Debian: New slash packages fix multiple vulnerabilities
Debian: New slash packages fix multiple vulnerabilities
It has been discovered that Slash, the Slashdot Like Automated
Storytelling Homepage suffers from two vulnerabilities related to
insufficient input sanitation, leading to execution of SQL commands
(CVE-2008-2231) and cross-site scripting (CVE-2008-2553).
- ------------------------------------------------------------------------ Debian Security Advisory DSA-1633-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Florian Weimer September 01, 2008 https://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : slash Vulnerability : SQL Injection, Cross-Site Scripting Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-2231, CVE-2008-2553 Debian Bug : 484499 It has been discovered that Slash, the Slashdot Like Automated Storytelling Homepage suffers from two vulnerabilities related to insufficient input sanitation, leading to execution of SQL commands (CVE-2008-2231) and cross-site scripting (CVE-2008-2553). For the stable distribution (etch), these problems have been fixed in version 2.2.6-8etch1. In the unstable distribution (sid), the slash package is currently uninstallable and will be removed soon. We recommend that you upgrade your slash package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Source archives: https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.dsc Size/MD5 checksum: 954 70b86d7e0c6f4d70e6ecc1e027739be5 https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6.orig.tar.gz Size/MD5 checksum: 584128 a9886e1e08e47e0db4f3ba3e750102ff https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.diff.gz Size/MD5 checksum: 21622 2b23a32433e9b168b09ad43e0fd1d160 alpha architecture (DEC Alpha) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_alpha.deb Size/MD5 checksum: 591940 9e38837b0a8f3cc1d3459dacc58c23c6 amd64 architecture (AMD x86_64 (AMD64)) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_amd64.deb Size/MD5 checksum: 588970 e81e95ed88e082dc56cd10b3770c4360 arm architecture (ARM) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_arm.deb Size/MD5 checksum: 589446 925a97d085854e35f4e9bd678b99454e hppa architecture (HP PA RISC) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_hppa.deb Size/MD5 checksum: 594236 702a6635658253ad1c5c69169174dcfc i386 architecture (Intel ia32) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_i386.deb Size/MD5 checksum: 587830 005ed926fe7595e45d2780c37bd6d09f ia64 architecture (Intel ia64) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_ia64.deb Size/MD5 checksum: 589356 a75d5d65a4499f1d9278df08849959ce mips architecture (MIPS (Big Endian)) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mips.deb Size/MD5 checksum: 586112 a2b1336b77de1682ae764c3e05a5950e mipsel architecture (MIPS (Little Endian)) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mipsel.deb Size/MD5 checksum: 587726 25c8ea639b4aa9c924e26ab33e5d59d6 powerpc architecture (PowerPC) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_powerpc.deb Size/MD5 checksum: 590880 71de67c5a29a3c3122f74570ea090435 s390 architecture (IBM S/390) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_s390.deb Size/MD5 checksum: 587744 c4809262d63d3449c41e8816b2a8cea1 sparc architecture (Sun SPARC/UltraSPARC) https://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_sparc.deb Size/MD5 checksum: 588014 8ef8f770f5f22f9473133f382fd7bb18 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb https://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.