Mageia alert MGASA-2018-0394 (nextcloud)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2018-0394: Updated nextcloud packages fix security vulnerability 
Date:
             
 
Sun, 14 Oct 2018 02:59:24 +0200
Message-ID:
             
 
<20181014005924.7F53B9FE7A@duvel.mageia.org>
MGASA-2018-0394 - Updated nextcloud packages fix security vulnerability

Publication date: 14 Oct 2018
URL: https://advisories.mageia.org/MGASA-2018-0394.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2018-3780

Description:
Nextcloud has been updated to 13.0.6 and fixes atleast the following
security issue:

A missing sanitization of search results for an autocomplete field could
lead to a stored XSS requiring user-interaction. The missing sanitization
only affected user names, hence malicious search results could only be
crafted by authenticated users (CVE-2018-3780).

References:
- https://bugs.mageia.org/show_bug.cgi?id=23497
- https://nextcloud.com/changelog/#latest13
- https://nextcloud.com/security/advisory/?id=NC-SA-2018-008
- https://lists.opensuse.org/opensuse-updates/2018-08/msg00...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3780

SRPMS:
- 6/core/nextcloud-13.0.6-1.mga6