*** This bug is a security vulnerability ***
Public security bug reported:
Binary package hint: elog
I presume that all releases are affected by these, as there is little
difference between them.
CVE-2008-0444:
"Cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) before
2.7.0 allows remote attackers to inject arbitrary web script or HTML via
subtext parameter to unspecified components."
CVE-2008-0445:
"The replace_inline_img function in elogd in Electronic Logbook (ELOG) before
2.7.1 allows remote attackers to cause a denial of service (infinite loop) via
crafted logbook entries. NOTE: some of these details are obtained from third
party information."
** Affects: elog (Ubuntu)
Importance: High
Status: Confirmed
** Affects: elog (Ubuntu Dapper)
Importance: Undecided
Status: New
** Affects: elog (Ubuntu Edgy)
Importance: Undecided
Status: New
** Affects: elog (Ubuntu Feisty)
Importance: Undecided
Status: New
** Affects: elog (Ubuntu Gutsy)
Importance: Undecided
Status: New
** Affects: elog (Ubuntu Hardy)
Importance: High
Status: Confirmed
** Affects: elog (Debian)
Importance: Unknown
Status: Unknown
** Visibility changed to: Public
** Bug watch added: Debian Bug tracker #463600
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463600
** Also affects: elog (Debian) via
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=463600
Importance: Unknown
Status: Unknown
** Changed in: elog (Ubuntu Hardy)
Importance: Undecided => High
Status: New => Confirmed
** Summary changed:
- [CVE-2008-0044, CVE-2008-0045] XSS and DoS
+ [CVE-2008-0444, CVE-2008-0445] XSS and DoS
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2008-0444
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2008-0445
--
[CVE-2008-0444, CVE-2008-0445] XSS and DoS
https://bugs.launchpad.net/bugs/216301
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
