DELTA 480936 0 22556 SVNf tIZ?Y XBx^SM0 = kOTH``>*jW=Cڻ  M ]^q3wI氧(,>Dfn{)!U9Z"p[&l<Vh~*&aӐbGTRy}U JW|.@* egiUƪi)4MjO^TL(g[Nߺ`MJ]|`FqJ'tkrpU2PKp~ј.eȱwS|MeIAjZL|gTCndidVɓ*dqueS=31b PC/2^mzI.3Cq |XH&德6ƚƿNfbvedl}MeM |^ (K0Eh譧;f:>pؑ2heBzAÖv9j*0+̝cx#XNNr(qPg4:XPNg7[x$~`N [_A[Ov+N}uRzbx^Rn0<'_ȹÒc9P z6N3Ebɒ]}W;=@,&[,ϓ%KS,okdE<&_U@_{  {Z*Jԯ]-nݷ'_( .h&m"rqXޔwx5p\ӋNQRc\E`a3luָ؎l27AȀ!Xǧ)4ؓG&nIZEL !]G˘SV!^8i@DGPRhj ۀ |~2#eZh3|Vu0așn|t-nGqh/r/iJM/%WS?Gasʆĩ^9T8Yʲt/Yϙ͒݋6׫No\o8߄q \<59tù1Ez/ R#"0`Z= Rc^zKtx^Oo1S(i i9pڳ[myƉu(B'3U״i:2;p0|3#ٰo7; kT.)#`q IFxbV3HpXVgLshAEs#Jh-Q-*E+Ǽ 0=HR[/vuدo}Ï^-%Ukσh:pXG֘g)9Y⽒kO`KsnK9//g'٥ =|T6cXʔ#_yuͳ׻fPiuwVVj[Unvg)q>u/3{}rPqPU@h'5 $:‚6.gSߑ9CG@bWx^͒OO0S̩۪ ۲RG zwIbx3Vjq7%H#5^1Ā`Mlu*%M*xvt<{eQۏ̫|>e]q^mSICA`oZlm~Bjp#i6ށЯHq{iq@ޱ,`Lʚ&שCN:R0=4qe,|X`k{<ҽ'5 Y[at^G6AeDb&o= p+H{Oo`ۣ IENtP['d_kxZIjQ&%a_Uj8:X38CS*""K|f'4| t4Lx]Bf^mdN;c;=uğI2~@g`?b@x^Rn0<_H+K[ny\5Sʥ$_N-*@aK\*VNʀnGR(U*l|Y*Yj|#pίރa|Jա-XL_etQ/?I||- ^>hicJ ÐX;E.UL&>+}0Ī*+ׇXg|oI-,I7%/@7'YqC v(` &y"D-1KBwa`&@6imHIyl;AvEx^Kr0 @) C< cZ&.P~~!Vɖ%G(#~~}QREaN9a 32,a 2L͉!!!!d2LAA_/jI^;7A1^K[kӶuAu m |f}8:3:"~,7v{O IT8<𪮺/_I1<=l\GxQbF.㗻l\36 E'p7KqxhcB{O.%iBe9B"@Iq@yx%%N.<[dJ0T1<;CR6!uf_Ǘ $ r&2%@PThv@^N@Mbox^1o W&u$r,UiN%Ar8V}Rڡtu-pkN-:Ѻf\te+E'O-TO*xZ>Dbhuk}D&ayqp'BV_dPSc2.SN# hQerJs{Rf%\1$ `:b М/!8dcs|{ay8.U-;Kayn+ar=``oMZ}/H§ TbSG\r{h:VN@f?LSx^AO1xD%n6MJTR+5B:nj=%o̴TUQTx3Emgw&lzNS؇+i/+a~ZHr;*yfJ+H3?^>Aw`Q4:^\nTYgj>9/hRb{fv=Bb(x^j0EWe=8NP tu{E'"Jrh<"aΙ;҈+ ~D' pؤV\3ȘZA _M i=h4+D۪Zq1BbHI|i^|(ҘICB`-6*bKyFGaOzy|La2;RORP'iO41UЈ/o"/OGV0Nsqڊ~p:EmL2QYEiv2Ee+,oVVo(vݤ$rjV:?|=֛Vt٥S'LJsj8[ku9gU||6 Hv{QdgMO G>Zt""jo[xf b # DA:Bw. Xý*Oayw&`섮6_ɋ:(<,hC&h$"AM8C͘8}/YBƩ.93r_3&ѠN@mv@l_@b{x^uSn0 =_A<[qdh.z Ym!ItM|(9X/X{<9AYywݶh8sd 6ң)J{<:`&9pLhGBCCϘ9)gj&zS8*pSϯl.z{\W-i4d3k5CYP{zlbW9L* Wݥ0EpӪloi}VfvZFk @,j1RUsDzQd:KRM*}^|-^t$ߧZTr2pqvCY;2?S`,jYriDl(춖Zoz6wk xzG4I&+kɑ&^½f c1KT%Ɏ18#~W0VAO,fk4[ц42 N9[Pg;R&1ONe8oCz,\1/N>!bPx^o0ǟ_qpi(D! 1ցѱ/#\Jx R$zqygtLg hfm"6"DL6ȕEư!5١袔݊2I4yU|ysJ_!7*jzq9;2މA0~@QovSY"v]QLC8 ~Ka%< `) ъj,Ypw 4Ũc1F{q6={ q*vUA2ͿC&m#D¢8:xr,+̓aWxӖj\GrJU2+d/~ʠS'C 6֝ХSY#mƷ3`lk8hCWM|$OɷA24aXMd9YJ܀nJ| ,۝'gI:qܱa4Y5q|bTx^eKn0)Xw*?("袛`D%"]=aOd jx1gR ,DGgWlUnC @PRa;[ G*}fU-3ڇJ8181uc>A nt=8{8_vg_+>&z*t 'EB8񤽰;tmEgE=aUI`V^fR+F⩗ߍ^E3ZlGYdJyRqԵ*eڀ\ʼn5ͿUaIv6 @;Ѳo4`]7b~|LB]zd>31-#/돛\o8/π ZL,D=薽Q9`pq(4EIPC;mI[-ڙy|,>fb?D>wRv*A;)i&쀧b5_F tu f4uv[@N bx^n0S,ګ-J \Zmkj]1H\YۗRqpgS6Sc}|TYWjj6Y^.&X o^_PWFWݲSݥo99,#އ+*ϊˬzZb7E-ZzF2茴@-'4]m*~K&ܹE},UK5g,/ӏw4z 9PqΨn :߽%N@I1 y:=OX-=}ȳY~Yp/1' HܡLJP^FI"$+~U׺, Ubx^M0ཧ0UӰ1^}CmԴWKK#[`;#Β,"]Ir\2~kW~ }ثk[wř0ҝT^\ K9#2I+2)%22)'&f\͸q +tؖD0'Kۡ56|t\3MePOM+ T) gpW@K]oYv@`btx^R˒0<'_1#'%RKqBQRû$I*.`>VK搟P;tJXZRwY%zSYBs̙/+tĠDfq:v}Q) +º+E6́4\v7HBSHd@e)%d~>.ziC'Q?X*OH(Mq7QPnd˼jW.ia"h{鄖w@UB 'R2"F4k3f:)I+ J4]ó1VDP%;fo]K |n+Svўį0SzyWbQ=z7uLJo@'Ýcoy֞_j{ ~ {"_UetQ}Ub.lj}[tcPJz#pn?A1f<*A٤E؁ nAX0pv|#P/d@\ѧ('1@JYcJܕװ Ex蝍R[ڷcQ&'icVSM=/g;a ,U NR,; sM5WAaŘ&6-|-Zn9i瑂)z͒aάƉw/^M\0OXGGԬgYjuL7zO0}KGR@zOP:keu36q4pH'"0 8YqaZ@R*zNr_b^x^SɎ0 ='_!ݖIh ]Ezg$:FT-Yd=a4E>R,a`ypG q'7mw ,F+w1Y8r聰%WeiyBs,`t&cyĂ2|vU5]^9aϜcPr-݁CHZk{K߹z:jў)"w1Ve:]x7-TQnvQ.|ւ{oqǘv~pJ5W˽l,fQ~ 5(`4VmjUӴt=V=\Z"n O@U1I +` Q$3Ew<7b6+ 7yt"Xaphۺ ]Տ=qBb|:;?+m.LJ8;L/7s %g]9>8 >D#auOC/Jkdٕ|LUx!ǕgF Fkrǡ6͐N9f>]|yLar3URr6AXnlF5TŲDYI _47nwrUr~$ pAxlx>g]bQx^SMo0 =iNt- b; DZɣd|`a ʬgyʌ&&)2y=D6'>nyQ|ˇW* Z*GźX[Nh)tVoLG8[Rб;2 E ̦© tPoMqGW2c3z)(]"d-gdg}[Ew0&0;b`$ z@DwmJ]|ʲof"Cq+n؆ٙƾy?kfye j8`:ހZ.gCj@>%GHA5,17T~;N0CW13LhHHZaÅ͠#@m]"P_av\гO_Ix;CKzȷ'F%4=9 Q 0%Yu蝁>ҙIQWRE=Mp pX8v%bx^A091bR{ kl1$ۨ^ O C֟cmaH:{SbΧi0#1srSZ\|6cʧ<x:gkzbSݎhe,X)eoR2EW:nDg,+G{OQEvV|<u*SV;ydE`v͖Rm˱Õݠ:Ⱦ xm'yT1XeB]m ["~PfX_`< !@ZEE&V0{p~AH @v :v 6~Y-HcVDIqڠ"Csk{xi+8z꧒[g.9\~%1$-[>mTvN^@bx^R;o0_qz9 Ck@Q'E2jKJM5yPY]gf8W|c~+ vV/'ɪɽ VЧt{gm#ZdbG6cy貲Dzá"chhk2xBn{0sF7(3 ab;/*#M,gxXvÖɊk s\7}^5z<2vOG6;e$ێD(yΣE13Nw&jٿ{0s O)FDW$>R2NGua!x\Eh~5"d "$ I;$%)*cM fXbF%.h-)I Ni]> _R);GNo.O!% }}b`+g N?b#2-27 otrs -- XSS vulnerability13. In this case this is achieved by using javascript source attributes with whitespaces.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to and including 3.1.10cvename>CVE-2012-4751Sl#eva`9Œ-3`D’KFa Ч?홎@RcW04jeђ_ raO\3CU=Q5p4=8HZsZ-- "0yw*^¯Zdx_hDG%QX &`'1yq"ίA-' ߢWtlIWGs,F^d [Q2V. 6k6)AO^lR?3t./ , '肖}y\Mʔ+EMz hJr oq9X/BN<^({ԯEWDKhKu! lDnRݯ0 d|v;Skns˯^T`Tz@%_@(J@b{x^n EW~ Jg1J Y, ! !R_A17SjWȃ|e]=PFr%K#.8B{ȟ*/\C c|7d#8BMNk2ˀ!B~ϣ8dk d0#^l ''L?G~FzAi x z&\M%iGE #zO^<=OJMMo^*|L$5wEBUPobxONda5Cg*fc 쟈]:ênVEQXu]=n+cRoCW5 Px Y?MuHx^SM0=_1sC>@Vi.*!cؖ?k'*BOqア@ < z@i A*ZGZe A>:->:@l@);zG\I o\IjS3x@@Ǚd#Փ"-A@ 㞆Lp JV|܌ڙ0ɢ Yzu ߭X\6zsܒ},/pNi珽%$~J7ߜ(6,ru-ƯZޠ}#N<*V]YL%2E| V=[=[ V6G{s/cIyXj{ߦ^-Wh&ǣunyLQVҤ uK3oLd\UnuYeZ@Ӧܮ]ٶmYYbmŦ͊bU|ڴnS+׆x͠z}C88biz<1J.Hc%nZL?5F"!fT@o/6af!{Hb?x^uj0rB$م5BAǶVrFc'~ʻ&-9޸RW) eZhŒE"/DQV={C{YQ9DsES>E4wۍFkBc B2iZLlyrI7Y^fx'ooˊ_{ﱮ׹,e?JA2\jR6Co?K=OI v1$[E<~O>H1cc6.)0(ib+j[ѤYeտ;8{ocrw[AۆC?[ ~s)LJПԢ:n/_4Ȁ6N-v@bZx^mSn0 =7_AN,-\_6`ze:H$ߏD?G>?,1*AE83+F߇t;8P$?q0C p52ao E(z #W1ȼfۏ0:=J@Ǖ{Y,e"{O"TsE2\آG˵ΑF=(hwF6b␝3EfWR{cE<-/t!yfY Qz9sEבc;6z48hO]$D^dRNYj[cQZܕVjfRO\{iaV ZqZ{hi9iU8΅(Z-hP:x8ن KV/x+Yy6`S6ٰQ&jZoQѸ3 4}H^{v@ogϣ߻~B?!MU{ 7.nxi SN2#pkXk+~6*)uɻl ,L {aXZݗomR؃ڣ_5J 8!.y)bUೂ99߄QG@܁j\Owp+c-+Dz=~јI 9͓ ; )Qac %b#jDAuJs=)u$[T <ZladE} foVbOdzkHH<ԆG>TA-g6Uw(>{q`CdP$Ͳ"+zV=G[c8;bȜ_q#ӌ<%SKjk5 iT|] Q"B75~S2QIG^㏮1R,֒o.2`cPLJ0!@\\eU]oWv Ю$Z6;0~~~|_Qm:WAhGr~j ^ӞGՄN5꣬^Yj-Y}:}eV߳BŽʪweU&,?[\mȻԂ{cOLu()|}2nfWr۰w]^rqɈƲ-ǐ&K'َx t!6Hh?z8'ho$WVT׹mH<@ T$zC2^D÷ KT.ٞf6/83"u!NiOl5ZD:' ={M>Ԡ93XY:j>OP=r49v3Z#:P9$Wӟ1]sVGn!Mn'sʔT=هeU=yR-,rd;thHk6j,qVx HLI_]TmvP~=bx^Qo0ǟOqs!*6-^'c. XiR,J/uhߣFyF_G}:wP1_Q NϻW_x7a^vlS]Q[u[Ow#8"P|`݁Q 9>~2Km[k%5^jӁ,ɚa|cU<'뒂6z#{_v"b Ot ߨz/]Dw8k=Nƃg3d+W˽Bw@ Qyl*r-e.Awi!Fy)]?ybmx^mQKo0 >=vlE[a2]s%ߏva J߃}_>w~2DG6&(Pb'|4S7:z(%uS9 Y&4ΩjrlPPF <׾^2A.>+ɀLYw$r1OLFLLW./{eu0:H,/+5UjU'xB 'j`_ͭ|:av4+usbBj,>O7XZ᤻na׆NeZh 䩮7=UGy!Y۝TjL8YN?Iv@8bZx^eSMo0 =Byim([aF,y4~TA{#)U( t&|bg@B舽y~yX$ZȾEܢ `@Np?__,Eyr_\eX 8>JI\3d' !J62gPc@fOϵ7á=fʢ=šUZ7r,gFuU6ZO7^]ib]uQ+ogGW%Q| C4(j 5M&&9!Lh5 ^YEsxi$ occ[-oՆ5 իD<чHslgz|.D|4'xWgzYWU]MD"W~s0$q(D(:TM{ h:Y c1IY:^ Qi9lU!,hƽ2g~Obd-1LLÄPWpm`K;3p,ylHO0𺝊(s!&s X 9~{}˄(o@Mm_?ivU Vx^Sێ0}NbO0.T.RUPub&ZcS۰}̜9s1@0j!: (R z 1;b4K)lR$`F(hy~ڳ_sOlh9'l@!qr֒ĉGk=/'m zUq2ge 19q6j]q.TY<<\0mj#Qu+m]QQۣ݅U;m Ya ?oWh0K#ok}Gd,xѩI!`x;YjSHNb]ЂhVomURz{[m۲⛷%gd*}FB~6;\x>κرٱÅSF< GDx/ѿkJXge䌞x\r*F[ZLeM#߬>Qe[~TYbdY$yۦ ;o1i̦12вd%%1kosP2Ԉ?=<I3V~I| t?b x^}j0ۧr]׻]\C &}Y{Օ%E]e%BɅ3޾i{qvI)Val\kq?nB!EҖ>$]`K2"1 mc"\AQ? :4GR3Sr "s92ҙ Sw ?QmG2ig): >nV-c[,ћbynb$a `z*$ͅIzA0n0^×)m#>#PHƍȭV4ӽ*pOMW{iWmslNRh˵y-$1*Re>剖X(ktj^Pbs,V!/b|_VL\亭W ,[isjku@꿔WQ糼 :`o ltO@dA1t>bx^SMo0 =7ȹl/m 0<`vhȒx4X[NǏ,D \Q`wPzEATZ,;mv0`Ni䩃& ylVq |E %h%N[aD)#4Av)Gd9?<S[nK#A4]scp d7b~iB֧1rV[bY׫Ǭ0ȬnkW2oUQʪg)VK#洷ٜ-8iV}XUMV]VqЮhi<,6=[s>ܣ8W#ngB:w2Fά2r;i _#NwތMHu;O sntfůV_I$QP;qvn|`xe97EOw}մ{ۀ?k0n c2?GN>BB@KbOx^mRM0=wŐsc%&l" n=Jz%(x="Iv&K 7  f:g5>U">H#]?R5 'ĸSMbA:u8b|)(>Y4~)X?Z̘U'z0YJhU _\G8[1!G๳2p:EH=BDEJ4 Mk]iYf1;W!KLLgfʟOd#駂:1^'ސkG]Mi I]SXQq/P bQR"n~W[)u{G((@E"3u:|m[Q]r٧Γ{ˢb}u[ g4o湽rV!4eY˵ݭ 邓4O@W?bx^mS]o0|nŪrD B!;}co.sG{ Ofwfvfϥ9ԧ2ZGcMzAI ƏNcx Lꌃ t r :| ;ekNB0`Iʌ ?Ƅw,ۖ V}5 ϴ 3QO2"o]8JQh`21ҟ*Lj)8ʬG ќ1ƒQsKoV+YA~a&zgB{?=~vE6+A oaylݥ4b|QwQU.V?s3sp%CQ0gU))q"عMTs\O"x>>랽kecyb>v~'Ƕ8T:Ӈ] =fEQ|2~۰aPАepp?Y ^݂oȁExsHBp*.<K0kL72ҦzyJq'"Ղ* G@WbWx^uSK0>ўZiSV% gǞ4';)3cv[-=% 8dُS|b|zA҄ zE|4#N~r2 DAޖs`%=#$z # "(`ǧf}wy)9llRTYS #`=$}*D3YmNnV41t 8 TiHi)cHJvL ݙͅb㜪 xм(/,4&>_0S po֋`7$>hS }- [͓IїaK-JpeVM _Vϓt5̤ݗ%NOfKYOel3Ž}F0b*])6u{2ݨqقn3.R[1'!ģ"J,Ͱa5J;A;rTimk4:#ћP|C{>O²Ia$KzeI%>/>6t pN=v@?Nyb x^SM0= Bod;U\n( ewiB.y4qzDWnZ>ȣ7ѓ@sq>|NH"i*I |4j5!Z+B)yBrFˊ]ɶ :YJg :L@=B.e0 NuqĜ4PT!ϒqxs@9_"16_vl㩎p98p\0v>u%ۢϚKYm/jsժםpҷR:H eaz.Dvo!T\fg }[wAړ咼1D.M(RxتѦl81Y:J0{thS(ŪJ{A({A/y~t?` fbx^uTn0<'_ȹPA"W6a+p) .)?5`@,@h[rn뀊@W.j퐣zh)Mޣe󳪯_Pd_Wz&7 ^֩5D-& q7:9GkPT 6$4by2@lsU?u&V yLqC&Pf~q"5;0*+zup" ("<=SO! 1&=*^A/HamTkvUgfc9lA!HAkN"2>"Bf`ۊd߲ruoY6Ezg[xl, Ӫ~N^O5sȇ\()Iё}JzXq꼬8S7cJRH2%qs-#Z1`gV.ۂ†!mAoj[VwE~(gfNc Tp5q4k{-M4䢥rw Kd|z+(R'N&]s?zU: Y<Y+Ab$x^mRKo0 >/9yݶۀȒb %UߏE@IhQae4Y2Upy[YضrSPZ:lUh/Py-|_ 1jہW1c5Lg%"=uN5ot|PYfs=n6M;) 2F^GWо " ~[Q@D |"֨hݿFgq;-ѵ D9ܛVS937OP=iK:a e|7GzH> n}OЗM13:>kَ-ˬpnr#DpBt)ƻnK`Mublr#.]X;vȰwӉRt,x|gT)P}XronKb.c6="( 'vVR]Rx)v4Pa?x^Qr0 <'_'Y$ G_ɩ LBT/(@ Xh^DFCv%ˣvyw؅O\R"&L8S$ 2Gsq"q{X;|Oֱ?A9GvT&X&6SP9dѹ 8B 9)pGE`ἢD0S|c?k$f[smhX>^5\Ӻ$7o\oW1.CԾFTs7ҽ=6JN]0<m#d.N&t_(f?oSId";k1O %Vv'0A g"qU%r 0Nsb[Ůtb+`@b>x^mSKo1>b)fӦM =PNU=_߱7JN==; B;ЉсES@b ҤSyx~OtVHm4A RO&'>$;1/A:4x)A片5ևh|]{V0&CQ`0`G_!`Eպg>>%ORn&Q#N &Z>hug˪#k&۬fooHG:v3ʂ9rևV@Ys?8UP0W 2x"92}ѴɔQMGsٍF I7E?5$9` sY$*荐0VoBK3%>q|(dDo)"Ee!%@5 r,rz, 4z>.X(ݶX2 .;{kHIk\CdlrHP=ŝO,ܽ qzviu@KPcvFܥ].׵<P~kk2{6g|7OmE9_̆ܧw-Wz9kff + UDsŀRP~OqRFx~bex^n0ϻO19`*)R@W]!K+σV РRVf(9Q]OQv J)1DI7j}ִ_tGur~@~V|)ٞYyf>FA=x+ w{#]Fb^- : z>0&BQ{J) *6v`l6^첡y֥ tJt$YVK7^Юd{~rOZ^xK&Ņp оJb9. )>>UQ>%I\IMeE=6;چy Co왻=r eͼȣdD-S!FGfiQd?#ӏo<-nȵYc1Ti`h]Oͯo}z | a]kT./Auˠ{5avvG{(x^Sn0=_1 $mA* j+vzC{:k;wt[Q ʌg{3gV1DuPq0:a`NdYN:-N$T-cR(ײk( P0@GHI; 9sY)bfiH8g{7RuxPZi*Y@Ҥx\Vˇ_] K&g\'onNt~ԥτnIgc8xBɡ'b}읢s9)>rլ!j^ո<ˑg}G]@[t%m[ޢ"xUmn7G{F+vn#ͩw1P)_z`#ָ "g#ZlG?"|SOJ6uWտK7so bK5C:ŅR+;7