Debian: New slash packages fix multiple vulnerabilities

It has been discovered that Slash, the Slashdot Like Automated Storytelling Homepage suffers from two vulnerabilities related to insufficient input sanitation, leading to execution of SQL commands (CVE-2008-2231) and cross-site scripting (CVE-2008-2553).

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1633-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
https://www.debian.org/security/                           Florian Weimer
September 01, 2008                    https://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : slash
Vulnerability  : SQL Injection, Cross-Site Scripting
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2008-2231, CVE-2008-2553
Debian Bug     : 484499

It has been discovered that Slash, the Slashdot Like Automated
Storytelling Homepage suffers from two vulnerabilities related to
insufficient input sanitation, leading to execution of SQL commands 
(CVE-2008-2231) and cross-site scripting (CVE-2008-2553).

For the stable distribution (etch), these problems have been fixed in
version 2.2.6-8etch1.

In the unstable distribution (sid), the slash package is currently
uninstallable and will be removed soon.

We recommend that you upgrade your slash package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.dsc
    Size/MD5 checksum:      954 70b86d7e0c6f4d70e6ecc1e027739be5
  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6.orig.tar.gz
    Size/MD5 checksum:   584128 a9886e1e08e47e0db4f3ba3e750102ff
  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.diff.gz
    Size/MD5 checksum:    21622 2b23a32433e9b168b09ad43e0fd1d160

alpha architecture (DEC Alpha)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_alpha.deb
    Size/MD5 checksum:   591940 9e38837b0a8f3cc1d3459dacc58c23c6

amd64 architecture (AMD x86_64 (AMD64))

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_amd64.deb
    Size/MD5 checksum:   588970 e81e95ed88e082dc56cd10b3770c4360

arm architecture (ARM)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_arm.deb
    Size/MD5 checksum:   589446 925a97d085854e35f4e9bd678b99454e

hppa architecture (HP PA RISC)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_hppa.deb
    Size/MD5 checksum:   594236 702a6635658253ad1c5c69169174dcfc

i386 architecture (Intel ia32)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_i386.deb
    Size/MD5 checksum:   587830 005ed926fe7595e45d2780c37bd6d09f

ia64 architecture (Intel ia64)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_ia64.deb
    Size/MD5 checksum:   589356 a75d5d65a4499f1d9278df08849959ce

mips architecture (MIPS (Big Endian))

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mips.deb
    Size/MD5 checksum:   586112 a2b1336b77de1682ae764c3e05a5950e

mipsel architecture (MIPS (Little Endian))

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mipsel.deb
    Size/MD5 checksum:   587726 25c8ea639b4aa9c924e26ab33e5d59d6

powerpc architecture (PowerPC)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_powerpc.deb
    Size/MD5 checksum:   590880 71de67c5a29a3c3122f74570ea090435

s390 architecture (IBM S/390)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_s390.deb
    Size/MD5 checksum:   587744 c4809262d63d3449c41e8816b2a8cea1

sparc architecture (Sun SPARC/UltraSPARC)

  https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_sparc.deb
    Size/MD5 checksum:   588014 8ef8f770f5f22f9473133f382fd7bb18


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb https://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.