TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."

This update for typo3-cms-4_7 fixes the following issues :

  - CVE-2014-3941: Multiple vulnerabilities     (TYPO3-CORE-SA-2014-001)

  - CVE-2013-4701: Multiple vulnerabilities     (TYPO3-CORE-SA-2014-002)

  - CVE-2013-7073: Multiple vulnerabilities     (TYPO3-CORE-SA-2013-004)

  - other security fixes, e.g. preventing XSS attacks.

The package was updated to last upstream version (discontinued) 4.7.20

Important security fixes for vulnerabilities in typo3 which can be used for Cross-Site Scripting or Denial of Service attacks or for authentication bypassing.

typo3-cms-4_5 was updated to version 4.5.34 to fix eight security vulnerabilities and several other bugs.

These security problems where fixed :

  - Add trusted HTTP_HOST configuration (CVE-2014-3941)

  - XSS in (old) extension manager information function     (CVE-2014-3943)

  - XSS in new content element wizard (CVE-2014-3943)

  - XSS in template tools on root page (CVE-2014-3943)

  - XSS in Backend Layout Wizard (CVE-2014-3943)

  - Encode URL for use in JavaScript (CVE-2014-3943)

  - Fix insecure unserialize in colorpicker (CVE-2014-3942)

  - Remove charts.swf to get rid of XSS vulnerability     (CVE-2014-3943)

ID	Name	Product	Family	Severity
93062	openSUSE Security Update : typo3-cms-4_7 (openSUSE-2016-1002)	Nessus	SuSE Local Security Checks	high
92930	openSUSE Security Update : typo3 (openSUSE-2016-959)	Nessus	SuSE Local Security Checks	high
76135	openSUSE Security Update : typo3-cms-4_5 (openSUSE-SU-2014:0813-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-3941

medium

Tenable Plugins

high

high

medium