MHonArc - Bugs: bug #32080, Specially crafted <base...
You are not allowed to post comments on this tracker with your current authentication level.
bug #32080: Specially crafted <base href> can lead to XSS exploit
Submitter: | Earl Hood <ehood> | ||
Submitted: | Sun 09 Jan 2011 08:46:00 AM UTC | ||
Category: | MIME Filter | Severity: | 6 - Security |
Priority: | 7 - High | Item Group: | Security |
Status: | Fixed | Privacy: | Public |
Assigned to: | None | Open/Closed: | Closed |
Operating System: | All | Perl Version: | All |
Component Version: | <=2.6.16 | Fixed Release: | 2.6.17 |
Sun 09 Jan 2011 08:50:16 AM UTC, comment #1: |
Earl Hood <ehood> |
Sun 09 Jan 2011 08:46:00 AM UTC, original submission:
If HTML filtering has not been disabled, and if using mhonarc's
|
Earl Hood <ehood> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 2 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2011-01-09 | ehood | Open/Closed | Open | Closed | |
2011-01-09 | ehood | Status | Confirmed | Fixed |
Powered by Savane 3.13-758e.
Corresponding source code
mhtxthtml.pl filter modified to fix exploit. Other modifications
done to improve the robustness of filtering along with rejecting
HTML that is too malformed to be legitimate HTML data.