Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
[VulnDiscuss] Re: [Full-Disclosure] Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability
From: Roman Medina (romanrs-labs.com)
Date: Wed Jun 02 2004 - 17:10:05 CDT
On Tue, 1 Jun 2004 16:59:42 -0700, you wrote:
>On Wed, Jun 02, 2004 at 01:49:01AM +0200, Roman Medina wrote:
>> In other words, many vendors/developers silently fixes bugs and they don't
>> necesarily have to know who is packaging their software and inform them.
>this way. There is no need to contact every downstream vendor directly;
>they monitor the usual channels.
#define usual_channels bugtraq other_lists
#define usual_channels changelog_file
printf("My usual channels are: %s", usual_channels);
It was some kind of pseudocode :-) Question: which perspective are
using Debian maintainers to monitorize their packages? In the
particular case of SM, the old XSS issues were listed in ChangeLog,
but .deb package was not updated. Why?
09BB EFCD 21ED 4E79 25FB 29E1 E47F 8A7D EAD5 6742
[Key ID: 0xEAD56742. Available at KeyServ]