Multiple vulnerabilities have been found in phpBB, the worst of which may allow remote attackers to inject arbitrary web script or HTML.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/phpBB | * | < 3.1.10 | — |
phpBB is an Open Source bulletin board package.
Multiple vulnerabilities have been discovered in phpBB. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to change settings, inject arbitrary web script or HTML, or conduct cross-site request forgery (CSRF) attacks.
There is no known workaround at this time.
Gentoo Security support has been discontinued due to phpBB being dropped to unstable. As such, we recommend that users unmerge phpBB:
# emerge --unmerge "www-apps/phpBB"
NOTE: Users could alternatively upgrade to “>=www-apps/phpBB-3.1.10”, however, these packages are not currently marked stable.
A vulnerability in phpBB allows a remote attacker to execute arbitrary commands with the rights of the web server.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/phpBB | * | < 2.0.16 | >= 2.0.16 |
phpBB is an Open Source bulletin board package.
Ron van Daal discovered that phpBB contains a vulnerability in the highlighting code.
Successful exploitation would grant an attacker unrestricted access to the PHP exec() or system() functions, allowing the execution of arbitrary commands with the rights of the web server.
Please follow the instructions given in the phpBB announcement.
The phpBB package is no longer supported by Gentoo Linux and has been masked in the Portage repository, no further announcements will be issued regarding phpBB updates. Users who wish to continue using phpBB are advised to monitor and refer to www.phpbb.com for more information.
To continue using the Gentoo-provided phpBB package, please refer to the Portage documentation on unmasking packages and upgrade to 2.0.16.
phpBB is vulnerable to a cross-site scripting attack that could allow arbitrary scripting code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/phpBB | * | < 2.0.15 | >= 2.0.15 |
phpBB is an Open Source bulletin board package.
phpBB is vulnerable to a cross-site scripting vulnerability due to improper sanitization of user supplied input. Coupled with poor validation of BBCode URLs which may be included in a forum post, an unsuspecting user may follow a posted link triggering the vulnerability.
Successful exploitation of the vulnerability could cause arbitrary scripting code to be executed in the browser of a user.
There are no known workarounds at this time.
All phpBB users should upgrade to the latest version:
emerge --sync emerge --ask --oneshot --verbose ">=www-apps/phpBB-2.0.15"
Several vulnerabilities allow remote attackers to gain phpBB administrator rights or expose and manipulate sensitive data.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/phpBB | * | < 2.0.13 | >= 2.0.13 |
phpBB is an Open Source bulletin board package.
It was discovered that phpBB contains a flaw in the session handling code and a path disclosure bug. AnthraX101 discovered that phpBB allows local users to read arbitrary files, if the "Enable remote avatars" and "Enable avatar uploading" options are set (CAN-2005-0259). He also found out that incorrect input validation in "usercp_avatar.php" and "usercp_register.php" makes phpBB vulnerable to directory traversal attacks, if the "Gallery avatars" setting is enabled (CAN-2005-0258).
Remote attackers can exploit the session handling flaw to gain phpBB administrator rights. By providing a local and a remote location for an avatar and setting the "Upload Avatar from a URL:" field to point to the target file, a malicious local user can read arbitrary local files. By inserting "/../" sequences into the "avatarselect" parameter, a remote attacker can exploit the directory traversal vulnerability to delete arbitrary files. A flaw in the "viewtopic.php" script can be exploited to expose the full path of PHP scripts.
There is no known workaround at this time.
All phpBB users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/phpBB-2.0.13"