CVE-2011-1401

Name	CVE-2011-1401
Description	ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2214-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ikiwiki (PTS)	jessie, jessie (lts)	3.20141016.4+deb8u1	fixed
	stretch (security), stretch (lts), stretch	3.20170111.1	fixed
	buster	3.20190228-1	fixed
	bullseye, bookworm	3.20200202.3-1	fixed
	sid, trixie	3.20200202.4-2.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ikiwiki	source	lenny	2.53.6		DSA-2214-1
ikiwiki	source	squeeze	3.20100815.7		DSA-2214-1
ikiwiki	source	(unstable)	3.20110328