From 5f8d1689985e77757167a17f380ea14a3f6d5dd9 Mon Sep 17 00:00:00 2001 From: culot Date: Wed, 6 Mar 2013 15:56:59 +0000 Subject: - Document vulnerabilities in typo3. Security: b9a347ac-8671-11e2-b73c-0019d18c446a Obtained from: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/ --- security/vuxml/vuln.xml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) (limited to 'security/vuxml') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index fb0e89f9dfc9..a4788ddd9062 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,48 @@ Note: Please add new entries to the beginning of this file. --> + + typo3 -- Multiple vulnerabilities in TYPO3 Core + + + typo3 + 4.5.04.5.23 + 4.6.04.6.16 + 4.7.04.7.8 + 6.0.06.0.2 + + + + +

Typo Security Team reports:

+
Extbase Framework - Failing to sanitize user input, the Extbase + database abstraction layer is susceptible to SQL Injection. TYPO3 + sites which have no Extbase extensions installed are not affected. + Extbase extensions are affected if they use the Query Object Model + and relation values are user generated input. Credits go to Helmut + Hummel and Markus Opahle who discovered and reported the issue.
+
Access tracking mechanism - Failing to validate user provided + input, the access tracking mechanism allows redirects to arbitrary + URLs. To fix this vulnerability, we had to break existing + behaviour of TYPO3 sites that use the access tracking mechanism + (jumpurl feature) to transform links to external sites. The link + generation has been changed to include a hash that is checked + before redirecting to an external URL. This means that old links + that have been distributed (e.g. by a newsletter) will not work + any more.
+

+ + + + http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/ + + + 2013-03-06 + 2013-03-06 + + + chromium -- multiple vulnerabilities -- cgit