=================== BUG #3128: LATEST MODIFICATIONS ==================
http://savannah.nongnu.org/bugs/?func=detailbug&bug_id=3128&group_id=1968
Changes by: Earl Hood <earl(_at_)earlhood(_dot_)com>
Date: Sat 04/05/2003 at 17:57 (US/Central)
What | Removed | Added
---------------------------------------------------------------------------
Resolution | None | Fixed
Status | Open | Closed
Fixed Release | | 2.6.3
------------------ Additional Follow-up Comments ----------------------------
mhtxthtml.pl modified to deal with these cases.
BTW, Why would recognize javascript URLs with whitespace
characters embedded in them? Kind of stupid if you ask me.
=================== BUG #3128: FULL BUG SNAPSHOT ===================
Submitted by: ehood Project: MHonArc
Submitted on: Sat 04/05/2003 at 17:54
Category: MIME Filter Severity: 5 - Major
Bug Group: Security Resolution: Fixed
Assigned to: None Status: Closed
Platform Version: All Perl Version: All
Component Version: <=2.6.2 Fixed Release: 2.6.3
Summary: XSS Vulnerabilies
Original Submission: Copied from private message:
The following constructs all came out as working javascript or SSI
directives after I installed mhonarc v2.6.2 and ran them through
mhonarc -single:
<!-<link>-#exec foo -->
<img src=foo onerror="alert(1)">
<img lowsrc="javas
cript:alert(2)">
<img lowsrc="javas	cript:alert(3)">
Follow-up Comments
*******************
-------------------------------------------------------
Date: Sat 04/05/2003 at 17:57 By: ehood
mhtxthtml.pl modified to deal with these cases.
BTW, Why would recognize javascript URLs with whitespace
characters embedded in them? Kind of stupid if you ask me.
CC list is empty
No files currently attached
For detailed info, follow this link:
http://savannah.nongnu.org/bugs/?func=detailbug&bug_id=3128&group_id=1968
---------------------------------------------------------------------
To sign-off this list, send email to majordomo(_at_)mhonarc(_dot_)org with the
message text UNSUBSCRIBE MHONARC-DEV
