Quoting the upstream news advisory [1]:

"The 2010.08.05 release comes with a patched config file. With shell code in hyperlinks on a page, one of the sample (uzbl-core) resp. default (uzbl-browser) button bindings (binding for mousebutton2) would execute this code.

Note that just upgrading your uzbl is not enough. If you have an existing config, the change will not be automatically applied. So be sure you have this change in your config."

And an associated bug report [2] exists as well. There is no patch noted in the bug report.

This would affect all versions of Fedora.

[1] http://www.uzbl.org/news.php?id=29 [2] http://www.uzbl.org/bugs/index.php?do=details&taskid=240

A flaw was found in the way that the Mantis BTS handled attachments and MIME types. A user could upload an HTML file renamed to a .gif and Mantis would calculate the actual MIME type of the file as text/html. A user tricked into thinking they were clicking a .gif attachment would instead have the full HTML file rendered in the browser, rather than having it treated as a downloadable file or displayed in plain text.

References:

http://www.mantisbt.org/bugs/view.php?id=11952 http://www.mantisbt.org/blog/?p=113

This was corrected in upstream version 1.2.2 and affects current Fedora 12, 13, rawhide, and EPEL5.

Tavis Ormandy reported that /dev/systty in Fedora has insecure permissions (0644 instead of 0600 or 0640). This could allow a remote user logged into the system to snoop on the terminal of any user logged in on tty0.

On Red Hat Enterprise Linux 5, /dev/systty is mode 0600, and on Red Hat Enterprise Linux 6, /dev/systty is a symlink to /dev/tty0 which is mode 0620. So this flaw only affects Fedora.