CVE request: TYPO3-EXT-SA-2014-014 and TYPO3-EXT-SA-2014-015

[Henri Salo <henri () nerv fi>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Can I get two 2014 CVEs for following TYPO3 extension vulnerabilities, thank you.

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-014/

It has been discovered that the extension "fal_sftp" (fal_sftp) is susceptible to
Improper Access Control.

Release Date: October 17, 2014
Affected Versions: 0.2.4, 0.2.5
Vulnerability Type: Improper Access Control
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C

Problem Description: Configured permissions of newly created files and folders
for the sFTP driver are set incorrectly.

Solution: Updated version 0.2.6 is available from the TYPO3 extension manager
and at http://typo3.org/extensions/repository/download/fal_sftp/0.2.6/t3x/.
Please check your existing setup and fix permission if needed! Users of the
extension are advised to update the extension as soon as possible.

Credits: Credits go to Jost Baron who discovered and reported the issue.

- -

http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-015/

It has been discovered that the extension "Dynamic Content Elements" (dce) is
susceptible to Information Disclosure.

Release Date: October 17, 2014
Affected Versions: all versions of 0.7.x, 0.8.x, 0.9.x, 0.10.x, 0.11.4 and below
of 0.11.x

Vulnerability Type: Information Disclosure
Severity: Low
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:H/RL:OF/RC:C

Problem Description: The extension provides a functionality to check for
extension updates. Along with this functionality, installation environment data
is automatically reported to the infrastructure of the extension author without
user interaction.

Solution: Updated version 0.11.5 is available from the TYPO3 extension manager
and at http://typo3.org/extensions/repository/download/dce/0.11.5/t3x/. The new
extension version provides a configuration option to enable the described
behaviour.

Credits: Credits go to Georg Ringer who discovered and reported the issue and
Armin Vieweg who quickly responded & resolved this issue. 

- ---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlRCKUYACgkQXf6hBi6kbk8NiQCfThDCmISqf0/wZtvAnnNfpnkU
8gQAn08njOk/+4STMSkpvkn9KZo9mUI4
=SKx5
-----END PGP SIGNATURE-----