viewc: Cross-Site Scripting (XSS) vulnerability

Debian Bug report logs - #854681
viewc: Cross-Site Scripting (XSS) vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Sebastien Delafond <seb@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: viewc: Cross-Site Scripting (XSS) vulnerability

Date: Thu, 09 Feb 2017 14:32:39 +0100

Package: viewc
Severity: important
Tags: security
Control: found 1.1.25+repack-1
Control: notfound 1.1.26-1

XSS vulnerability, identified by CVE-2017-5938. See
https://github.com/viewvc/viewvc/commit/9dcfc7daa4c940992920d3b2fbd317da20e44aad.

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, armel

Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: sysvinit (via /sbin/init)

Message #14 received at 854681@bugs.debian.org (full text, mbox, reply):

From: Adrian Bunk <bunk@debian.org>

To: Sebastien Delafond <seb@debian.org>, 854681@bugs.debian.org

Cc: Lev Lamberov <dogsleg@debian.org>

Subject: Re: Bug#854681: viewc: Cross-Site Scripting (XSS) vulnerability

Date: Thu, 9 Feb 2017 15:46:44 +0200

Control: reassign -1 viewvc 1.1.25+repack-1
Control: fixed -1 1.1.26-1

- view*v*c
- fixed, not notfound

On Thu, Feb 09, 2017 at 02:32:39PM +0100, Sebastien Delafond wrote:
> Package: viewc
> Severity: important
> Tags: security
> Control: found 1.1.25+repack-1
> Control: notfound 1.1.26-1
> 
> XSS vulnerability, identified by CVE-2017-5938. See
> https://github.com/viewvc/viewvc/commit/9dcfc7daa4c940992920d3b2fbd317da20e44aad.
> 
> -- System Information:
> Debian Release: stretch/sid
>   APT prefers unstable
>   APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
> Architecture: amd64 (x86_64)
> Foreign Architectures: i386, armel
> 
> Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
> Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/bash
> Init: sysvinit (via /sbin/init)

Message #29 received at 854681-done@bugs.debian.org (full text, mbox, reply):

From: Lev Lamberov <dogsleg@debian.org>

To: 854681-done@bugs.debian.org

Date: Wed, 13 Feb 2019 16:42:28 +0500

Hi,

This bug was fixed in versions viewvc/1.1.22-1+deb8u1 and viewvc/1.1.26-1, the only versions
available in Debian.

Regards,
Lev Lamberov

Send a report that this bug log contains spam.