diff options
| author | Sergey Matveychuk <sem@FreeBSD.org> | 2005-10-14 21:38:08 +0000 |
|---|---|---|
| committer | Sergey Matveychuk <sem@FreeBSD.org> | 2005-10-14 21:38:08 +0000 |
| commit | afc778e5607015943016cba473dae727300ef389 (patch) | |
| tree | d2b1cde68c10dc1461dd34de319c97bb42627ae8 /security/vuxml/vuln.xml | |
| parent | fd060b46db7353d7c8f4f74a6f40ad7a87312211 (diff) | |
Notes
Diffstat (limited to 'security/vuxml/vuln.xml')
| -rw-r--r-- | security/vuxml/vuln.xml | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 8bd81da12ded..f4c89c457ca1 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,41 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="47bdabcf-3cf9-11da-baa2-0004614cc33d"> + <topic>gallery2 -- a vulnerability has been discovered</topic> + <affects> + <package> + <name>gallery2</name> + <range><lt>2.0.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Michael Dipper wrote:</p> + <blockquote cite="http://dipper.info/security/20051012/"> + <p>A vulnerability has been discovered in gallery, + which allows remote users unauthorized access to files + on the webserver.</p> + <p>A remote user accessing gallery over the web may use + specially crafted HTTP parameters to access arbitrary + files located on the webserver. All files readable by + the webserver process are subject to disclosure. + The vulnerability is *not* restricted to the webserver's + document root but extends to the whole server file space.</p> + <p>The vulnerabilty may be used by any anonymous user, + there is no login to the application required.</p> + </blockquote> + </body> + </description> + <references> + <url>http://dipper.info/security/20051012/</url> + </references> + <dates> + <discovery>2005-10-12</discovery> + <entry>2005-10-15</entry> + </dates> + </vuln> + <vuln vid="60e26a40-3b25-11da-9484-00123ffe8333"> <topic>openssl -- potential SSL 2.0 rollback</topic> <affects> |