Re: viewvc: CVE request: XSS and illegal characters while printing name-value pairs

[Josh Bressers <bressers () redhat com>]

Plese use these ids:

CVE-2009-3618 viewvc XSS (rev 2215)
CVE-2009-3619 viewvc print illegal parameter names unsafely (rev 2218)

-- 
    JB


----- "Ludwig Nussel" <ludwig.nussel () suse de> wrote:

> Thomas Biege wrote:
> > Version 1.1.2 (released 11-Aug-2009)
> >
> >   * security fix: validate the 'view' parameter to avoid XSS attack
> >   * security fix: avoid printing illegal parameter names and values
> http://viewvc.tigris.org/source/browse/*checkout*/viewvc/tags/1.1.2/CHANGES
>
> CVE request dropped off the radar I guess.
>
> cu
> Ludwig
>
> -- 
>  (o_   Ludwig Nussel
>  //\   
>  V_/_  http://www.suse.de/
> SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)