{"id":"MGASA-2016-0040","summary":"Updated owncloud packages fix security vulnerability","details":"A Cross-site scripting (XSS) vulnerability in the OCS discovery provider\nin ownCloud Server before 8.0.10 allows remote attackers to inject\narbitrary web script or HTML via the URL resulting in a reflected\nCross-Site-Scripting (CVE-2016-1498).\n\nownCloud Server before 8.0.10 allows remote authenticated users to obtain\nsensitive information from a directory listing and possibly cause a denial\nof service (CPU consumption) via the force parameter to\nindex.php/apps/files/ajax/scan.php (CVE-2015-1499).\n\nownCloud Server before 8.0.10, when the \"file_versions\" application is\nenabled, does not properly check the return value of getOwner, which\nallows remote authenticated users to read the files with names starting\nwith \".v\" and belonging to a sharing user by leveraging an incoming share\n(CVE-2016-1500).\n","modified":"2026-04-16T06:24:35.576997424Z","published":"2016-01-29T11:02:50Z","upstream":["CVE-2016-1498","CVE-2016-1499","CVE-2016-1500"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2016-0040.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=17620"},{"type":"ADVISORY","url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-001"},{"type":"ADVISORY","url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-002"},{"type":"ADVISORY","url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-003"},{"type":"WEB","url":"https://lists.fedoraproject.org/pipermail/package-announce/2016-January/176017.html"}],"affected":[{"package":{"name":"owncloud","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/owncloud?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.10-1.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2016-0040.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}