Bug#859136: CVE-2016-1566: XSS vulnerability in file browser
anarcat at orangeseeds.org
Thu Mar 30 18:45:21 UTC 2017
X-Debbugs-CC: team at security.debian.org secure-testing-team at lists.alioth.debian.org
the following vulnerability was published for guacamole.
| Cross-site scripting (XSS) vulnerability in the file browser in
| Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location
| shared by multiple users, allows remote authenticated users to inject
| arbitrary web script or HTML via a crafted filename. NOTE: this
| vulnerability was fixed in guacamole.war on 2016-01-13, but the
| version number was not changed.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the pkg-remote-team