oss-sec mailing list archives
Re: CVE request: multiple issues in ViewVC
From: "Steven M. Christey" <coley () linus mitre org>
Date: Wed, 12 Mar 2008 12:14:46 -0400 (EDT)
On Wed, 12 Mar 2008, Pierre-Yves Rofes wrote:
multiple security issues were fixed in the latest ViewVC release, apparently no CVE ids were assigned yet. Could we get some? Secunia advisory: http://secunia.com/advisories/29176/ Gentoo Bug: https://bugs.gentoo.org/show_bug.cgi?id=212288
This was one of those complex issues where, if you looked at the original changelog, you couldn't tell how many CVEs to assign. Thus the delay, though the bug report definitely helps. CVEs will be filled in later today. CVE-2008-1290 - list CVS or SVN commits on "all-forbidden" files CVE-2008-1291 - directly access hidden CVSROOT folders CVE-2008-1292 - expose restricted content via the revision view, the log history, or the diff view - Steve
Current thread:
- CVE request: multiple issues in ViewVC Pierre-Yves Rofes (Mar 11)
- Re: CVE request: multiple issues in ViewVC Steven M. Christey (Mar 12)