lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <42CA733A.4080403@nohn.net>
Date: Tue Jul  5 12:44:22 2005
From: sebastian at nohn.net (Sebastian Nohn)
Subject: Re: FD-V5-I5 [ GLSA 200507-01 ] PEAR XML-RPC,
	phpxmlrpc: PHP script injection vulnerability

Tony Dodd wrote:

> There is talk from some people that simply upgrading phpxmlrpc will not 
> suffice, and that you have to upgrade everything which uses it. 
> Confusion abundant so to speak.
> 
> Anyone have any clarification on this?

If someone bundled a vulnerable package in his distribution, upgrading 
the original package does not help, you need to upgrade the bundled 
version also. The easiest way to do that is to upgrade the application 
that bundles the lib (given that the application developers provide an 
updated version).

Sebastian

Powered by blists - more mailing lists