Bug 607746

Summary:	<www-apps/piwigo-2.8.6: Cross-site scripting (XSS) vulnerability in the image upload function (CVE-2017-5608)
Product:	Gentoo Security	Reporter:	Bernard Cafarelli <voyageur>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5608
Whiteboard:	~3 [noglsa cve]
Package list:		Runtime testing required:	---

Description Bernard Cafarelli gentoo-dev

2017-01-30 19:07:14 UTC

Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via a crafted image filename

~arch only package

Comment 1 Bernard Cafarelli gentoo-dev

2017-01-30 19:13:05 UTC

2.8.6 is now in tree, I removed previous version

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2017-01-30 22:34:44 UTC

(In reply to Bernard Cafarelli from comment #1)
> 2.8.6 is now in tree, I removed previous version

thanks for the report and quick action!