Re: viewvc: CVE request: XSS and illegal characters while printing name-value pairs

[Alex Legler <a3li () gentoo org>]

On Mon, 7 Sep 2009 10:52:34 +0200, Thomas Biege <thomas () suse de> wrote:

> Hello,
> I do not have any further details, just this changelog entries:

The two commit messages have more or less detailed information:

>   * security fix: validate the 'view' parameter to avoid XSS attack

http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2214

>   * security fix: avoid printing illegal parameter names and values

http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2219

Alex

Attachment: signature.asc
Description: