Secure testing team - Mar 2010 - Bug#575777: CVE-2010-0004 CVE-2010-0005

Package: viewvc
Severity: serious
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for viewvc.

CVE-2010-0004[0]:
| ViewVC before 1.1.3 composes the root listing view without using the
| authorizer for each root, which might allow remote attackers to
| discover private root names by reading this view.

CVE-2010-0005[1]:
| query.py in the query interface in ViewVC before 1.1.3 does not reject
| configurations that specify an unsupported authorizer for a root,
| which might allow remote attackers to bypass intended access
| restrictions via a query.

If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0004
    http://security-tracker.debian.org/tracker/CVE-2010-0004
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0005
    http://security-tracker.debian.org/tracker/CVE-2010-0005


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkuwXE8ACgkQNxpp46476aqGjwCgnsgcAXKzsz8mdcktg9rxIG1F
elYAoJk2IZTsUGPg3CaDU5U+TqBee0zX
=XLxz
-----END PGP SIGNATURE-----