MHonArc - Bugs: bug #32013, CVE-2010-4524: Improper escaping...
You are not allowed to post comments on this tracker with your current authentication level.
bug #32013: CVE-2010-4524: Improper escaping of certain HTML sequences (XSS)
Submitter: | Earl Hood <ehood> | ||
Submitted: | Thu 30 Dec 2010 08:04:54 PM UTC | ||
Category: | MIME Filter | Severity: | 6 - Security |
Priority: | 5 - Normal | Item Group: | Security |
Status: | Fixed | Privacy: | Public |
Assigned to: | ehood | Open/Closed: | Closed |
Operating System: | All | Perl Version: | All |
Component Version: | 2.6.16 | Fixed Release: | 2.6.17 |
Thu 30 Dec 2010 08:55:55 PM UTC, comment #1: |
Earl Hood <ehood> |
Thu 30 Dec 2010 08:04:54 PM UTC, original submission:
Specially crafted HTML email message can allow scripting
|
Earl Hood <ehood> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 6 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2011-01-09 | ehood | Item Group | Undesired Behavior | Security | |
Open/Closed | Open | Closed | |||
2011-01-09 | ehood | Status | Ready For Test | Fixed | |
2011-01-09 | ehood | Fixed Release | 2.6.17 | ||
2010-12-30 | ehood | Status | Confirmed | Ready For Test | |
2010-12-30 | ehood | Summary | Improper escaping of certain HTML sequences (XSS) | CVE-2010-4524: Improper escaping of certain HTML sequences (XSS) |
Powered by Savane 3.13-d3ae.
Corresponding source code
mhtxthtml.pl filter modified to reject any message with
nested tags. This is invalid HTML, so any message
that contains it would likely indicate someone trying
to attack an archive web site.