bugtraq - Re: [USN-147-1] PHP XMLRPC vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050708111421.xv110sglk4cok4wk@neo.wg.de>
Date: Fri, 08 Jul 2005 11:14:21 +0200
From: Jan Schneider <jan@...de.org>
To: Martin Pitt <martin.pitt@...onical.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	ubuntu-security-announce@...ts.ubuntu.com
Subject: Re: [USN-147-1] PHP XMLRPC vulnerability

Zitat von Martin Pitt <martin.pitt@...onical.com>:

> Please note that many applications contain a copy of the affected 
> XMLRPC code,
> which must be fixed separately. The following packages may also be affected,
> but are unsupported in Ubuntu:
>
> - drupal
> - wordpress
> - phpwiki
> - horde3
> - ewiki
> - egroupware
> - phpgroupware

To avoid confusion, I want to make clear that Horde applications are 
NOT affected by this vulnerability because we don't use the vulnerable 
software. I would appreciate if such statements would be cross checked 
with the projects before releasing them to the public.

Jan.

-- 
Do you need professional PHP or Horde consulting?
http://horde.org/consulting/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/