CVE-2009-2324

NameCVE-2009-2324
DescriptionMultiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1836-1
Debian Bugs536051

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
egroupwaresource(unstable)(not affected)
fckeditorsourcelenny1:2.6.2-1lenny1DSA-1836-1
fckeditorsource(unstable)1:2.6.4.1-1low536051
gforgesourceetch(not affected)
gforgesource(unstable)4.6.99+svn6225-1
karrigellsourceetch(not affected)
karrigellsource(unstable)(unfixed)
knowledgerootsourceetch(not affected)
knowledgerootsource(unstable)0.9.8.5-3
moinsourceetch(not affected)
moinsource(unstable)1.8.2-2
request-tracker3.8source(unstable)(not affected)

Notes

moin from 1.8.2-2 uses systemwide copy of fckeditor
[lenny] - moin <no-dsa> (unimportant; provides FCKeditor as example files in /usr/share/doc, but not executable in general case)
[etch] - moin <not-affected> (doesn't provide FCKeditor sample files)
knowledgeroot from 0.9.8.5-3 uses systemwide copy of fckeditor
[etch] - knowledgeroot <not-affected> (doesn't provide FCKeditor sample files)
[etch] - karrigell <not-affected> (doesn't provide FCKeditor sample files)
[etch] - gforge <not-affected> (doesn't contain FCKeditor)
- egroupware <not-affected> (doesn't provide FCKeditor sample files)
- request-tracker3.8 <not-affected> (doesn't provide FCKeditor sample files)

Search for package or bug name: Reporting problems