Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 549334 (CVE-2015-3880) - <www-apps/phpBB-3.1.10: open redirect (CVE-2015-3880)
Summary: <www-apps/phpBB-3.1.10: open redirect (CVE-2015-3880)
Status: RESOLVED FIXED
Alias: CVE-2015-3880
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-05-13 07:17 UTC by Agostino Sarubbo
Modified: 2017-01-08 21:03 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
phpBB-3.1.9.ebuild (phpBB-3.1.9.ebuild,938 bytes, text/plain)
2016-07-05 10:39 UTC, Aaron Bauman (RETIRED) 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-05-13 07:17:58 UTC 
From ${URL} :

from the phpbb 3.0.14 release highlight:

> Security: An insufficient check allowed users of the Google Chrome browser to
> be redirected to external domains (e.g. on login). Thanks to Mathias Karlsson
> (avlidienbrunn) for bringing this to our attention.

https://wiki.phpbb.com/Release_Highlights/3.0.14

The patch seems to be this one:
https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2015-07-15 22:51:48 UTC 
@Maintainers: Can you post a new ebuild?
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2016-07-05 10:39:12 UTC 
Created attachment 439780 [details]
phpBB-3.1.9.ebuild
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2016-07-05 10:41:00 UTC 
Comment on attachment 439780 [details]
phpBB-3.1.9.ebuild

quickly put together and install tested.
Comment 4 James Le Cuirot gentoo-dev 2017-01-07 21:35:20 UTC 
3.1.10 is now in the tree and 3.0.x is now removed. Security team, please do your thing.
Comment 5 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-08 21:03:59 UTC 
GLSA Vote: No

@ Maintainer(s): Thank for your work!