CVE-2006-1577

Name	CVE-2006-1577
Description	Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) start_day, (2) start_year, and (3) start_month parameters.
Source	CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
References	DSA-1133-1
NVD severity	medium (attack range: remote)
Debian Bugs	361138
Debian/oldstable	not known to be vulnerable.
Debian/stable	not vulnerable.
Debian/testing	not known to be vulnerable.
Debian/unstable	not known to be vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mantis (PTS)	squeeze (security)	1.1.8+dfsg-10squeeze2	fixed
	wheezy	1.2.11-1.2+deb7u1	fixed
	wheezy (security)	1.2.18-1	fixed

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mantis	source	(unstable)	0.19.4-3.1	medium		361138
mantis	source	sarge	0.19.2-5sarge4.1	medium	DSA-1133-1
mantis	source	woody	(not affected)

[woody] - mantis <not-affected> (Vulnerable code not present)