Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values."

Update of viewvc to version 1.0.9 fixes a cross-site scripting (XSS) problem and enhances filtering of illegal characters when displaying error messages (CVE-2009-3618, CVE-2009-3619).

CHANGES in 1.1.2: - security fix: validate the 'view' parameter to avoid XSS attack - security fix: avoid printing illegal parameter names and values - add optional support for character encoding detection (issue #400) - fix username case handling in svnauthz module (issue #419) - fix cvsdbadmin/svnadmin rebuild error on missing repos (issue #420) - don't drop leading blank lines from colorized file contents (issue #422) - add file.ezt template logic for optionally hiding binary file contents Also includes: Install and populate mimetypes.conf. This should hopefully help when colouring syntax using pygments. Install and populate mimetypes.conf.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CHANGES in 1.0.9: - security fix: validate the 'view' parameter to avoid XSS attack - security fix: avoid printing illegal parameter names and values Also includes: Patch by Patrick Monnerat to make allow_tar work on F-10.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
42328	openSUSE 10 Security Update : viewvc (viewvc-6578)	Nessus	SuSE Local Security Checks	medium
42249	openSUSE Security Update : viewvc (viewvc-1420)	Nessus	SuSE Local Security Checks	medium
42246	openSUSE Security Update : viewvc (viewvc-1420)	Nessus	SuSE Local Security Checks	medium
40582	Fedora 11 : viewvc-1.1.2-2.fc11 (2009-8507)	Nessus	Fedora Local Security Checks	medium
40581	Fedora 10 : viewvc-1.0.9-1.fc10 (2009-8501)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-3619

critical

Tenable Plugins

medium

medium

medium

medium

medium