Security update for openstack-horizon-plugin-manila-ui SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2457-1 Final 1 1 2016-10-05T07:33:52Z current 2016-10-05T07:33:52Z 2016-10-05T07:33:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openstack-horizon-plugin-manila-ui This update for openstack-horizon-plugin-manila-ui fixes the metadata_to_str function code injection vulnerability. (bsc#988935, CVE-2016-6519) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2016-1431 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162457-1/ Link for SUSE-SU-2016:2457-1 https://lists.suse.com/pipermail/sle-security-updates/2016-October/002308.html E-Mail link for SUSE-SU-2016:2457-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/988935 SUSE Bug 988935 https://www.suse.com/security/cve/CVE-2016-6519/ SUSE CVE CVE-2016-6519 page SUSE OpenStack Cloud 6 openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 as a component of SUSE OpenStack Cloud 6 python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 as a component of SUSE OpenStack Cloud 6 Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form. CVE-2016-6519 SUSE OpenStack Cloud 6:openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 SUSE OpenStack Cloud 6:python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162457-1/ https://www.suse.com/security/cve/CVE-2016-6519.html CVE-2016-6519 https://bugzilla.suse.com/988935 SUSE Bug 988935