oss-sec mailing list archives
Joomla! Security News 2012-03-16
From: Henri Salo <henri () nerv fi>
Date: Fri, 16 Mar 2012 14:12:19 +0200
Can we assign CVE-identifiers for these two vulnerabilities? 20120304 - Core - Password Change http://developer.joomla.org/security/news/394-20120304-core-password-change.html 20120303 - Core - Privilege Escalation http://developer.joomla.org/security/news/395-20120303-core-privilege-escalation.html With Joomla you are never safe! - Henri Salo ----- Forwarded message from Joomla! Developer Network - Security News <no_reply () joomla org> ----- Date: Fri, 16 Mar 2012 12:09:18 +0000 From: Joomla! Developer Network - Security News <no_reply () joomla org> To: henri () nerv fi Subject: Joomla! Security News Joomla! Developer Network - Security News /////////////////////////////////////////// [20120304] - Core - Password Change Posted: 16 Mar 2012 12:21 AM PDT http://feedproxy.google.com/~r/JoomlaSecurityNews/~3/JukET1dgfDM/394-20120304-core-password-change.html?utm_source=feedburner&utm_medium=email Project: Joomla! SubProject: All Severity: High Versions: 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x releases Exploit type: Password Change Reported Date: 2012-March-8 Fixed Date: 2012-March-15 Description Insufficient randomness leads to password reset vulnerability. Affected Installs Joomla! versions 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x versions Solution Upgrade to version 2.5.3 Reported by George Argyros and Aggelos Kiayias Contact The JSST at the Joomla! Security Center. /////////////////////////////////////////// [20120303] - Core - Privilege Escalation Posted: 15 Mar 2012 05:00 AM PDT http://feedproxy.google.com/~r/JoomlaSecurityNews/~3/n5w8L96w-LM/395-20120303-core-privilege-escalation.html?utm_source=feedburner&utm_medium=email Project: Joomla! SubProject: All Severity: High Versions: 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x releases Exploit type: Privilege Escalation Reported Date: 2012-March-12 Fixed Date: 2012-March-15 Description Programming error allows privilege escalation in some cases. Affected Installs Joomla! versions 2.5.2, 2.5.1, 2.5.0, and all 1.7.x and 1.6.x versions Solution Upgrade to version 2.5.3 Reported by Jeff Channel Contact The JSST at the Joomla! Security Center. -- You are subscribed to email updates from "Joomla! Developer Network - Security News." To stop receiving these emails, you may unsubscribe now: http://feedburner.google.com/fb/a/mailunsubscribe?k=JWlBXz9w0F12fWtPu46jwc9_Jcc Email delivery powered by Google. Google Inc., 20 West Kinzie, Chicago IL USA 60610 ----- End forwarded message -----
Current thread:
- Joomla! Security News 2012-03-16 Henri Salo (Mar 16)
- Re: Joomla! Security News 2012-03-16 Kurt Seifried (Mar 19)