Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Debian: DSA-2360-1 Vital: Hibernate Remote Code Execution Vulnerability

debian
Calendar Grey December 6, 2011
Scroller Debian
Unapproved inputs in Mojarra interpreted as EL statements; update advised for security patch.
It was discovered that Mojarra, an implementation of JavaServer Faces, evaluates untrusted values as EL expressions if includeViewParameters is set to true
Topics%20covered

Topics Covered

security advisory debian security fix remote threat el injection mojarra

Summary

It was discovered that Mojarra, an implementation of JavaServer Faces,
evaluates untrusted values as EL expressions if includeViewParametersis set to true.

For the stable distribution (squeeze), this problem has been fixed in
version 2.0.3-1+squeeze1.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 2.0.3-2.

We recommend that you upgrade your mojarra packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: mojarra
CVE ID: CVE-2011-4358

Topics%20covered

Topics Covered

security advisory debian security fix remote threat el injection mojarra

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.