CVE-2016-1566: XSS vulnerability in file browser

Debian Bug report logs - #859136
CVE-2016-1566: XSS vulnerability in file browser

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupre <anarcat@orangeseeds.org>

To: submit@bugs.debian.org

Subject: CVE-2016-1566: XSS vulnerability in file browser

Date: Thu, 30 Mar 2017 14:45:21 -0400

[Message part 1 (text/plain, inline)]

Package: guacamole-client
X-Debbugs-CC: team@security.debian.org secure-testing-team@lists.alioth.debian.org
Severity: normal
Tags: security
Version: 0.9.9+dfsg-1

Hi,

the following vulnerability was published for guacamole.

CVE-2016-1566[0]:
| Cross-site scripting (XSS) vulnerability in the file browser in
| Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location
| shared by multiple users, allows remote authenticated users to inject
| arbitrary web script or HTML via a crafted filename.  NOTE: this
| vulnerability was fixed in guacamole.war on 2016-01-13, but the
| version number was not changed.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-1566
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1566

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 859136@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: 859136@bugs.debian.org

Subject: Re: CVE-2016-1566: XSS vulnerability in file browser

Date: Mon, 2 Oct 2017 21:19:17 +0200

On Thu, Mar 30, 2017 at 02:45:21PM -0400, Antoine Beaupre wrote:
> Package: guacamole-client
> X-Debbugs-CC: team@security.debian.org secure-testing-team@lists.alioth.debian.org
> Severity: normal
> Tags: security
> Version: 0.9.9+dfsg-1
> 
> Hi,
> 
> the following vulnerability was published for guacamole.
> 
> CVE-2016-1566[0]:
> | Cross-site scripting (XSS) vulnerability in the file browser in
> | Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location
> | shared by multiple users, allows remote authenticated users to inject
> | arbitrary web script or HTML via a crafted filename.  NOTE: this
> | vulnerability was fixed in guacamole.war on 2016-01-13, but the
> | version number was not changed.

What's the status? More than half a year has passed.

Cheers,
        Moritz

Message #17 received at 859136@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 859136@bugs.debian.org

Subject: Re: Bug#859136: CVE-2016-1566: XSS vulnerability in file browser

Date: Tue, 3 Oct 2017 20:55:47 +0200

Hi

On Mon, Oct 02, 2017 at 09:19:17PM +0200, Moritz Muehlenhoff wrote:
> On Thu, Mar 30, 2017 at 02:45:21PM -0400, Antoine Beaupre wrote:
> > Package: guacamole-client
> > X-Debbugs-CC: team@security.debian.org secure-testing-team@lists.alioth.debian.org
> > Severity: normal
> > Tags: security
> > Version: 0.9.9+dfsg-1
> > 
> > Hi,
> > 
> > the following vulnerability was published for guacamole.
> > 
> > CVE-2016-1566[0]:
> > | Cross-site scripting (XSS) vulnerability in the file browser in
> > | Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location
> > | shared by multiple users, allows remote authenticated users to inject
> > | arbitrary web script or HTML via a crafted filename.  NOTE: this
> > | vulnerability was fixed in guacamole.war on 2016-01-13, but the
> > | version number was not changed.
> 
> What's the status? More than half a year has passed.

Upstream commit, afaics 

https://github.com/glyptodon/guacamole-client/commit/7da13129c432d1c0a577342a9bf23ca2bde9c367

Regards,
Salvatore

Message #24 received at 859136-submitter@bugs.debian.org (full text, mbox, reply):

From: Dominik George <nik@naturalnet.de>

To: 859136-submitter@bugs.debian.org

Subject: Bug#859136 marked as pending

Date: Tue, 17 Oct 2017 13:59:18 +0000

tag 859136 pending
thanks

Hello,

Bug #859136 reported by you has been fixed in the Git repository. You can
see the changelog below, and you can check the diff of the fix at:

    https://anonscm.debian.org/cgit/pkg-remote/packages/guacamole-client.git/commit/?id=e06c65f

---
commit e06c65fef15274ea8190e5b5e409dcfbecbe8708
Author: Dominik George <nik@naturalnet.de>
Date:   Tue Oct 17 15:58:58 2017 +0200

    Update control and changelog.

diff --git a/debian/changelog b/debian/changelog
index 8a3c08d..ff9b437 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+guacamole-client (0.9.13-1) UNRELEASED; urgency=medium
+
+  * New upstream version.
+    + Includes fix for CVE-2016-1566. (Closes: #859136)
+  * Update watch file for Apache Incubator. (Closes: #859373)
+  * Update Standards-Version to 4.1.1, no changes needed.
+
+ -- Dominik George <nik@naturalnet.de>  Tue, 17 Oct 2017 15:56:10 +0200
+
 guacamole-client (0.9.9+dfsg-1) unstable; urgency=medium
 
   [ Dominik George ]

Send a report that this bug log contains spam.