Christian Welzel
2012-Jul-12 09:54 UTC
[Secure-testing-team] Bug#681323: libjs-swfupload: XSS via ExternalInterface.call
Package: libjs-swfupload Version: 2.2.0.1+ds1-1 Severity: grave Tags: security Justification: user security hole Dear Maintainer, libjs-swfupload contains a XSS security vulnarability that allows attackers to inject javascript code into the context of the current webpage. As a Flash applet can be loaded directly (with parameters in the URL), the Flash applet allows for reflected cross-site scripting. For sites where the applet is hosted on the same domain as the main website, this is a serious security concern. More information can be found here: http://code.google.com/p/swfupload/issues/detail?id=376 -- System Information: Debian Release: wheezy/sid APT prefers testing APT policy: (990, ''testing'') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-3-amd64 (SMP w/4 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- no debconf information