Security Notice Phishing campain
Version 1.4.15
Security Upgrade
Security
Possible XSS in MagicHTML (IE only)
Date:
2006年02月10日
Description:
The MagicHTML filter for incoming HTML email did not correctly disregard comments (/* */) inserted in style sheets ("u/* */rl"). It also accepted "u\rl" as "url" in styles. These allow a malicious user to break the privacy of the user by having them request an item from a remote site when reading the mail. This happens only in browsers that parse this invalid style, only one known is Internet Explorer.
Affected Versions:
<= 1.4.5
Register Globals:
Register_globals does not have to be on for this issue.