lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 14 Oct 2014 11:35:49 +0300
From: Henri Salo <henri@...v.fi>
To: "oststrom (public)" <pub@...strom.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in
 AdminCP/ApiLog via xmlrpc API (post-auth)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, Oct 13, 2014 at 10:38:03PM +0200, oststrom (public) wrote:
> CVE-2013-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via
> xmlrpc API (post-auth)

Can you confirm that this should be CVE-2014-2021 and not 2013 ID, thank you.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2021 says:

"pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial
of service (out-of-bounds-read) via a crafted length value in an encrypted PDF
file."

- ---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlQ84GUACgkQXf6hBi6kbk+iHQCfegUzTUZ/F2c80FKAz++m8snY
s8oAn2j9Hjx1QSkWmJTx/vS8ciKpG+Ud
=F6yu
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists