Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.

This update fixes the following security issues :

  - 732323: CVE-2011-4345: namazu: XSS flaw by processing     HTTP cookies (CVE-2011-4345)

- bnc#732323 (pretty bug number!)

  - CVE-2011-4345 XSS flaw for IE6/7 in japanese locale

The remote host is affected by the vulnerability described in GLSA-201311-22 (Namazu: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Namazu. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code or cause a Denial of       Service condition.
      Furthermore, a remote attacker may be able to inject arbitrary web script       or HTML via a cookie.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
75972	openSUSE Security Update : namazu (openSUSE-SU-2011:1327-1)	Nessus	SuSE Local Security Checks	low
75677	openSUSE Security Update : namazu (openSUSE-SU-2011:1327-1)	Nessus	SuSE Local Security Checks	low
74534	openSUSE Security Update : namazu (openSUSE-2011-79)	Nessus	SuSE Local Security Checks	low
71124	GLSA-201311-22 : Namazu: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2011-4345

medium

Tenable Plugins

low

low

low

high