Hi Steffen, Thanks for the report. I had a quick look at the advisory, apparently both attacks have the same origin, TtaWCToMBstring().
Will have a look at fixing it, CC'ing upstream, since I haven't seen anything about the advisory over there. Regis On Tue, December 2, 2008 19:20, Steffen Joeris wrote: > Package: amaya > Severity: grave > Tags: security > Justification: user security hole > > Hi, > the following CVE (Common Vulnerabilities & Exposures) id was > published for amaya. > > CVE-2008-5282[0]: > | Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 > | allow remote attackers to execute arbitrary code via (1) a link with a > | long HREF attribute, and (2) a DIV tag with a long id attribute. > > If you fix the vulnerability please also make sure to include the > CVE id in your changelog entry. > > Cheers > Steffen > > For further information see: > > [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5282 > http://security-tracker.debian.net/tracker/CVE-2008-5282 > > > -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
