[Bug 229991] New: CVE-2007-1049: wordpress < 2.1.1 XSS
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229991
Summary: CVE-2007-1049: wordpress < 2.1.1 XSS
Product: Fedora Extras
Version: devel
Platform: All
URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1049
OS/Version: Linux
Status: NEW
Severity: medium
Priority: normal
Component: wordpress
AssignedTo: jwb(a)redhat.com
ReportedBy: ville.skytta(a)iki.fi
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-security-list(a)redhat.com
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1049
"Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in
the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before
2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web
script or HTML via the file parameter to wp-admin/templates.php, and possibly
other vectors involving the action variable."
FE5+ apparently affected.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
17 years, 1 month
- 1
- 9
[Bug 228138] New: CVE-2006-6979: amarok shell escaping issue
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=228138
Summary: CVE-2006-6979: amarok shell escaping issue
Product: Fedora Extras
Version: fc6
Platform: All
OS/Version: Linux
Status: NEW
Severity: normal
Priority: normal
Component: amarok
AssignedTo: gauret(a)free.fr
ReportedBy: ville.skytta(a)iki.fi
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-security-list(a)redhat.com
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6979
"The ruby handlers in Amarok do not properly quote text in certain contexts,
probably including construction of an unzip command line, which allows attackers
to execute arbitrary commands via shell metacharacters."
Not clear to me which, if any, versions of amarok in FE or upstream are
affected. The referenced bugs.kde.org entry is open and there are no comments
at the moment.
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
17 years, 1 month
- 1
- 2