504782 – (CVE-2014-0339) <app-admin/webmin-1.680 : XSS (CVE-2014-0339)

Bug 504782 (CVE-2014-0339) - <app-admin/webmin-1.680 : XSS (CVE-2014-0339)

Summary: <app-admin/webmin-1.680 : XSS (CVE-2014-0339)

Status:	RESOLVED FIXED

Alias:	CVE-2014-0339

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	http://seclists.org/fulldisclosure/20...
Whiteboard:	~4 [noglsa]
Keywords:

Duplicates (1):	509226 (view as bug list)
Depends on:	509226
Blocks:
	Show dependency tree

Reported:	2014-03-16 10:47 UTC by Frank Krömmelbein
Modified:	2014-05-01 16:44 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Frank Krömmelbein 2014-03-16 10:47:07 UTC

Security:
Fixed security issues that could be exploited by un-trusted Webmin users in the PHP Configuration and Webalizer modules.

Complete Changelog:
http://www.webmin.com/changes.html

Reproducible: Always

Comment 1 Agostino Sarubbo gentoo-dev

2014-03-16 14:19:54 UTC

Thanks for the report

Comment 2 Alex Legler (RETIRED) archtester

2014-05-01 10:02:20 UTC

*** Bug 509226 has been marked as a duplicate of this bug. ***

Comment 3 Markos Chandras (RETIRED) gentoo-dev

2014-05-01 16:30:20 UTC

+*webmin-1.680 (01 May 2014)
+
+  01 May 2014; Markos Chandras <hwoarang@gentoo.org> +webmin-1.680.ebuild,
+  -webmin-1.620.ebuild, -webmin-1.630.ebuild, -webmin-1.660.ebuild:
+  Version bump. Remove old versions. Bug #504782 by PhobosK
+  <phobosk@fastmail.fm>
+

Comment 4 Mikle Kolyada (RETIRED) archtester

2014-05-01 16:43:43 UTC

Thanks Markos.

Closing as [noglsa].

Comment 5 GLSAMaker/CVETool Bot gentoo-dev

2014-05-01 16:44:49 UTC

CVE-2014-0339 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0339):
  Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680
  allows remote attackers to inject arbitrary web script or HTML via the
  search parameter.