From 1da851aff67408c523f76b88c45c6e38aa166c3b Mon Sep 17 00:00:00 2001 From: Erwin Lansing Date: Mon, 4 Jun 2007 20:56:26 +0000 Subject: [PATCH] Add an entry for an email header injection vulnerability in www/typo3 from February. Reviewed by: remko Persuaded by: cperciva and simon by setting up the ports-security team --- security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e54057eee525..409e6a14a4cf 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,36 @@ Note: Please add new entries to the beginning of this file. --> + + typo3 -- email header injection + + + typo3 + 3.04.0.5 + 4.14.1.1 + + + + +

Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:

+
+

An unspecified error in the internal form engine can be used for + sending arbitrary mail headers, using it for purposes which it + is not meant for, e.g. sending spam messages.

+
+ + + + CVE-2007-1081 + http://secunia.com/advisories/24207/ + http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/ + + + 2007-02-21 + 2007-06-04 + + + phppgadmin -- cross site scripting vulnerability