + <blockquote cite="http://lists.horde.org/archives/announce/2005/000232.html"> + <p>This [3.0.7] is a security release that fixes cross site scripting vulnerabilities in + two of Horde's MIME viewers. These holes could for example be exploited by an + attacker sending specially crafted emails to Horde's webmail client IMP. The + attack could be used to steal users' identity information, taking over users' + sessions, or changing users' settings.</p> + <p>As a hotfix the css and tgz MIME drivers can be disabled by removing their + entries from the $mime_drivers_map['horde']['registered'] list in + horde/config/mime_drivers.php.</p> + </blockquote> + </body> + </description> + <references> + <url>http://lists.horde.org/archives/announce/2005/000232.html</url> + </references> + <dates> + <discovery>2005-11-22</discovery> + <entry>2005-11-22</entry> + </dates> + </vuln> + <vuln vid="c55f9ed0-56a7-11da-a3f0-00123ffe8333"> <topic>phpmyadmin -- HTTP Response Splitting vulnerability</topic> <affects> |