CVE-2015-0220

The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL.

• canonical ubuntu linux 10.04 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 14.10 • djangoproject django (<= 1.4.17) • djangoproject django 1.6 • djangoproject django 1.6.1 • djangoproject django 1.6.2 • djangoproject django 1.6.3 • djangoproject django 1.6.4 • djangoproject django 1.6.5 • djangoproject django 1.6.6 • djangoproject django 1.6.7 • djangoproject django 1.6.8 • djangoproject django 1.6.9 • djangoproject django 1.7 • djangoproject django 1.7.1 • djangoproject django 1.7.2