Bug 256561 (CVE-2007-4542)

Summary:	CVE-2007-4542 Multiple XSS vulnerabilities in mapserver's CGI interface
Product:	[Fedora] Fedora	Reporter:	Lubomir Kundrak <lkundrak>
Component:	mapserver	Assignee:	Oliver Falk <oliver>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	low	Docs Contact:
Priority:	low
Version:	7	Keywords:	Reopened, Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	All
URL:	http://trac.osgeo.org/mapserver/ticket/2256
Whiteboard:
Fixed In Version:	4.10.3-2.fc7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-09-04 22:14:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Lubomir Kundrak 2007-08-27 14:27:08 UTC

Description of problem:

Newly released Mapserver 4.10.3 fixes two vulnerabilities which could be
possibly exploited to conduct a Cross-Site Scripting attack against user who
would follow a link to malicious site while visiting a mapserver site.

Version-Release number of selected component (if applicable):

mapserver-4.10.2-4.fc7

Additional info:

See URL for upstream bug ticket and a patch. No CVE identifier is assigned to
this issue yet.

Comment 1 Lubomir Kundrak 2007-08-27 14:36:37 UTC

A CVE name  was requested.

Comment 2 Lubomir Kundrak 2007-08-28 09:26:39 UTC

Mitre assigned CVE-2007-4542 to this issue.

Comment 3 Oliver Falk 2007-08-31 06:58:20 UTC

Fixed in devel and f7, updated pushed.

Comment 4 Balint Cristian 2007-09-03 22:41:47 UTC

I try look/update to 4.10.3 ones tomorrow for Fedora / EPEL ones.
I hadn't chance to read ChangeLog or the issue, but its solvable i think.

Comment 5 Balint Cristian 2007-09-03 22:43:00 UTC

Lobo, BTW Oliver is not implied in GIS package maintainace only in the alpha 
port, i am only/lonely with the GIS/geography ones for RH/Fedora.

Comment 6 Lubomir Kundrak 2007-09-04 16:45:47 UTC

Cristian, Oliver volunteered to do the update while you were away.
https://admin.fedoraproject.org/updates/pending/F7/mapserver-4.10.3-2.fc7

Comment 7 Lubomir Kundrak 2007-09-04 16:49:28 UTC

The version bump also solves bug #272081

Comment 8 Fedora Update System 2007-09-04 22:14:11 UTC

mapserver-4.10.3-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.