MHonArc - Bugs: bug #32013, CVE-2010-4524: Improper escaping...
You are not allowed to post comments on this tracker with your current authentication level.
bug #32013: CVE-2010-4524: Improper escaping of certain HTML sequences (XSS)
Submitter: | Earl Hood <ehood> | ||
Submitted: | Thu 30 Dec 2010 08:04:54 PM UTC | ||
Category: | MIME Filter | Severity: | 6 - Security |
Priority: | 5 - Normal | Item Group: | Security |
Status: | Fixed | Privacy: | Public |
Assigned to: | ehood | Open/Closed: | Closed |
Operating System: | All | Perl Version: | All |
Component Version: | 2.6.16 | Fixed Release: | 2.6.17 |
Thu 30 Dec 2010 08:55:55 PM UTC, comment #1: |
Earl Hood <ehood>![]() ![]() |
Thu 30 Dec 2010 08:04:54 PM UTC, original submission:
Specially crafted HTML email message can allow scripting
|
Earl Hood <ehood>![]() ![]() |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 6 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2011-01-09 | ehood | Item Group | Undesired Behavior | ![]() |
Security |
Open/Closed | Open | ![]() |
Closed | ||
2011-01-09 | ehood | Status | Ready For Test | ![]() |
Fixed |
2011-01-09 | ehood | Fixed Release | ![]() |
2.6.17 | |
2010-12-30 | ehood | Status | Confirmed | ![]() |
Ready For Test |
2010-12-30 | ehood | Summary | Improper escaping of certain HTML sequences (XSS) | ![]() |
CVE-2010-4524: Improper escaping of certain HTML sequences (XSS) |
mhtxthtml.pl filter modified to reject any message with
nested tags. This is invalid HTML, so any message
that contains it would likely indicate someone trying
to attack an archive web site.