RedhatCVELIST:CVE-2010-0004CVE-2010-0004
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
References
lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222
viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD
viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300
www.openwall.com/lists/oss-security/2010/01/11/2
www.openwall.com/lists/oss-security/2010/01/13/5
www.openwall.com/lists/oss-security/2010/01/14/4
www.redhat.com/archives/fedora-package-announce/2009-December/msg01421.html
www.redhat.com/archives/fedora-package-announce/2009-December/msg01464.html
Related
