Vulnerability Bulletins |
Cross-Site Scripting en JFreeChart 1.0.8 |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Aumento de la visibilidad |
| Dificulty | Avanzado |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software | JFreeChart 1.0.8 |
Description |
|
|
Se han descubierto múltiples vulnerabilidades de tipo Cross-Site Scripting en JFreeChart 1.0.8. Las vulnerabilidades residen en errores de validación de la entrada en el código de generación HTML de mapas de imágenes. Un atacante remoto podría inyectar código arbitrario javaScript o JTML mediante una cadena especialmente diseñada en los atributos "chart name", "chart tool tip text", "href", "shape" o "coords". |
|
Solution |
|
|
Actualización de software Red Hat (RHSA-2008:0158-4) Red Hat Application Stack v1 for Enterprise Linux AS (v.4) Red Hat Application Stack v1 for Enterprise Linux ES (v.4) Red Hat Application Stack v2 https://rhn.redhat.com/ Red Hat (RHSA-2008:0151-4) JBoss Enterprise Application Platform 4.2.0 EL4 https://rhn.redhat.com/ Red Hat (RHSA-2008:0261-4) Red Hat Network Satellite (v. 5.0 para RHEL 4) https://rhn.redhat.com/ Red Hat (RHSA-2008:0630-3) Red Hat Network Satellite (v. 5.1 para RHEL 4) https://rhn.redhat.com/ |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2007-6306 |
| BID | 26752 |
Other resources |
|
|
Red Hat Security Advisory (RHSA-2008:0158-4) http://rhn.redhat.com/errata/RHSA-2008-0158.html Red Hat Security Advisory (RHSA-2008:0151-4) http://rhn.redhat.com/errata/RHSA-2008-0151.html Red Hat Security Advisory (RHSA-2008:0261-4) http://rhn.redhat.com/errata/RHSA-2008-0261.html Red Hat Security Advisory (RHSA-2008:0630-3) https://rhn.redhat.com/errata/RHSA-2008-0630.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2008-03-26 |
| 1.1 | Aviso emitido por Red Hat (RHSA-2008:0151-4) | 2008-04-11 |
| 1.2 | Aviso emitido por Red Hat (RHSA-2008:0261-4) | 2008-05-21 |
| 1.3 | Aviso emitido por Red Hat (RHSA-2008:0630-3) | 2008-08-19 |