-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org [EMAIL PROTECTED] [EMAIL PROTECTED] OpenPKG-SA-2005.029 14-Dec-2005 ________________________________________________________________________ Package: apache Vulnerability: cross site scripting OpenPKG Specific: no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT <= apache-1.3.34-20051205 >= apache-1.3.34-20051214 OpenPKG 2.5 <= apache-1.3.33-2.5.4 >= apache-1.3.33-2.5.5 OpenPKG 2.4 <= apache-1.3.33-2.4.4 >= apache-1.3.33-2.4.5 OpenPKG 2.3 <= apache-1.3.33-2.3.6 >= apache-1.3.33-2.3.7 Description: According to vendor information [0], a Cross-Site Scripting (XSS) vulnerability exists in the Apache HTTP server [1]. The flaw exists in the "mod_imap" extension module and occurs when using the "Referer" directive with image maps. In certain configurations a remote attacker could perform an XSS attack if a victim can be forced to visit a malicious URL using certain web browsers. The Common Vulnerabilities and Exposures (CVE) project assigned the id CVE-2005-3352 [2] to the problem. ________________________________________________________________________ References: [0] http://issues.apache.org/bugzilla/show_bug.cgi?id=37874 [1] http://httpd.apache.org/ [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352 ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG <[EMAIL PROTECTED]>" (ID 63C4CB9F) of the OpenPKG project which you can retrieve from http://pgp.openpkg.org and hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/ for details on how to verify the integrity of this advisory. ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG <[EMAIL PROTECTED]> iD8DBQFDoH90gHWT4GPEy58RAhdVAJ0VS9ZdblzdeFoUppzby5/Rvb3LwgCghRcF GhKY6XK9mxxKkpwTUtSF+V4= =vbUz -----END PGP SIGNATURE-----
