Debian Security Advisory

DSA-2158-1 cgiirc -- cross-site scripting

Date Reported:
09 Feb 2011
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2011-0050.
More information:

Michael Brooks (Sitewatch) discovered a reflective XSS flaw in CGI:IRC, a web based IRC client, which could lead to the execution of arbitrary javascript.

For the old-stable distribution (lenny), this problem has been fixed in version 0.5.9-3lenny1.

For the stable distribution (squeeze), and unstable distribution (sid), this problem will be fixed shortly.

We recommend that you upgrade your cgiirc packages.