Re: [Full-Disclosure] Re: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability
From: Roman Medina (roman_at_rs-labs.com)
To: Matt Zimmerman <email@example.com> Date: Thu, 03 Jun 2004 00:10:05 +0200
On Tue, 1 Jun 2004 16:59:42 -0700, you wrote:
>On Wed, Jun 02, 2004 at 01:49:01AM +0200, Roman Medina wrote:
>> In other words, many vendors/developers silently fixes bugs and they don't
>> necesarily have to know who is packaging their software and inform them.
>this way. There is no need to contact every downstream vendor directly;
>they monitor the usual channels.
---- #ifdef _security_perspective_ #define usual_channels bugtraq other_lists #endif #ifdef _devel_perspective_ #define usual_channels changelog_file #endif printf("My usual channels are: %s", usual_channels); ---- It was some kind of pseudocode :-) Question: which perspective are using Debian maintainers to monitorize their packages? In the particular case of SM, the old XSS issues were listed in ChangeLog, but .deb package was not updated. Why? Saludos, --Roman -- PGP Fingerprint: 09BB EFCD 21ED 4E79 25FB 29E1 E47F 8A7D EAD5 6742 [Key ID: 0xEAD56742. Available at KeyServ] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html