CVE-2007-0901,0902: XSS in debugging information

Debian Bug report logs - #411084
CVE-2007-0901,0902: XSS in debugging information

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Kees Cook <kees@outflux.net>

To: Debian Bugs <submit@bugs.debian.org>

Subject: CVE-2007-0901,0902: XSS in debugging information

Date: Thu, 15 Feb 2007 13:41:47 -0800

[Message part 1 (text/plain, inline)]

Package: moin
Version: 1.3.4-3
Severity: grave
Tags: patch, security

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0901 says:

"Multiple cross-site scripting (XSS) vulnerabilities in Info pages in 
MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or 
HTML via the (1) hitcounts and (2) general parameters, different vectors 
than CVE-2007-0857."

This appears not to be true for the 1.5.x line of Moin, but it is true 
in 1.3.x.  Attached is the patch I'm using in Ubuntu, which also 
includes fixes for CVE-2007-0902, by allowing for "show_traceback" to be 
set to 0 in site configurations.

-- 
Kees Cook                                            @outflux.net

[091_fix-debug-report-xss.patch (text/x-diff, attachment)]

Send a report that this bug log contains spam.