CVE-2014-3876

Name	CVE-2014-3876
Description	Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-68-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fex (PTS)	sid/non-free, forky/non-free, bullseye/non-free, trixie/non-free, bookworm/non-free	20160919-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fex	source	squeeze	20100208+debian1-1+squeeze4		DLA-68-1
fex	source	(unstable)	20140530-1

[wheezy] - fex <no-dsa> (non-free not supported)
https://www.lsexperts.de/advisories/lse-2014-05-22.txt