lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <42CA733A.4080403@nohn.net> Date: Tue Jul 5 12:44:22 2005 From: sebastian at nohn.net (Sebastian Nohn) Subject: Re: FD-V5-I5 [ GLSA 200507-01 ] PEAR XML-RPC, phpxmlrpc: PHP script injection vulnerability Tony Dodd wrote: > There is talk from some people that simply upgrading phpxmlrpc will not > suffice, and that you have to upgrade everything which uses it. > Confusion abundant so to speak. > > Anyone have any clarification on this? If someone bundled a vulnerable package in his distribution, upgrading the original package does not help, you need to upgrade the bundled version also. The easiest way to do that is to upgrade the application that bundles the lib (given that the application developers provide an updated version). Sebastian
Powered by blists - more mailing lists