Re: [SECURITY] [DSA 1715-1] New moin packages fix insufficient input sanitising
Thank you Devin, the problem was solved yesterday by other member helps. 2009. 01. 29, csütörtök keltezéssel 07.14-kor Devin Carraway ezt írta: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1715secur...@debian.org http://www.debian.org/security/ Steffen Joeris January 29, 2009 http://www.debian.org/security/faq - Package: moin Vulnerability : insufficient input sanitising Problem type : remote Debian-specific: no CVE ID : CVE-2009-0260 CVE-2009-0312 Debian Bug : 513158 It was discovered that the AttachFile action in moin, a python clone of WikiWiki, is prone to cross-site scripting attacks (CVE-2009-0260). Another cross-site scripting vulnerability was discovered in the antispam feature (CVE-2009-0312). For the stable distribution (etch) these problems have been fixed in version 1.5.3-1.2etch2. For the testing (lenny) distribution these problems have been fixed in version 1.7.1-3+lenny1. For the unstable (sid) distribution these problems have been fixed in version 1.8.1-1.1. We recommend that you upgrade your moin packages. Upgrade instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - --- Debian (stable) - --- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/m/moin/moin_1.5.3-1.2etch2.diff.gz Size/MD5 checksum:40914 139bcec334ed7fbf1ca2bef3c89a8377 http://security.debian.org/pool/updates/main/m/moin/moin_1.5.3.orig.tar.gz Size/MD5 checksum: 4187091 e95ec46ee8de9527a39793108de22f7d http://security.debian.org/pool/updates/main/m/moin/moin_1.5.3-1.2etch2.dsc Size/MD5 checksum: 671 7b24d6f694511840a0a9da0c9f33f5ad Architecture independent packages: http://security.debian.org/pool/updates/main/m/moin/python-moinmoin_1.5.3-1.2etch2_all.deb Size/MD5 checksum: 914904 ab6158ae7010c3701859ceb26bd61bd2 http://security.debian.org/pool/updates/main/m/moin/moinmoin-common_1.5.3-1.2etch2_all.deb Size/MD5 checksum: 1595112 a46561072eb0ee26ee1a71275c0e64b3 These files will probably be moved into the stable distribution on its next update. - - For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-annou...@lists.debian.org Package info: `apt-cache show pkg' and http://packages.debian.org/pkg -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFJgT3oU5XKDemr/NIRApQ9AJ4tYeY7WMIAUYHjmeryHoEo6HkecgCgmIU9 b7VcvgOvyalRLrZrejSKFQI= =miAO -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Re: [SECURITY] [DSA 1710-1] New ganglia-monitor-core packages fix remote code execution
Thank you for information! -- Andy Smith kovacs.end...@upcmail.hu 2009. 01. 25, vasárnap keltezéssel 21.26-kor Steffen Joeris ezt írta: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1710-1 secur...@debian.org http://www.debian.org/security/ Steffen Joeris January 25, 2009 http://www.debian.org/security/faq - Package: ganglia-monitor-core Vulnerability : buffer overflow Problem type : remote Debian-specific: no CVE Id : CVE-2009-0241 Spike Spiegel discovered a stack-based buffer overflow in gmetad, the meta-daemon for the ganglia cluster monitoring toolkit, which could be triggered via a request with long path names and might enable arbitrary code execution. For the stable distribution (etch), this problem has been fixed in version 2.5.7-3.1etch1. For the unstable distribution (sid) this problem has been fixed in version 2.5.7-5. For the testing distribution (lenny), this problem will be fixed soon. We recommend that you upgrade your ganglia-monitor-core packages. Upgrade instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - --- Source archives: http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor-core_2.5.7.orig.tar.gz Size/MD5 checksum: 508535 7b312d76d3f2d0cfe0bafee876337040 http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor-core_2.5.7-3.1etch1.diff.gz Size/MD5 checksum: 316476 052c6ae45b1d114616ae8a4d04530cfe http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor-core_2.5.7-3.1etch1.dsc Size/MD5 checksum: 759 cf4c7357786fd423ee1c04a936dfc389 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1-dev_2.5.7-3.1etch1_alpha.deb Size/MD5 checksum: 150882 e0450d50127c267dbb97d3f27b41603a http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gmetad_2.5.7-3.1etch1_alpha.deb Size/MD5 checksum: 111420 5050aa958bd47ca0202f782989a3f662 http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1_2.5.7-3.1etch1_alpha.deb Size/MD5 checksum: 106024 204e913ca281f7698d94c28e0b53fa7d http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor_2.5.7-3.1etch1_alpha.deb Size/MD5 checksum: 168450 5476515111a428a8e13c27437ef9f18c amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gmetad_2.5.7-3.1etch1_amd64.deb Size/MD5 checksum: 102418 e4f43cb6911e3b8ebcd38dd400698c70 http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1-dev_2.5.7-3.1etch1_amd64.deb Size/MD5 checksum: 132094 ea40ef93a55598d06bbebd6ca297371b http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1_2.5.7-3.1etch1_amd64.deb Size/MD5 checksum:98228 c7694aad20a0c47144fcf9ed3a8c7005 http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor_2.5.7-3.1etch1_amd64.deb Size/MD5 checksum: 153468 c3b2b87c5ccc506aa5294ca7fe4c5c65 arm architecture (ARM) http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gmetad_2.5.7-3.1etch1_arm.deb Size/MD5 checksum:92476 58bbe3b2bab165d03c0b4042152b558c http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1_2.5.7-3.1etch1_arm.deb Size/MD5 checksum:88620 7eeb57376971a530a8630a31d428f63f http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1-dev_2.5.7-3.1etch1_arm.deb Size/MD5 checksum: 119844 8b79fdc26c8d936ae851e3eae7782644 http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ganglia-monitor_2.5.7-3.1etch1_arm.deb Size/MD5 checksum: 138300 60bd39e5a8c5591d2c81e450a6b410ad i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/libganglia1_2.5.7-3.1etch1_i386.deb Size/MD5 checksum:93078 93bcce44d781f9b6338e563f335487a5 http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gmetad_2.5.7-3.1etch1_i386.deb Size/MD5 checksum:95864 364689bae05cead30438b1f58ed39254
