CVE-2010-4183

2010-11-0517:00:03

Debian Security Bug Tracker

security-tracker.debian.org

cross-site scripting

html purifier

internet explorer

css

remote attackers

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.003

Percentile

68.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.

OSVersionArchitecturePackageVersionFilename
Debian12allphp-htmlpurifier< 4.1.1+dfsg1-1php-htmlpurifier_4.1.1+dfsg1-1_all.deb
Debian11allphp-htmlpurifier< 4.1.1+dfsg1-1php-htmlpurifier_4.1.1+dfsg1-1_all.deb
Debian999allphp-htmlpurifier< 4.1.1+dfsg1-1php-htmlpurifier_4.1.1+dfsg1-1_all.deb
Debian13allphp-htmlpurifier< 4.1.1+dfsg1-1php-htmlpurifier_4.1.1+dfsg1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	php-htmlpurifier	< 4.1.1+dfsg1-1	php-htmlpurifier_4.1.1+dfsg1-1_all.deb
Debian	11	all	php-htmlpurifier	< 4.1.1+dfsg1-1	php-htmlpurifier_4.1.1+dfsg1-1_all.deb
Debian	999	all	php-htmlpurifier	< 4.1.1+dfsg1-1	php-htmlpurifier_4.1.1+dfsg1-1_all.deb
Debian	13	all	php-htmlpurifier	< 4.1.1+dfsg1-1	php-htmlpurifier_4.1.1+dfsg1-1_all.deb