Debian Security Advisory
DSA-199-1 mhonarc -- cross site scripting
- Date Reported:
- 19 Nov 2002
- Affected Packages:
- mhonarc
- Vulnerable:
- Yes
- Security database references:
- In the Bugtraq database (at SecurityFocus): BugTraq ID 6204.
In Mitre's CVE dictionary: CVE-2002-1307. - More information:
-
Steven Christey discovered a cross site scripting vulnerability in mhonarc, a mail to HTML converter. Carefully crafted message headers can introduce cross site scripting when mhonarc is configured to display all headers lines on the web. However, it is often useful to restrict the displayed header lines to To, From and Subject, in which case the vulnerability cannot be exploited.
This problem has been fixed in version 2.5.2-1.2 for the current stable distribution (woody), in version 2.4.4-1.2 for the old stable distribution (potato) and in version 2.5.13-1 for the unstable distribution (sid).
We recommend that you upgrade your mhonarc package.
- Fixed in:
-
Debian GNU/Linux 2.2 (potato)
- Source:
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.4.4-1.2.dsc
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.4.4-1.2.diff.gz
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.4.4.orig.tar.gz
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.4.4-1.2.diff.gz
- Architecture-independent component:
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.4.4-1.2_all.deb
Debian GNU/Linux 3.0 (woody)
- Source:
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.5.2-1.2.dsc
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.5.2-1.2.diff.gz
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.5.2.orig.tar.gz
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.5.2-1.2.diff.gz
- Architecture-independent component:
- http://security.debian.org/pool/updates/main/m/mhonarc/mhonarc_2.5.2-1.2_all.deb
MD5 checksums of the listed files are available in the original advisory.