From e932073a626743749847a2aa1f443c5ef66335ca Mon Sep 17 00:00:00 2001 From: sem Date: Thu, 10 Nov 2005 11:09:55 +0000 Subject: - Document p5-Mail-SpamAssassin vulnerabily (alread fixed in ports) - Document flyspray cross-site scripting vulnerabilities --- security/vuxml/vuln.xml | 66 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 95fb0e2..9c795a4 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,72 @@ Note: Please add new entries to the beginning of this file. --> + + flyspray -- cross-site scripting vulnerabilities + + + flyspray + 0.9.8 + + + + +

A Secunia Advisory reports:

+
Lostmon has reported some vulnerabilities in Flyspray, + which can be exploited by malicious people to conduct + cross-site scripting attacks.
+
Some input isn't properly sanitised before being + returned to the user. This can be exploited to execute + arbitrary HTML and script code in a user's browser + session in context of an affected site.
+

+ + + + http://secunia.com/advisories/17316/ + http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html + + + 2005-10-26 + 2005-11-10 + + + + + p5-Mail-SpamAssassin -- long message header denial of service + + + p5-Mail-SpamAssassin + 3.1.0 + + + + +

A Secunia Advisory reports:

+
A vulnerability has been reported in SpamAssassin, + which can be exploited by malicious people to cause + a DoS (Denial of Service).
+
The vulnerability is caused due to the use of + an inefficient regular expression in + "/SpamAssassin/Message.pm" to parse email headers. + This can cause perl to crash when it runs out of stack + space and can be exploited via a malicious email that + contains a large number of recipients.
+

+ + + + http://secunia.com/advisories/17386/ + http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570 + + + 2005-11-10 + 2005-11-10 + + + qpopper -- multiple privilege escalation vulnerabilities -- cgit v1.1