July 2007 - security [ARCHIVED] - Fedora Mailing-Lists

[Bug 239904] New: CVE-2007-2627: wordpress sidebar.php XSS

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239904 Summary: CVE-2007-2627: wordpress sidebar.php XSS Product: Fedora Extras Version: fc6 Platform: All URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2627 OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: wordpress AssignedTo: jwb(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2627 "Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622." -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

16 years, 9 months

1
3
0 / 0

fedora-security/audit fc7,1.34,1.35

by fedora-extras-commits＠redhat.com

Author: lkundrak Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv3043 Modified Files: fc7 Log Message: Freetype Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.34 retrieving revision 1.35 diff -u -r1.34 -r1.35 --- fc7 4 Jul 2007 17:24:55 -0000 1.34 +++ fc7 4 Jul 2007 17:47:49 -0000 1.35 @@ -10,6 +10,7 @@ CVE-2007-3544 ** (wordpress) #245211 CVE-2007-3543 ** (wordpress) #245211 CVE-2007-3508 ignore (glibc) not an issue +CVE-2007-3506 version (freetype, fixed 2.3.4) #235479 [since FEDORA-2007-0033] CVE-2007-3507 VULNERABLE (flac123, fixed 0.0.10) #246322 CVE-2007-3478 ** (gd) CVE-2007-3477 ** (gd) -- fedora-extras-commits mailing list fedora-extras-commits(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-extras-commits

16 years, 9 months

1
0
0 / 0

fedora-security/audit fc6,1.219,1.220

by fedora-extras-commits＠redhat.com

Author: lkundrak Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv2958 Modified Files: fc6 Log Message: These were forgotten about. Index: fc6 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc6,v retrieving revision 1.219 retrieving revision 1.220 diff -u -r1.219 -r1.220 --- fc6 18 Jun 2007 17:59:55 -0000 1.219 +++ fc6 4 Jul 2007 17:46:02 -0000 1.220 @@ -4,6 +4,13 @@ ** are items that need attention CVE-2007-4168 VULNERABLE (libexif) #243892 +CVE-2007-3508 ignore (glibc) not an issue +CVE-2007-3506 backport (freetype, fixed 2.3.4) #235479 [since FEDORA-2007-561] +CVE-2007-3378 ignore (php) safe mode escape +CVE-2007-3126 ignore (gimp) just a crash +*CVE-2007-2894 VULNERABLE (bochs) #241799 +CVE-2007-2876 version (kernel, fixed 2.6.21.5?) [since ?] +*CVE-2007-2874 (wpa_supplicant) #242455 CVE-2007-2873 version (spamassassin, fixed 3.1.9) CVE-2007-2438 VULNERABLE (vim) #238734 CVE-2007-1856 VULNERABLE (vixie-cron) #235882 -- fedora-extras-commits mailing list fedora-extras-commits(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-extras-commits

16 years, 9 months

1
0
0 / 0

fedora-security/audit fc7,1.33,1.34

by fedora-extras-commits＠redhat.com

Author: scop Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv31836 Modified Files: fc7 Log Message: +nessus-core, dar Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.33 retrieving revision 1.34 diff -u -r1.33 -r1.34 --- fc7 4 Jul 2007 15:57:49 -0000 1.33 +++ fc7 4 Jul 2007 17:24:55 -0000 1.34 @@ -4,11 +4,13 @@ *CVE are items that need verification for Fedora 7 -CVE-2007-3543 ** (wordpress) -CVE-2007-3544 ** (wordpress) +CVE-2007-4168 VULNERABLE (libexif) #243890 +CVE-2007-3546 ignore (nessus-core) Windows only +CVE-2007-3528 VULNERABLE (dar, fixed 2.3.4) #246760 +CVE-2007-3544 ** (wordpress) #245211 +CVE-2007-3543 ** (wordpress) #245211 CVE-2007-3508 ignore (glibc) not an issue CVE-2007-3507 VULNERABLE (flac123, fixed 0.0.10) #246322 -CVE-2007-4168 VULNERABLE (libexif) #243890 CVE-2007-3478 ** (gd) CVE-2007-3477 ** (gd) CVE-2007-3476 ** (gd) -- fedora-extras-commits mailing list fedora-extras-commits(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-extras-commits

16 years, 9 months

1
0
0 / 0

fedora-security/audit fe6,1.124,1.125

by fedora-extras-commits＠redhat.com

Author: scop Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv31812 Modified Files: fe6 Log Message: +nessus-core, dar, wordpress Index: fe6 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fe6,v retrieving revision 1.124 retrieving revision 1.125 diff -u -r1.124 -r1.125 --- fe6 30 Jun 2007 08:27:52 -0000 1.124 +++ fe6 4 Jul 2007 17:24:39 -0000 1.125 @@ -2,7 +2,11 @@ ** are items that need attention -CVE-NOID VULNERABLE (flac123, fixed 0.0.10) #246322 +CVE-2007-3546 ignore (nessus-core) Windows only +CVE-2007-3544 ** (wordpress) #245211 +CVE-2007-3543 ** (wordpress) #245211 +CVE-2007-3528 VULNERABLE (dar, fixed 2.3.4) #246760 +CVE-2007-3507 VULNERABLE (flac123, fixed 0.0.10) #246322 CVE-2007-3241 ** (wordpress) #245211 CVE-2007-3240 ** (wordpress) #245211 CVE-2007-3239 ** (wordpress) #245211 -- fedora-extras-commits mailing list fedora-extras-commits(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-extras-commits

16 years, 9 months

1
0
0 / 0

fedora-security/audit fc7,1.32,1.33

by fedora-extras-commits＠redhat.com

Author: lkundrak Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv7617 Modified Files: fc7 Log Message: Wordpress Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.32 retrieving revision 1.33 diff -u -r1.32 -r1.33 --- fc7 2 Jul 2007 19:29:39 -0000 1.32 +++ fc7 4 Jul 2007 15:57:49 -0000 1.33 @@ -4,6 +4,9 @@ *CVE are items that need verification for Fedora 7 +CVE-2007-3543 ** (wordpress) +CVE-2007-3544 ** (wordpress) +CVE-2007-3508 ignore (glibc) not an issue CVE-2007-3507 VULNERABLE (flac123, fixed 0.0.10) #246322 CVE-2007-4168 VULNERABLE (libexif) #243890 CVE-2007-3478 ** (gd) @@ -19,6 +22,7 @@ CVE-2007-3391 VULNERABLE (wireshark) CVE-2007-3390 VULNERABLE (wireshark) CVE-2007-3389 VULNERABLE (wireshark) +CVE-2007-3378 ignore (php) safe mode escape CVE-2007-3241 ** (wordpress) #245211 CVE-2007-3240 ** (wordpress) #245211 CVE-2007-3239 ** (wordpress) #245211 -- fedora-extras-commits mailing list fedora-extras-commits(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-extras-commits

16 years, 9 months

1
0
0 / 0

fedora-security/audit fc7,1.31,1.32

by fedora-extras-commits＠redhat.com

Author: lkundrak Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv2162 Modified Files: fc7 Log Message: cve for flac123 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.31 retrieving revision 1.32 diff -u -r1.31 -r1.32 --- fc7 30 Jun 2007 08:28:36 -0000 1.31 +++ fc7 2 Jul 2007 19:29:39 -0000 1.32 @@ -4,7 +4,7 @@ *CVE are items that need verification for Fedora 7 -CVE-NOID VULNERABLE (flac123, fixed 0.0.10) #246322 +CVE-2007-3507 VULNERABLE (flac123, fixed 0.0.10) #246322 CVE-2007-4168 VULNERABLE (libexif) #243890 CVE-2007-3478 ** (gd) CVE-2007-3477 ** (gd) -- fedora-extras-commits mailing list fedora-extras-commits(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-extras-commits

16 years, 9 months

1
0
0 / 0

fedora-security/audit fe5,1.210,1.211

by fedora-extras-commits＠redhat.com

Author: scop Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv1648 Modified Files: fe5 Log Message: FC5 is EOL. Index: fe5 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fe5,v retrieving revision 1.210 retrieving revision 1.211 diff -u -r1.210 -r1.211 --- fe5 30 Jun 2007 08:27:52 -0000 1.210 +++ fe5 2 Jul 2007 19:25:50 -0000 1.211 @@ -1,5 +1,8 @@ # $Id$ +This list is no longer maintained by the Fedora Security Response Team +as of 2nd July 2007 (the Fedora Core 5 EOL date). + ** are items that need attention CVE-NOID VULNERABLE (flac123, fixed 0.0.10) #246322 -- fedora-extras-commits mailing list fedora-extras-commits(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-extras-commits

16 years, 9 months

1
0
0 / 0

Security Response product in Bugzilla, add-tracking-bugs?

by Ville Skyttä

Hi, Is the "Security Response" product in Bugzilla and the add-tracking-bugs functionality for creating dependency trees available for use to people who are not in the Red Hat security response team? Example: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244808 and its dependencies.

16 years, 9 months

2
1
0 / 0

Need some security advice for systemtap

by David Smith

I need some security development help (and this might be the wrong list - if so, please point me in the right direction). I'm one of the systemtap developers. You can see <http://sourceware.org/systemtap/> for details, but a 2 second overview is that systemtap allows users to write a script that probes points in the kernel. systemtap takes the script, converts it into C, compiles the C into a kernel module, inserts the kernel module, and displays any output from the compiled script. When the script finishes, we remove the kernel module. One of the complaints we get from users is that we require root access (using sudo) to install/remove the kernel module. Large enterprise customers typically don't give out sudo access to all admins. So, they would like a way to designate certain scripts/modules as "blessed", and allow admins/developers/etc. without root access to run those "blessed" scripts/modules. Some basic ideas about how we can allow users without sudo access to run "blessed" scripts/modules can be seen at <http://sources.redhat.com/bugzilla/show_bug.cgi?id=4523>, So, I'm looking for thoughts, criticisms, pointers, etc. to do this in a manner that won't allow a system to be easily compromised. We're in the fairly early stages of this idea, and I'm looking for direction before heading down the wrong road. Thanks for the help. -- David Smith dsmith(a)redhat.com Red Hat http://www.redhat.com 256.217.0141 (direct) 256.837.0057 (fax)

16 years, 9 months

8
17
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] July 2007