------------------------------------------------------------------------
Debian Security Advisory DSA-138-1                   security@debian.org 
Debian -- Security Information  Wichert Akkerman
August  1, 2002
------------------------------------------------------------------------


Package        : gallery
Problem type   : remote exploit
Debian-specific: no

A problem was found in gallery (a web-based photo album toolkit): it
was possible to pass in the GALLERY_BASEDIR variable remotely. This
made it possible to execute commands under the uid of web-server.

This has been fixed in version 1.2.5-7 of the Debian package and upstream
version 1.3.1.


------------------------------------------------------------------------

Obtaining updates:

  By hand:
    wget URL
        will fetch the file for you.
    dpkg -i FILENAME.deb
        will install the fetched file.

  With apt:
    deb  Debian -- Security Information  stable/updates main
        added to /etc/apt/sources.list will provide security updates

Additional information can be found on the Debian security web-pages
at  Debian -- Security Information 

------------------------------------------------------------------------

Debian GNU/Linux 2.2 alias potato
---------------------------------

  Potato does not contain the gallery package


Debian GNU/Linux 3.0 alias woody
--------------------------------

  Woody was released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel,
  powerpc, s390 and sparc.


  Source archives:

      
Size/MD5 checksum:      577 34188f0145b780cabc087dc273710428
      
Size/MD5 checksum:   132099 1a32e57b36ca06d22475938e1e1b19f9
      
Size/MD5 checksum:     7125 707ec3020491869fa59f66d28e646360

  Architecture independent packages:

      
Size/MD5 checksum:   132290 8f6f152a45bdd3f632fa1cee5e994132

--
----------------------------------------------------------------------------
Debian Security team <team@security.debian.org> 
Debian -- Security Information 
Mailing-List: debian-security-announce@lists.debian.org