PHP Trans SID XSS (Was: New php release with security fixes)

To: je@xxxxxxxxxx
Subject: PHP Trans SID XSS (Was: New php release with security fixes)
From: "Sverre H. Huseby" <shh@xxxxxxxxxxxx>
Date: Fri, 30 May 2003 14:41:53 +0200
Delivered-to: zerbey@localhost.horry.org
Delivered-to: mailing list bugtraq@securityfocus.com
Delivered-to: moderator for bugtraq@securityfocus.com
Delivery-date: Sun, 01 Jun 2003 19:37:08 +0100
Envelope-to: zerbey@wibble.co.uk
In-reply-to: <Pine.BSO.4.55.0305291531230.6630@birdie.sekure.net>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@securityfocus.com; run by ezmlm
References: <Pine.BSO.4.55.0305291531230.6630@birdie.sekure.net>
User-agent: Mutt/1.4.1i

It also fixes the following, which wasn't mentioned in the summary (or
elsewhere, as far as I can see):

  "Cross-site Scripting in PHP's Transparent Session ID Support"
   http://shh.thathost.com/secadv/2003-05-11-php.txt


Sverre.

-- 
shh@xxxxxxxxxxxx
http://shh.thathost.com/

Prev by Date: Re: Multiple Vulnerabilities In P-Synch Password Management
Next by Date: MDKSA-2003:063 - Updated apache2 packages fix vulnerabilities
Previous by thread: Re: Multiple Vulnerabilities In P-Synch Password Management
Next by thread: MDKSA-2003:063 - Updated apache2 packages fix vulnerabilities
Index(es):
- Date
- Thread