Re: [SECURITY] [DSA 1715-1] New moin packages fix insufficient input sanitising
Thank you Devin, the problem was solved yesterday by other member helps. 2009. 01. 29, csütörtök keltezéssel 07.14-kor Devin Carraway ezt írta: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > - > Debian Security Advisory DSA-1715secur...@debian.org > http://www.debian.org/security/ Steffen Joeris > January 29, 2009 http://www.debian.org/security/faq > - > > Package: moin > Vulnerability : insufficient input sanitising > Problem type : remote > Debian-specific: no > CVE ID : CVE-2009-0260 CVE-2009-0312 > Debian Bug : 513158 > > > It was discovered that the AttachFile action in moin, a python clone of > WikiWiki, is prone to cross-site scripting attacks (CVE-2009-0260). > Another cross-site scripting vulnerability was discovered in the > antispam feature (CVE-2009-0312). > > > For the stable distribution (etch) these problems have been fixed in > version 1.5.3-1.2etch2. > > For the testing (lenny) distribution these problems have been fixed in > version 1.7.1-3+lenny1. > > For the unstable (sid) distribution these problems have been fixed in > version 1.8.1-1.1. > > We recommend that you upgrade your moin packages. > > Upgrade instructions > - > > wget url > will fetch the file for you > dpkg -i file.deb > will install the referenced file. > > If you are using the apt-get package manager, use the line for > sources.list as given below: > > apt-get update > will update the internal database > apt-get upgrade > will install corrected packages > > You may use an automated update by adding the resources from the > footer to the proper configuration. > > > Debian GNU/Linux 4.0 alias etch > - --- > > Debian (stable) > - --- > > Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, > mipsel, powerpc, s390 and sparc. > > Source archives: > > > http://security.debian.org/pool/updates/main/m/moin/moin_1.5.3-1.2etch2.diff.gz > Size/MD5 checksum:40914 139bcec334ed7fbf1ca2bef3c89a8377 > http://security.debian.org/pool/updates/main/m/moin/moin_1.5.3.orig.tar.gz > Size/MD5 checksum: 4187091 e95ec46ee8de9527a39793108de22f7d > http://security.debian.org/pool/updates/main/m/moin/moin_1.5.3-1.2etch2.dsc > Size/MD5 checksum: 671 7b24d6f694511840a0a9da0c9f33f5ad > > Architecture independent packages: > > > http://security.debian.org/pool/updates/main/m/moin/python-moinmoin_1.5.3-1.2etch2_all.deb > Size/MD5 checksum: 914904 ab6158ae7010c3701859ceb26bd61bd2 > > http://security.debian.org/pool/updates/main/m/moin/moinmoin-common_1.5.3-1.2etch2_all.deb > Size/MD5 checksum: 1595112 a46561072eb0ee26ee1a71275c0e64b3 > > > These files will probably be moved into the stable distribution on > its next update. > > - > - > For apt-get: deb http://security.debian.org/ stable/updates main > For dpkg-ftp: ftp://security.debian.org/debian-security > dists/stable/updates/main > Mailing list: debian-security-annou...@lists.debian.org > Package info: `apt-cache show ' and http://packages.debian.org/ > -BEGIN PGP SIGNATURE- > Version: GnuPG v1.4.9 (GNU/Linux) > > iD8DBQFJgT3oU5XKDemr/NIRApQ9AJ4tYeY7WMIAUYHjmeryHoEo6HkecgCgmIU9 > b7VcvgOvyalRLrZrejSKFQI= > =miAO > -END PGP SIGNATURE- > > -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Re: [SECURITY] [DSA 1710-1] New ganglia-monitor-core packages fix remote code execution
Thank you for information! -- Andy Smith 2009. 01. 25, vasárnap keltezéssel 21.26-kor Steffen Joeris ezt írta: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > - > Debian Security Advisory DSA-1710-1 secur...@debian.org > http://www.debian.org/security/ Steffen Joeris > January 25, 2009 http://www.debian.org/security/faq > - > > Package: ganglia-monitor-core > Vulnerability : buffer overflow > Problem type : remote > Debian-specific: no > CVE Id : CVE-2009-0241 > > Spike Spiegel discovered a stack-based buffer overflow in gmetad, the > meta-daemon for the ganglia cluster monitoring toolkit, which could be > triggered via a request with long path names and might enable > arbitrary code execution. > > For the stable distribution (etch), this problem has been fixed in > version 2.5.7-3.1etch1. > > For the unstable distribution (sid) this problem has been fixed in > version 2.5.7-5. > > For the testing distribution (lenny), this problem will be fixed soon. > > We recommend that you upgrade your ganglia-monitor-core packages. > > Upgrade instructions > - > > wget url > will fetch the file for you > dpkg -i file.deb > will install the referenced file. > > If you are using the apt-get package manager, use the line for > sources.list as given below: > > apt-get update > will update the internal database > apt-get upgrade > will install corrected packages > > You may use an automated update by adding the resources from the > footer to the proper configuration. > > > Debian GNU/Linux 4.0 alias etch > - --- > > Source archives: > > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor-core_2.5.7.orig.tar.gz > Size/MD5 checksum: 508535 7b312d76d3f2d0cfe0bafee876337040 > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor-core_2.5.7-3.1etch1.diff.gz > Size/MD5 checksum: 316476 052c6ae45b1d114616ae8a4d04530cfe > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor-core_2.5.7-3.1etch1.dsc > Size/MD5 checksum: 759 cf4c7357786fd423ee1c04a936dfc389 > > alpha architecture (DEC Alpha) > > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1-dev_2.5.7-3.1etch1_alpha.deb > Size/MD5 checksum: 150882 e0450d50127c267dbb97d3f27b41603a > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gmetad_2.5.7-3.1etch1_alpha.deb > Size/MD5 checksum: 111420 5050aa958bd47ca0202f782989a3f662 > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1_2.5.7-3.1etch1_alpha.deb > Size/MD5 checksum: 106024 204e913ca281f7698d94c28e0b53fa7d > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor_2.5.7-3.1etch1_alpha.deb > Size/MD5 checksum: 168450 5476515111a428a8e13c27437ef9f18c > > amd64 architecture (AMD x86_64 (AMD64)) > > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gmetad_2.5.7-3.1etch1_amd64.deb > Size/MD5 checksum: 102418 e4f43cb6911e3b8ebcd38dd400698c70 > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1-dev_2.5.7-3.1etch1_amd64.deb > Size/MD5 checksum: 132094 ea40ef93a55598d06bbebd6ca297371b > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1_2.5.7-3.1etch1_amd64.deb > Size/MD5 checksum:98228 c7694aad20a0c47144fcf9ed3a8c7005 > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor_2.5.7-3.1etch1_amd64.deb > Size/MD5 checksum: 153468 c3b2b87c5ccc506aa5294ca7fe4c5c65 > > arm architecture (ARM) > > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gmetad_2.5.7-3.1etch1_arm.deb > Size/MD5 checksum:92476 58bbe3b2bab165d03c0b4042152b558c > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1_2.5.7-3.1etch1_arm.deb > Size/MD5 checksum:88620 7eeb57376971a530a8630a31d428f63f > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1-dev_2.5.7-3.1etch1_arm.deb > Size/MD5 checksum: 119844 8b79fdc26c8d936ae851e3eae7782644 > > http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor_2.5.7-3.1etch1_arm.deb > Size/MD5 checksum: 1383
