Joomla Core Multiple Vulnerabilities Fixed by 3.4.6
Description
(#Several vulnerabilities have been identified in Joomla CMS:#- CVE-2015-8562: remote code execution due to improper browser information filtering when saving the session values into the database##- CVE-2015-8565: directory traversal due to improper sanitation of input data from the XML install file located within an extension's package archive##- CVE-2015-8564: directory traversal due to inadequate filtering of request data##- CVE-2015-8563: com_templates not hardened enough against cross-site request forgery attacks.##The CVE-2015-8562 vulnerability is currently exploited in the wild.#Updated, 15/12/2015:#A proof of concept exists for the CVE-2015-8562 vulnerability.#Updated, 17/12/2015:#joomla3 packets provided by FreeBSD are vulnerable.#Updated, 31/12/2015:#An exploitation code for the CVE-2015-8562 vulnerability is available.)
