Skip to content
Permalink
Browse files
Document vulnerabilities fixed prior to Guacamole's move to the ASF.
  • Loading branch information
mike-jumper committed Jan 8, 2018
1 parent 172a5c3 commit 856c62b20bfb742627dc898140f6781e81842c05
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 0 deletions.
@@ -0,0 +1,14 @@
---
title: Buffer overflow in guac_client_plugin_open()
cve: CVE-2012-4415
fixed: 0.6.3
---

A stack-based buffer overflow vulnerability was discovered in the
`guac_client_plugin_open()` function in libguac in Guacamole before 0.6.3
which could allow remote attackers to cause a denial of service (crash) or
execute arbitrary code via a long protocol name.

Acknowledgements: We would like to thank Timo Juhani Lindfors for reporting
this issue.

@@ -0,0 +1,14 @@
---
title: Stored cross-site scripting (XSS) in file browser
cve: CVE-2016-1566
fixed: 0.9.9
---

A cross-site scripting (XSS) vulnerability was discovered through which files
with specially-crafted filenames could lead to JavaScript execution if file
transfer is enabled to a location which is shared by multiple users, and the
filename is displayed within the file browser located within the Guacamole
menu.

Acknowledgements: We would like to thank Niv Levy for reporting this issue.

0 comments on commit 856c62b

Please sign in to comment.