planet: missing input sanitizing
| Package(s): | planet | CVE #(s): | CVE-2009-2937 | ||||||||
| Created: | September 15, 2009 | Updated: | September 17, 2009 | ||||||||
| Description: | From the Debian bugzilla:
The planet feed aggregator attempts to remove malicious content from user-submitted feeds. It does a great job, but fails to sanitize this input:
<img src="javascript:alert(1);" > At least Opera will execute this code. | ||||||||||
| Alerts: |
| ||||||||||