APPSEC-1502: Stored XSS – Add new group in Attribute set name
APPSEC-1802: Customer registration through frontend did not have anti-CSRF protection
APPSEC-1773: Injection on Page leading to DoS
APPSEC-1853: CSRF + Stored Cross Site Scripting in newsletter template
Part of patch Magento 2.0.16 and 2.1.9 Security Update
Note:
It can be the case that you will receive a message that the files are patched for the 2 below shown files for versions “2.1.12, 2.1.11, 2.1.10, 2.1.9”. As stated in this message the security fix is coming from 2.1.9. What we had to do is move code from a newly introduced file to “AbstractBlock.php”. This is code wise the most logical place. It it turns out that the hashes of version range 2.1.12-2.1.5 is the same for “AbstractBlock.php”. Therefor we automatically have to patch the entire range. This is currently due to the limitations of our system.
vendor/magento/framework/View/Element/AbstractBlock.php
vendor/magento/framework/Escaper.php
This vulnerability affects the following application versions:
- Magento 0.74.0-beta9
- Magento 0.74.0-beta10
- Magento 0.74.0-beta11
- Magento 0.74.0-beta12
- Magento 0.74.0-beta13
- Magento 0.74.0-beta14
- Magento 0.74.0-beta15
- Magento 0.74.0-beta16
- Magento 1.0.0-beta
- Magento 1.0.0-beta2
- Magento 1.0.0-beta3
- Magento 1.0.0-beta4
- Magento 1.0.0-beta5
- Magento 1.0.0-beta6
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2
- Magento 2.0.1
- Magento 2.0.2
- Magento 2.0.3
- Magento 2.0.4
- Magento 2.0.5
- Magento 2.0.6
- Magento 2.0.7
- Magento 2.0.8
- Magento 2.0.9
- Magento 2.0.10
- Magento 2.0.11
- Magento 2.0.12
- Magento 2.0.13
- Magento 2.0.14
- Magento 2.0.15
- Magento 2.0.16
- Magento 2.0.17
- Magento 2.0.18
- Magento 2.1.0
- Magento 2.1.0-rc1
- Magento 2.1.0-rc2
- Magento 2.1.0-rc3
- Magento 2.1.1
- Magento 2.1.2
- Magento 2.1.3
- Magento 2.1.4
- Magento 2.1.5
- Magento 2.1.6
- Magento 2.1.7
- Magento 2.1.8
- Magento 2.1.9
- Magento 2.1.10
- Magento 2.1.11
- Magento 2.1.12