FreshPorts - VuXML

The CodeIgniter changelog reports:

An improvement was made to the MySQL and MySQLi drivers to prevent exposing a potential vector for SQL injection on sites using multi-byte character sets in the database client connection.

An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7 with mysql_set_charset() creates a situation where using multi-byte character sets on these environments may potentially expose a SQL injection attack vector. Latin-1, UTF-8, and other "low ASCII" character sets are unaffected on all environments.

If you are running or considering running a multi-byte character set for your database connection, please pay close attention to the server environment you are deploying on to ensure you are not vulnerable.

< 2.0.3

The CodeIgniter changelog reports:

Form Validation Library rule valid_email could be bypassed if idn_to_ascii() is available.

< 3.1.5

The CodeIgniter changelog reports:

Fixed a header injection vulnerability in common function set_status_header() under Apache (thanks to Guillermo Caminer from Flowgate).

Fixed byte-safety issues in Encrypt Library (DEPRECATED) when mbstring.func_overload is enabled.

Fixed byte-safety issues in Encryption Library when mbstring.func_overload is enabled.

Fixed byte-safety issues in compatibility functions password_hash(), hash_pbkdf2() when mbstring.func_overload is enabled.

Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv() with MCRYPT_DEV_URANDOM.

< 3.1.4

The CodeIgniter changelog reports:

Security: Fixed an SQL injection vulnerability in Active Record method offset().

< 2.2.4

The CodeIgniter changelog reports:

Security: Removed a fallback to mysql_escape_string() in the mysql database driver (escape_str() method) when there's no active database connection.

< 2.2.3

The CodeIgniter changelog reports:

Fixed a number of XSS attack vectors in Security Library method xss_clean (thanks to Frans Rosén from Detectify.

< 2.2.5

The CodeIgniter changelog reports:

Fixed an XSS attack vector in Security Library method xss_clean().

Changed Config Library method base_url() to fallback to ``$_SERVER['SERVER_ADDR']`` in order to avoid Host header injections.

Changed CAPTCHA Helper to try to use the operating system's PRNG first.

< 2.2.6

The CodeIgniter changelog reports:

Security: The xor_encode() method in the Encrypt Class has been removed. The Encrypt Class now requires the Mcrypt extension to be installed.

Security: The Session Library now uses HMAC authentication instead of a simple MD5 checksum.

< 2.2.0

The CodeIgniter changelog reports:

Security: Fixed a potential object injection in Cache Library 'apc' driver when save() is used with $raw = TRUE.

< 3.1.6

The CodeIgniter changelog reports:

Fixed an SQL injection in the ‘odbc’ database driver.

Updated set_realpath() Path Helper function to filter-out php:// wrapper inputs.

< 3.1.0

The CodeIgniter changelog reports:

Fixed an XSS vulnerability in Security Library method xss_clean().

Fixed a possible file inclusion vulnerability in Loader Library method vars().

Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane from NamePros).

Added protection against timing side-channel attacks in Security Library method csrf_verify().

Added protection against BREACH attacks targeting the CSRF token field generated by Form Helper function form_open().

< 3.1.3

znirkel reports:

The eval() function in _reset_post_array crashes when posting certain data. By passing in carefully-crafted input data, the eval() function could also execute malicious PHP code.

Note that CodeIgniter applications that either do not use the new Form Validation class or use the old Validation class are not affected by this vulnerability.

ge 1.7.0 lt 1.7.1

Derek Jones reports:

A fix has been implemented for a security flaw in CodeIgniter 1.7.2. All applications using the File Upload class should install the patch to ensure that their application is not subject to a vulnerability.

< 1.7.2_1

The CodeIgniter changelog reports:

Security: Added HTTP "Host" header character validation to prevent cache poisoning attacks when base_url auto-detection is used.

Security: Added FSCommand and seekSegmentTime to the "evil attributes" list in CI_Security::xss_clean().

< 2.2.2

The CodeIgniter changelog reports:

Fixed a number of new vulnerabilities in Security Library method xss_clean().

< 3.1.2