oss-sec mailing list archives
Re: CVE request: smokeping XSS
From: Florian Weimer <fw () deneb enyo de>
Date: Mon, 27 Feb 2012 20:26:05 +0100
* Vincent Danen:
https://bugzilla.redhat.com/show_bug.cgi?id=783584
Is the patch https://bugzilla.redhat.com/attachment.cgi?id=556619 really correct? It does not strip the two magic characters "= (" should be enough, = is just defensive), so it's probably still possible to inject an onmouseover handler and CSS which enlarges the affected HTML element so that the handler is practically guaranteed to fire. I've just looked at the patch, I haven't got a (patched or unpatched) smokeping instance to test this.
Current thread:
- CVE request: smokeping XSS Vincent Danen (Jan 20)
- Re: CVE request: smokeping XSS Kurt Seifried (Jan 20)
- Re: CVE request: smokeping XSS Florian Weimer (Feb 27)
- Re: CVE request: smokeping XSS Vincent Danen (Mar 06)