From b17531f41b95b4bef62021c6cc4a38a78eacca00 Mon Sep 17 00:00:00 2001 From: delphij Date: Mon, 12 Nov 2007 00:39:01 +0000 Subject: Document plone arbitrary code execution vulnerability. Approved by: portmgr (ports-security blanket) --- security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'security/vuxml') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 8cd51d693cb3..645c5cea0aa1 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,36 @@ Note: Please add new entries to the beginning of this file. --> + + plone -- unsafe data interpreted as pickles + + + plone + 2.52.5.5 + 3.03.0.3 + + + + +

Plone projectreports:

+
This hotfix corrects a vulnerability in the statusmessages + and linkintegrity modules, where unsafe network data was + interpreted as python pickles. This allows an attacker to + run arbitrary python code within the Zope/Plone process.
+

+ + + + 26354 + CVE-2007-5741 + + + 2007-11-06 + 2007-11-12 + + + phpmyadmin -- cross-site scripting vulnerability -- cgit