Launchpad CVE tracker

CVE 2011-0728

Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Related bugs and status

CVE-2011-0728 (Candidate) is related to these bugs:

Bug #586611: loggerhead needs a hard dependency on simplejson

Summary				In	Importance	Status
	586611	loggerhead needs a hard dependency on simplejson		loggerhead	Medium	Fix Released
	586611	loggerhead needs a hard dependency on simplejson		loggerhead (Ubuntu)	Undecided	Fix Released

Bug #740142: persistent xss vector in (unescaped) filenames in revision views

		In	Importance	Status
740142	persistent xss vector in (unescaped) filenames in revision views	loggerhead	Critical	Fix Released
740142	persistent xss vector in (unescaped) filenames in revision views	Launchpad itself	Critical	Fix Released
740142	persistent xss vector in (unescaped) filenames in revision views	loggerhead (Ubuntu)	High	Fix Released
740142	persistent xss vector in (unescaped) filenames in revision views	loggerhead (Ubuntu Karmic)	Undecided	Fix Released
740142	persistent xss vector in (unescaped) filenames in revision views	loggerhead (Ubuntu Lucid)	Undecided	Fix Released
740142	persistent xss vector in (unescaped) filenames in revision views	loggerhead (Ubuntu Maverick)	Undecided	Fix Released

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2011-0728

References