https://bugzilla.redhat.com/show_bug.cgi?id=1336671 Bug ID: 1336671 Summary: CVE-2016-2803 bugzilla: Cross-site-scripting in dependency graphs Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@xxxxxxxxxx Reporter: anemec@xxxxxxxxxx CC: bazanluis20@xxxxxxxxx, emmanuel@xxxxxxxxx, itamar@xxxxxxxxxxxxxxxx, perl-devel@xxxxxxxxxxxxxxxxxxxxxxx, xavier@xxxxxxxxxxxx A vulnerability was found in the bugzilla application. Due to an incorrect parsing of the image map generated by the dot script, a specially crafted bug summary could trigger XSS in dependency graphs. External references: https://bugzilla.mozilla.org/show_bug.cgi?id=1253263 References: http://seclists.org/bugtraq/2016/May/72 Upstream fix: https://git.mozilla.org/?p=bugzilla/bugzilla.git;a=commitdiff;h=dd61903 -- You are receiving this mail because: You are on the CC list for the bug. -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list perl-devel@xxxxxxxxxxxxxxxxxxxxxxx http://lists.fedoraproject.org/admin/lists/perl-devel@xxxxxxxxxxxxxxxxxxxxxxx
