MHonArc - Bugs: bug #32013, CVE-2010-4524: Improper escaping...

You are not allowed to post comments on this tracker with your current authentication level.

bug #32013: CVE-2010-4524: Improper escaping of certain HTML sequences (XSS)

Submitter:	Earl Hood <ehood>
Submitted:	Thu 30 Dec 2010 08:04:54 PM UTC
Category:	MIME Filter	Severity:	6 - Security
Priority:	5 - Normal	Item Group:	Security
Status:	Fixed	Privacy:	Public
Assigned to:	ehood	Open/Closed:	Closed
Operating System:	All	Perl Version:	All
Component Version:	2.6.16	Fixed Release:	2.6.17

Thu 30 Dec 2010 08:55:55 PM UTC, comment #1:  mhtxthtml.pl filter modified to reject any message with nested tags.  This is invalid HTML, so any message that contains it would likely indicate someone trying to attack an archive web site.	Earl Hood <ehood>
Thu 30 Dec 2010 08:04:54 PM UTC, original submission:   Specially crafted HTML email message can allow scripting content to make it passed the default HTML MIME filter, allowing for XSS-based attack on archive site. References: https://bugzilla.redhat.com/show_bug.cgi?id=664718 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607693	Earl Hood <ehood>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List

-email is unavailable- added by ehood (Submitted the item)

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Copyright © 2024 Free Software Foundation, Inc.
Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
Page source code