Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 436
Alerts This Week
Warning Icon 1 436

Debian: DSA 1242-1 Critical: Elog Multiple Remote Threats

debian
Calendar Grey December 27, 2006
Scroller Debian
- --------------------------------------------------------------------------Debian Security Advisory
Updated package.
Topics%20covered

Topics Covered

security advisory debian remote execution critical threat multiple issues arbitrary code elog package

Summary


Tilman Koschnick discovered that log entry editing in HTML is vulnerable
to cross-site scripting. This update disables the vulnerable code.

CVE-2006-5790

Ulf Harnhammar of the Debian Security Audit Project discovered several
format string vulnerabilities in elog, which may lead to execution of
arbitrary code.

CVE-2006-5791

Ulf Harnhammar of the Debian Security Audit Project discovered
cross-site scripting vulnerabilities in the creation of new logbook
entries.

CVE-2006-6318

Jayesh KS and Arun Kethipelly of OS2A discovered that elog performs
insufficient error handling in config file parsing, which may lead to
denial of service through a NULL pointer dereference.

For the stable distribution (sarge) these problems have been fixed in
version 2.5.7+r1558-4+sarge3.

The upcoming stable distribution (etch) will no longer include elog.

For the unstable distribution (sid) these problems have been fixed in
version 2.6.2+r1754-1.

We recom...

Read the Full Advisory

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory debian remote execution critical threat multiple issues arbitrary code elog package

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.