[Secure-testing-team] Bug#681323: libjs-swfupload: XSS via ExternalInterface.call

[Christian Welzel]

Package: libjs-swfupload
Version: 2.2.0.1+ds1-1
Severity: grave
Tags: security
Justification: user security hole

Dear Maintainer,
libjs-swfupload contains a XSS security vulnarability that allows attackers to
inject javascript code into the context of the current webpage.
As a Flash applet can be loaded directly (with parameters in the URL), the Flash
applet allows for reflected cross-site scripting. For sites where the applet is
hosted on the same domain as the main website, this is a serious security concern.

More information can be found here:
http://code.google.com/p/swfupload/issues/detail?id=376


-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (990, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

-- no debconf information