------------------------------------------------------------------------ Debian Security Advisory DSA-138-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Wichert Akkerman August 1, 2002 ------------------------------------------------------------------------ Package : gallery Problem type : remote exploit Debian-specific: no A problem was found in gallery (a web-based photo album toolkit): it was possible to pass in the GALLERY_BASEDIR variable remotely. This made it possible to execute commands under the uid of web-server. This has been fixed in version 1.2.5-7 of the Debian package and upstream version 1.3.1. ------------------------------------------------------------------------ Obtaining updates: By hand: wget URL will fetch the file for you. dpkg -i FILENAME.deb will install the fetched file. With apt: deb https://security.debian.org/ stable/updates main added to /etc/apt/sources.list will provide security updates Additional information can be found on the Debian security web-pages at https://www.debian.org/security/ ------------------------------------------------------------------------ Debian GNU/Linux 2.2 alias potato --------------------------------- Potato does not contain the gallery package Debian GNU/Linux 3.0 alias woody -------------------------------- Woody was released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc. Source archives: https://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5-7.woody.0.dsc Size/MD5 checksum: 577 34188f0145b780cabc087dc273710428 https://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5.orig.tar.gz Size/MD5 checksum: 132099 1a32e57b36ca06d22475938e1e1b19f9 https://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5-7.woody.0.diff.gz Size/MD5 checksum: 7125 707ec3020491869fa59f66d28e646360 Architecture independent packages: https://security.debian.org/pool/updates/main/g/gallery/gallery_1.2.5-7.woody.0_all.deb Size/MD5 checksum: 132290 8f6f152a45bdd3f632fa1cee5e994132 -- ---------------------------------------------------------------------------- Debian Security team <This email address is being protected from spambots. You need JavaScript enabled to view it.> https://www.debian.org/security/ Mailing-List: This email address is being protected from spambots. You need JavaScript enabled to view it.
Debian: 'gallery'
A problem was found in gallery (a web-based photo album toolkit): itwas possible to pass in the GALLERY_BASEDIR variable remotely. Thismade it possible to execute commands under the uid of web-server.
