Debian: New slash packages fix multiple vulnerabilities

    Date01 Sep 2008
    CategoryDebian
    3489
    Posted ByLinuxSecurity Advisories
    It has been discovered that Slash, the Slashdot Like Automated Storytelling Homepage suffers from two vulnerabilities related to insufficient input sanitation, leading to execution of SQL commands (CVE-2008-2231) and cross-site scripting (CVE-2008-2553).
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1633-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                           Florian Weimer
    September 01, 2008                    http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : slash
    Vulnerability  : SQL Injection, Cross-Site Scripting
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2008-2231, CVE-2008-2553
    Debian Bug     : 484499
    
    It has been discovered that Slash, the Slashdot Like Automated
    Storytelling Homepage suffers from two vulnerabilities related to
    insufficient input sanitation, leading to execution of SQL commands 
    (CVE-2008-2231) and cross-site scripting (CVE-2008-2553).
    
    For the stable distribution (etch), these problems have been fixed in
    version 2.2.6-8etch1.
    
    In the unstable distribution (sid), the slash package is currently
    uninstallable and will be removed soon.
    
    We recommend that you upgrade your slash package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.dsc
        Size/MD5 checksum:      954 70b86d7e0c6f4d70e6ecc1e027739be5
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6.orig.tar.gz
        Size/MD5 checksum:   584128 a9886e1e08e47e0db4f3ba3e750102ff
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.diff.gz
        Size/MD5 checksum:    21622 2b23a32433e9b168b09ad43e0fd1d160
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_alpha.deb
        Size/MD5 checksum:   591940 9e38837b0a8f3cc1d3459dacc58c23c6
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_amd64.deb
        Size/MD5 checksum:   588970 e81e95ed88e082dc56cd10b3770c4360
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_arm.deb
        Size/MD5 checksum:   589446 925a97d085854e35f4e9bd678b99454e
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_hppa.deb
        Size/MD5 checksum:   594236 702a6635658253ad1c5c69169174dcfc
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_i386.deb
        Size/MD5 checksum:   587830 005ed926fe7595e45d2780c37bd6d09f
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_ia64.deb
        Size/MD5 checksum:   589356 a75d5d65a4499f1d9278df08849959ce
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mips.deb
        Size/MD5 checksum:   586112 a2b1336b77de1682ae764c3e05a5950e
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mipsel.deb
        Size/MD5 checksum:   587726 25c8ea639b4aa9c924e26ab33e5d59d6
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_powerpc.deb
        Size/MD5 checksum:   590880 71de67c5a29a3c3122f74570ea090435
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_s390.deb
        Size/MD5 checksum:   587744 c4809262d63d3449c41e8816b2a8cea1
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_sparc.deb
        Size/MD5 checksum:   588014 8ef8f770f5f22f9473133f382fd7bb18
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"4","type":"x","order":"1","pct":57.14,"resources":[]},{"id":"88","title":"Should be more technical","votes":"2","type":"x","order":"2","pct":28.57,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":14.29,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.