Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=homepage-ng.git;a=commitdiff;h=6623828b484e04bff3b619a5b24aa43c8ca7e8ca
commit 6623828b484e04bff3b619a5b24aa43c8ca7e8ca Author: Miklos Vajna <[EMAIL PROTECTED]> Date: Fri Sep 26 23:03:42 2008 +0200 FSA529-drupal-simplenews diff --git a/frugalware/xml/security.xml b/frugalware/xml/security.xml index 80e8f6f..cd59d0e 100644 --- a/frugalware/xml/security.xml +++ b/frugalware/xml/security.xml @@ -26,6 +26,19 @@ <fsas> <fsa> + <id>529</id> + <date>2008-09-26</date> + <author>Miklos Vajna</author> + <package>drupal-simplenews</package> + <vulnerable>5.x_1.4-1</vulnerable> + <unaffected>5.x_1.5-1solaria1</unaffected> + <bts>http://bugs.frugalware.org/task/3362</bts> + <cve>There is no CVE for this issue yet, see http://drupal.org/node/312944.</cve> + <desc>A vulnerability has been reported in the Simplenews module for Drupal, which can be exploited by malicious users to conduct script insertion attacks. + Input passed as Newsletter categories is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed. + Successful exploitation requires valid user credentials with the "administer taxonomy" permission.</desc> + </fsa> + <fsa> <id>528</id> <date>2008-09-26</date> <author>Miklos Vajna</author> _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
