a:3:{s:5:"child";a:1:{s:0:"";a:1:{s:3:"rss";a:1:{i:0;a:6:{s:4:"data";s:0:"";s:7:"attribs";a:1:{s:0:"";a:1:{s:7:"version";s:3:"2.0";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:1:{s:0:"";a:1:{s:7:"channel";a:1:{i:0;a:6:{s:4:"data";s:57:"
		
		
		
		
		
       		
		
		
		
		
		
		
		
		
		
		
	";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:3:{s:0:"";a:7:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:38:"Joomla! Developer - Vulnerability News";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:274:"Not only is Joomla! easy to use, but it is easy to add extra functionality through a flexible and powerful developer framework. The Joomla! Framework allows you to build exceptional extensions for Joomla! including components, modules, plugins, templates and language packs.";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:46:"http://developer.joomla.org/security/news.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:13:"lastBuildDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Thu, 07 May 2009 04:59:56 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:9:"generator";a:1:{i:0;a:5:{s:4:"data";s:44:"Joomla! 1.5 - Open Source Content Management";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"language";a:1:{i:0;a:5:{s:4:"data";s:5:"en-gb";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"item";a:10:{i:0;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:35:"[20090302] - Core - com_content XSS";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:98:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/b6QqXDkfSfE/294-20090302-core-comcontent-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1110:"<ul>  <li><strong>Project:</strong> Joomla!</li>  <li><strong>SubProject:</strong> com_content</li>  <li><strong>Severity: </strong>Low</li>  <li><strong>Versions:</strong> 1.5.9 and all previous 1.5 releases</li>  <li><strong>Exploit type:</strong> XSS </li>  <li><strong>Reported Date:</strong> 2009-March-12</li>  <li><strong>Fixed Date:</strong> 2009-March-27</li> </ul> <h2>Description</h2> <p>A XSS vulnerability exists in the category view of com_content. </p> <h2>Affected Installs</h2> <p>All 1.5.x installs prior to and including 1.5.9 are affected.</p> <h2>Solution</h2> <p>Upgrade to latest Joomla! version (1.5.10 or newer).</p> <h2>Contact</h2> <p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=b6QqXDkfSfE:tJuPRIDqga4:yIl2AUoC8zA"><img src="http://feeds2.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/b6QqXDkfSfE" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 25 Mar 2009 17:08:07 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:79:"http://developer.joomla.org/security/news/294-20090302-core-comcontent-xss.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:1;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:37:"[20090301] - Core - Multiple XSS/CSRF";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:100:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/Hm6QFA90lns/293-20090301-core-multiple-xsscsrf.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1450:"<ul>  <li><strong>Project:</strong> Joomla!</li>  <li><strong>SubProject:</strong> Multiple</li>  <li><strong>Severity: </strong>Moderate</li>  <li><strong>Versions:</strong> 1.5.9 and all previous 1.5 releases</li>  <li><strong>Exploit type:</strong> XSS and CSRV </li>  <li><strong>Reported Date:</strong> 2009-February-15</li>  <li><strong>Fixed Date:</strong> 2009-March-27</li> </ul> <h2>Description</h2> <p>A series of XSS and CSRF faults exist in the administrator application.  Affected administrator components include com_admin, com_media, com_search.  Both com_admin and com_search contain XSS vulnerabilities, and com_media contains 2 CSRF vulnerabilities.  </p> <h2>Affected Installs</h2> <p>All 1.5.x installs prior to and including 1.5.9 are affected.  The com_search XSS vulnerability requires that "Gather Search Statistics" be enabled to be exploitable (Disabled by default). </p> <h2>Solution</h2> <p>Upgrade to latest Joomla! version (1.5.10 or newer).</p> <h2>Contact</h2> <p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~ff/JoomlaSecurityNews?a=Hm6QFA90lns:GmmjJX81OIU:yIl2AUoC8zA"><img src="http://feeds2.feedburner.com/~ff/JoomlaSecurityNews?d=yIl2AUoC8zA" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/Hm6QFA90lns" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 25 Mar 2009 17:02:52 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:81:"http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:2;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:53:"[20090102] - Core - plg_xstandard Directory Traversal";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:116:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/npCm6fy6cv0/288-20090102-core-plgxstandard-directory-traversal.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1156:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong> plg_xstandard</li>
 <li><strong>Severity:</strong> High</li>
 <li><strong>Versions:</strong> 1.5.8 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong> Directory Traversal</li>
 <li><strong>Reported Date:</strong> 2009-January-7</li>
 <li><strong>Fixed Date:</strong> 2009-January-9</li>
</ul>
<h2>Description</h2>
<p>A crafted request can cause disclosure of the directory structure on the server (including any directory that php has access to).</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.8 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.9 or newer).</p>
<h2>Contact</h2>
<p>The JSST at the <a title="Contact the JSST" href="http://developer.joomla.org/security.html">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=ef2TdBXQ"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/npCm6fy6cv0" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Fri, 09 Jan 2009 16:22:21 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:97:"http://developer.joomla.org/security/news/288-20090102-core-plgxstandard-directory-traversal.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:3;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:51:"[20090101] - Core - JSession SSL Session Disclosure";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:115:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/NM49c_VW5is/287-20090101-core-jsession-ssl-session-disclosure.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1543:"<ul><li><strong>Project:</strong> Joomla!</li><li><strong>SubProject:</strong> framework </li><li><strong>Severity:</strong> Low</li><li><strong>Versions:</strong> 1.5.8 and all previous 1.5 releases</li><li><strong>Exploit type:</strong> Session Hijacking/ </li><li><strong>Reported Date:</strong> 2008-November-20</li><li><strong>Fixed Date:</strong> 2009-January-9</li></ul>     <h2>Description</h2>  <p>When running a site under SSL ONLY (the entire site is forced to be under ssl), Joomla! does not set the SSL flag on the cookie.  This can allow someone monitoring the network to find the cookie related to the session.  Please note that all data is still transferred securely. </p><h2>Affected Installs </h2><p>1.5.8 and lower installs which are run with SSL only (no non-ssl access).   </p>  <h2>Solution</h2>  <p>Upgrade to latest Joomla! version (1.5.9 or newer), and set force_ssl in global configuration. Alternatively, the php setting session.secure_cookie can be set in .htaccess or php.ini.  Joomla! (all versions) will respect this setting. </p>  <p>Reported By <span>Hanno Boeck</span></p>  <h2>Contact</h2>  <p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=GWBfmoEq"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/NM49c_VW5is" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Fri, 09 Jan 2009 16:12:16 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:96:"http://developer.joomla.org/security/news/287-20090101-core-jsession-ssl-session-disclosure.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:4;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:50:"[20081102] - Core - com_weblinks XSS vulnerability";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:113:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/qvJjYyepavQ/284-20081102-core-comweblinks-xss-vulnerability.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1185:"<ul><li><strong>Project:</strong> Joomla!</li><li><strong>SubProject:</strong> com_weblinks </li><li><strong>Severity:</strong>moderate</li><li><strong>Versions:</strong> 1.5.7 and all previous 1.5 releases</li><li><strong>Exploit type:</strong> XSS </li><li><strong>Reported Date:</strong> 2008-November-9</li><li><strong>Fixed Date:</strong> 2008-November-10</li></ul>     <h2>Description</h2>  <p>com_weblinks allows raw HTML into the title and description tags for weblink submissions (from both the administrator and site submission forms).  </p> Affected Installs <p>All 1.5.x installs prior to and including 1.5.7 are affected.</p>  <h2>Solution</h2>  <p>Upgrade to latest Joomla! version (1.5.8 or newer).</p>  <p>Reported By Gergo Erdosi </p>  <h2>Contact</h2>  <p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=3s52y7VM"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/qvJjYyepavQ" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Mon, 10 Nov 2008 23:56:30 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:94:"http://developer.joomla.org/security/news/284-20081102-core-comweblinks-xss-vulnerability.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:5;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:49:"[20081101] - Core - com_content XSS vulnerability";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:112:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/45LItFdeH9Q/283-20081101-core-comcontent-xss-vulnerability.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1264:"<ul><li><strong>Project:</strong> Joomla!</li><li><strong>SubProject:</strong> com_content</li><li><strong>Severity:</strong>moderate</li><li><strong>Versions:</strong> 1.5.7 and all previous 1.5 releases</li><li><strong>Exploit type:</strong> XSS </li><li><strong>Reported Date:</strong> 2008-October-03</li><li><strong>Fixed Date:</strong> 2008-November-10</li></ul>    <h2>Description</h2> <p>The defaults on com_content article submission allow entry of dangerous HTML tags (script, etc).  This only affects users with access level Author or higher, and only if you have not set filtering options in com_content configuration. </p>Affected Installs <p>All 1.5.x installs prior to and including 1.5.7 are affected.</p> <h2>Solution</h2> <p>Upgrade to latest Joomla! version (1.5.8 or newer).</p> <p>Reported By Johan Janssens</p> <h2>Contact</h2> <p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=CaKbmphA"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/45LItFdeH9Q" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Mon, 10 Nov 2008 23:51:04 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:93:"http://developer.joomla.org/security/news/283-20081101-core-comcontent-xss-vulnerability.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:6;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:49:"[20080902] - Core - Random Number Generation Flaw";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:113:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/fCzs7y2EFx4/272-20080902-core-random-number-generation-flaw.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1638:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong>libraries</li>
 <li><strong>Severity:</strong>High</li>
 <li><strong>Versions:</strong> 1.5.6 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong>Brute Force</li>
 <li><strong>Reported Date:</strong> 2008-August-23</li>
 <li><strong>Fixed Date:</strong> 2008-September-9</li>
</ul>

<h2>Description</h2>
<p>A flaw with the random number generation exists which vastly reduces the entropy of system used random functions. This impacts system generated tokens and passwords. The fix increases entropy, and greatly reduces the chance of a generated token being guessed.</p>
<h2>3PD Concerns</h2>
<p>3PD extensions which use random number generation must properly seed the random numbers first (See JUserHelper::genRandomPassword() for more information on how to seed) To generate a random string, the following method is recommended: $password = JUtility::getHash( JUserHelper::genRandomPassword() );.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.6 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.7 or newer).</p>
<p>Reported By Stefan Esser</p>
<h2>Contact</h2>
<p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=W9Zulo0u"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/fCzs7y2EFx4" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Tue, 09 Sep 2008 16:09:07 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:94:"http://developer.joomla.org/security/news/272-20080902-core-random-number-generation-flaw.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:7;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:35:"[20080903] - Core - com_mailto Spam";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:98:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/l5eImTDiKq0/273-20080903-core-commailto-spam.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1119:"<ul><li><strong>Project:</strong> Joomla! </li><li><strong>SubProject:</strong> com_mailto</li><li><strong>Severity:</strong> Low</li><li><strong>Versions:</strong> 1.5.6 and all previous 1.5 releases </li><li><strong>Exploit type:</strong> Email Spam </li><li><strong>Reported Date:</strong> 2008-August-29 </li><li><strong>Fixed Date:</strong> 2008-September-9</li></ul><br /><h2>Description </h2><p>The mailto component does not verify validity of the URL prior to sending.</p><h2>Affected Installs </h2><p>All 1.5.x installs prior to and including 1.5.6 are affected. </p><h2>Solution </h2><p>Upgrade to latest Joomla! version (1.5.7 or newer). </p><p>Reported By Phil Taylor</p><h2>Contact </h2><p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=V2JJWE6A"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/l5eImTDiKq0" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Tue, 09 Sep 2008 16:09:07 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:79:"http://developer.joomla.org/security/news/273-20080903-core-commailto-spam.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:8;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:33:"[20080904] - Core - Redirect Spam";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:97:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/oImaRtjiT8U/274-20080904-core-redirect-spam.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1651:"<ul>
 <li><strong>Project:</strong> Joomla!</li>
 <li><strong>SubProject:</strong>&nbsp;Multiple</li>
 <li><strong>Severity:</strong>&nbsp;Low</li>
 <li><strong>Versions:</strong> 1.5.6 and all previous 1.5 releases</li>
 <li><strong>Exploit type:</strong>&nbsp;Redirect Spam&nbsp;</li>
 <li><strong>Reported Date:</strong> 2008-August-26&nbsp;</li>
 <li><strong>Fixed Date:</strong> 2008-September-9</li>
</ul>
<p>&nbsp;</p>

<h2>Description</h2>
<p>Several components utilize a passed in URL to redirect to after processing.&nbsp; These URLs are not validated prior to the redirect.&nbsp; A crafted URL can cause the system to redirect to a spam or phishing site.</p>
<h2>3PD Concerns</h2>
<p>3pd extensions should validate all redirects (where the URL cannot be trusted) using the new JURI method isInternal($url).&nbsp; JURI::isInternal($url) will return true if the passed in url is a url on the same host as Joomla, or false if it is not.&nbsp; JURI::isInternal($url) was not available prior to 1.5.7.</p>
<h2>Affected Installs</h2>
<p>All 1.5.x installs prior to and including 1.5.6 are affected.</p>
<h2>Solution</h2>
<p>Upgrade to latest Joomla! version (1.5.7 or newer).</p>
<p>Reported By Emanuele Gentili</p>
<h2>Contact</h2>
<p>The JSST at the <a title="Contact the JSST" href="http://developer.joomla.org/security.html">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=oy5I1akh"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/oImaRtjiT8U" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Tue, 09 Sep 2008 16:09:07 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:78:"http://developer.joomla.org/security/news/274-20080904-core-redirect-spam.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:9;a:6:{s:4:"data";s:27:"
			
			
			
			
			
			
		";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:6:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:47:"[20080901] - Core - JRequest Variable Injection";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:111:"http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/3cLES78nnRI/271-20080901-core-jrequest-variable-injection.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:1448:"<ul><li><strong>Project:</strong> Joomla! </li><li><strong>SubProject:</strong> libraries </li><li><strong>Severity:</strong> Critical </li><li><strong>Versions:</strong> 1.5.6 and all previous 1.5 releases </li><li><strong>Exploit type:</strong> Variable Injection </li><li><strong>Reported Date:</strong> 2008-September-7 </li><li><strong>Fixed Date:</strong> 2008-September-9</li></ul><br /><h2>Description </h2><p>A flaw in JRequest exists where variables set with JRequest::setVar are not cleaned when fetching the variable at a later point in the request.  This can result in variable injection (unwanted characters injected into returned data).</p><h2>3PD Concerns</h2><p>3PD extensions which use JRequest do not need to change anything for proper function.</p><h2>Affected Installs </h2><p>All 1.5.x installs prior to and including 1.5.6 are affected. </p><h2>Solution </h2><p>Upgrade to latest Joomla! version (1.5.7 or newer). </p><p>Reported By </p><p>Joomla! Development Coordinator Andrew Eddie. </p><h2>Contact </h2><p>The JSST at the <a href="http://developer.joomla.org/security.html" title="Contact the JSST">Joomla! Security Center</a>.</p><div class="feedflare">
<a href="http://feeds.joomla.org/~f/JoomlaSecurityNews?a=JDaG8byA"><img src="http://feeds2.feedburner.com/~f/JoomlaSecurityNews?d=41" border="0"></img></a>
</div><img src="http://feeds2.feedburner.com/~r/JoomlaSecurityNews/~4/3cLES78nnRI" height="1" width="1"/>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:6:"author";a:1:{i:0;a:5:{s:4:"data";s:44:"anthony.ferrara@joomla.org (Anthony Ferrara)";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:8:"category";a:1:{i:0;a:5:{s:4:"data";s:13:"Core Security";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Tue, 09 Sep 2008 16:00:24 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:1:{s:8:"origLink";a:1:{i:0;a:5:{s:4:"data";s:92:"http://developer.joomla.org/security/news/271-20080901-core-jrequest-variable-injection.html";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}}}s:27:"http://www.w3.org/2005/Atom";a:1:{s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:0:"";s:7:"attribs";a:1:{s:0:"";a:3:{s:3:"rel";s:4:"self";s:4:"href";s:42:"http://feeds.joomla.org/JoomlaSecurityNews";s:4:"type";s:19:"application/rss+xml";}}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:42:"http://rssnamespace.org/feedburner/ext/1.0";a:2:{s:14:"emailServiceId";a:1:{i:0;a:5:{s:4:"data";s:18:"JoomlaSecurityNews";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:18:"feedburnerHostname";a:1:{i:0;a:5:{s:4:"data";s:28:"http://feedburner.google.com";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}}}}}}}}s:7:"headers";a:9:{s:13:"last-modified";s:29:"Thu, 07 May 2009 05:02:25 GMT";s:4:"etag";s:27:"bC/ferYYGEMX1/8a9aIxKQV3h6U";s:12:"content-type";s:23:"text/xml; charset=utf-8";s:4:"date";s:29:"Thu, 07 May 2009 05:06:04 GMT";s:7:"expires";s:29:"Thu, 07 May 2009 05:06:04 GMT";s:13:"cache-control";s:18:"private, max-age=0";s:22:"x-content-type-options";s:7:"nosniff";s:6:"server";s:7:"GFE/2.0";s:17:"transfer-encoding";s:7:"chunked";}s:5:"build";i:20070719221955;}