Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 496
Alerts This Week
Warning Icon 1 496

Ubuntu 24.10, 20.04, 18.04: USN-7318-1 moderate: spip security issues

ubuntu
Calendar Grey March 4, 2025
Scroller Ubuntu
Multiple security issues in spip have been addressed for Ubuntu 24.10, 20.04, and 18.04 LTS; make sure to upgrade your systems.
Several security issues were fixed in spip.

Summary

Several security issues were fixed in spip.

Software Description:

- spip: website engine for publishing

Details:

It was discovered that svg-sanitizer, vendored in SPIP, did not properly

sanitize SVG/XML content. An attacker could possibly use this issue to

perform cross site scripting. This issue only affected Ubuntu 24.10.

(CVE-2022-23638)

It was discovered that SPIP did not properly sanitize certain inputs. A

remote attacker could possibly use this issue to perform cross site

scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28959)

It was discovered that SPIP did not properly sanitize certain inputs. A

remote attacker could possibly use this issue to perform PHP injection

attacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-28960)

It was discovered that SPIP did not properly sanitize certain inputs. A

remote attacker could possibly use this issue to perform SQL injection

attacks. This issue only affected Ubuntu 18.04 LTS. (CVE-2...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory software update cross site scripting arbitrary code execution SQL injection input sanitation spip

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
   spip                            4.3.1+dfsg-1ubuntu0.1

Ubuntu 20.04 LTS
   spip                            3.2.7-1ubuntu0.1+esm2
                                   Available with Ubuntu Pro

Ubuntu 18.04 LTS
   spip                            3.1.4-4~deb9u5ubuntu0.1~esm2
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-7318-1

  CVE-2022-23638, CVE-2022-28959, CVE-2022-28960, CVE-2022-28961,

  CVE-2022-37155, CVE-2023-24258, CVE-2023-27372, CVE-2024-8517

Severity
medium
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7318-1

Topics%20covered

Topics Covered

security advisory software update cross site scripting arbitrary code execution SQL injection input sanitation spip

Package Information

  https://launchpad.net/ubuntu/+source/spip/4.3.1+dfsg-1ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.