77 lines
No EOL
4.7 KiB
Text
77 lines
No EOL
4.7 KiB
Text
source: https://www.securityfocus.com/bid/5837/info
|
|
|
|
Rogue is a game included with BSD distributions including FreeBSD and NetBSD.
|
|
|
|
By passing an overly long value when restoring a saved game, it is possible for an attacker to corrupt memory. Exploitation of this issue could result in privilege escalation to the 'games' group, further resulting in the corruption of saved game data, as well as storage consumption.
|
|
|
|
--- myng/dev/myarticles.php.old Fri Sep 27 00:00:58 2002
|
|
+++ myng/dev/myarticles.php Fri Sep 27 00:01:24 2002
|
|
@@ -126,7 +126,7 @@
|
|
$t->set_var("date",$date);
|
|
$t->set_var("id_article",$db->Record['id_article']);
|
|
$t->set_var("sender",$db2->Record['name']);
|
|
- $t->set_var("subject",$db2->Record['subject']);
|
|
+ $t->set_var("subject",htmlspecialchars($db2->Record['subject']));
|
|
|
|
$group_url = "tree.php?group_name=".rawurlencode(real2table($db->Record['group_name']))."&begin=0&server=".rawurlencode($db->Record['server']);
|
|
$t->set_var("group_url",$group_url);
|
|
--- myng/dev/search.php.old Fri Sep 27 00:03:14 2002
|
|
+++ myng/dev/search.php Fri Sep 27 00:03:56 2002
|
|
@@ -97,7 +97,7 @@
|
|
$t->set_var("date",$date);
|
|
$article_url = "article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$db->Record['newsgroup'];
|
|
$t->set_var("article_url",$article_url);
|
|
- $t->set_var("subject",$db->Record['subject']);
|
|
+ $t->set_var("subject",htmlspecialchars($db->Record['subject']));
|
|
$t->set_var("sender",$db->Record['name']);
|
|
$t->set_var("group",$db->Record['newsgroup']);
|
|
$t->set_var("readings",$db->Record['num_readings']);
|
|
@@ -173,7 +173,7 @@
|
|
$t->set_var("date",$date);
|
|
$article_url = "article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$db->Record['newsgroup'];
|
|
$t->set_var("article_url",$article_url);
|
|
- $t->set_var("subject",$db->Record['subject']);
|
|
+ $t->set_var("subject",htmlspecialchars($db->Record['subject']));
|
|
$t->set_var("sender",$db->Record['name']);
|
|
$t->set_var("group",$db->Record['newsgroup']);
|
|
$t->set_var("readings",$db->Record['num_readings']);
|
|
--- myng/dev/stats.php.old Fri Sep 27 00:05:14 2002
|
|
+++ myng/dev/stats.php Fri Sep 27 00:06:40 2002
|
|
@@ -205,7 +205,7 @@
|
|
while($db2->next_record()){
|
|
|
|
$num_replies[$j][0] = $db2->Record[1];
|
|
- $num_replies[$j][1] = $db2->Record['subject'];
|
|
+ $num_replies[$j][1] = htmlspecialchars($db2->Record['subject']);
|
|
$j ++;
|
|
|
|
}
|
|
@@ -246,7 +246,7 @@
|
|
$db2->query($consulta2);
|
|
while($db2->next_record()){
|
|
$num_readings[$j][0] = $db2->Record['num_readings'];
|
|
- $num_readings[$j][1] = $db2->Record['subject'];
|
|
+ $num_readings[$j][1] = htmlspecialchars($db2->Record['subject']);
|
|
$j ++;
|
|
}
|
|
|
|
--- myng/dev/lib/standard.lib.php.old Thu Sep 26 23:54:04 2002
|
|
+++ myng/dev/lib/standard.lib.php Thu Sep 26 23:58:13 2002
|
|
@@ -577,7 +577,7 @@
|
|
|
|
$li_image = "li".$li_number.$color.".gif";
|
|
|
|
- $linea2 = $linea."<img src=images/".$li_image." width=5 height=5> "."<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".rawurlencode($group_name).">".$db->Record['subject']."</a>";
|
|
+ $linea2 = $linea."<img src=images/".$li_image." width=5 height=5> "."<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".rawurlencode($group_name).">".htmlspecialchars($db->Record['subject'])."</a>";
|
|
|
|
$reply_url = "post.php?type=reply&id=".$db->Record['number']."&group=".$group_name;
|
|
//echo $reply_url;
|
|
@@ -674,7 +674,7 @@
|
|
$db->query($consulta);
|
|
$db->next_record();
|
|
|
|
- $url_subject = "<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$group_name.">".$db->Record['subject']."</a>";
|
|
+ $url_subject = "<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$group_name.">".htmlspecialchars($db->Record['subject'])."</a>";
|
|
$t->set_var("p_subject",$url_subject);
|
|
$c->username = $db->Record['username'];
|
|
$c->email = $db->Record['from_header']; |