Security fix for flash-based cloud in Freetag plugin
MustLive discovered a HTML-injection vulnerability in the tagcloud.swf Flashfile that the Freetag-Plugin bundles and makes optionally available.
The issue is fixed in version 1.23 of the flashfile, which has now been committed to the Serendipity plugin (in version 3.30).
Since the swf-File is always bundled with the update, it is recommended to update to the latest version of the plugin for all users, or to delete that specific .swf file.
Thanks to MustLive for sharing the information with us.
Trackbacks
Trackback-URL für diesen Eintrag
- Keine Trackbacks
Kommentare
Ansicht der Kommentare: (Linear | Verschachtelt)
Steve am um :
Thanks Garv, but how is this injection triggered? How can I see if anyone already used this vulnerability?
Witi am um :
bump Would be a nice information.
Pacquiao vs Marquez 3 am um :
nice blog & very informative, i'm bookmarking this blog & visiting again for updates.