Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 2 articles for you...
91
security advisoryhigh severityremote exploitGentoo: GLSA-200802-04 High: Gallery Code Execution Threat
Multiple vulnerabilities were discovered in Gallery.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200802-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Gallery: Multiple vulnerabilities Date: February 11, 2008 Bugs: #203217 ID: 200802-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities were discovered in Gallery. Background ========= Gallery is a web-based application for creating and viewing photo albums. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/gallery < 2.2.4 > = 2.2.4 < 2.0 Description ========== The Gallery developement team reported and fixed critical vulnerabilities during an internal audit (CVE-2007-6685, CVE-2007-6686, CVE-2007-6687, CVE-2007-6688, CVE-2007-6689, CVE-2007-6690, CVE-2007-6691, CVE-2007-6692, CVE-2007-6693). Impact ===== A remote attacker could exploit these vulnerabilities to execute arbitrary code, conduct Cross-Site Scripting and Cross-Site Request Forgery attacks, or disclose sensitive informations. Workaround ========= There is no known workaround at this time. Resolution ========= All Gallery users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apps/gallery-2.2.4" References ========= [ 1 ] CVE-2007-6685 https://www.cve.org/CVERecord?id=CVE-2007-6685 [ 2 ]CVE-2007-6686 https://www.cve.org/CVERecord?id=CVE-2007-6686 [ 3 ] CVE-2007-6687 https://www.cve.org/CVERecord?id=CVE-2007-6687 [ 4 ] CVE-2007-6688 https://www.cve.org/CVERecord?id=CVE-2007-6688 [ 5 ] CVE-2007-6689 https://www.cve.org/CVERecord?id=CVE-2007-6689 [ 6 ] CVE-2007-6690 https://www.cve.org/CVERecord?id=CVE-2007-6690 [ 7 ] CVE-2007-6691 https://www.cve.org/CVERecord?id=CVE-2007-6691 [ 8 ] CVE-2007-6692 https://www.cve.org/CVERecord?id=CVE-2007-6692 [ 9 ] CVE-2007-6693 https://www.cve.org/CVERecord?id=CVE-2007-6693 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200802-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Feb 12, 2008
Gentoo
91
security advisorygentoolow severityGentoo: GLSA-200711-03 Low: Gallery WebDAV and Reupload Threats
The WebDAV and Reupload modules of Gallery contain multiple unspecified vulnerabilities.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200711-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Gallery: Multiple vulnerabilities Date: November 01, 2007 Bugs: #191587 ID: 200711-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The WebDAV and Reupload modules of Gallery contain multiple unspecified vulnerabilities. Background ========= Gallery is a PHP based photo album manager. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/gallery < 2.2.3 > = 2.2.3 Description ========== Merrick Manalastas and Nicklous Roberts have discovered multiple vulnerabilities in the WebDAV and Reupload modules. Impact ===== A remote attacker could exploit these vulnerabilities to bypass security restrictions and rename, replace and change properties of items, or edit item data using WebDAV. Workaround ========= There is no known workaround at this time. Resolution ========= All Gallery users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apps/gallery-2.2.3" References ========= [ 1 ] CVE-2007-4650 https://www.cve.org/CVERecord?id=CVE-2007-4650 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200711-03 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Nov 02, 2007
•Low
Gentoo
87
security advisorydebiancross-site scriptingDebian 3.1 DSA 1148-1 Critical: Gallery XSS Issues and Mitigations
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1148-1
Aug 09, 2006
•Critical
Debian
91
security advisorygentoosoftware updateGentoo: GLSA-200601-13 Low: Gallery Cross-Site Scripting Issue
Gallery is possibly vulnerable to a cross-site scripting attack that could allow arbitrary JavaScript code execution.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200601-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Gallery: Cross-site scripting vulnerability Date: January 26, 2006 Bugs: #119590 ID: 200601-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Gallery is possibly vulnerable to a cross-site scripting attack that could allow arbitrary JavaScript code execution. Background ========= Gallery is a web application written in PHP which is used to organize and publish photo albums. It allows multiple users to build and maintain their own albums. It also supports the mirroring of images on other servers. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/gallery < 1.5.2 > = 1.5.2 Description ========== Peter Schumacher discovered that Gallery fails to sanitize the fullname set by users, possibly leading to a cross-site scripting vulnerability. Impact ===== By setting a specially crafted fullname, an attacker can inject and execute script code in the victim's browser window and potentially compromise the user's gallery. Workaround ========= There is no known workaround at this time. Resolution ========= All Gallery users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apps/gallery-1.5.2" Note: Users with the vhosts USE flag set should manuallyuse webapp-config to finalize the update. References ========= [ 1 ] Gallery Announcement Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200601-13 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jan 26, 2006
•Low
Gentoo
87
security advisoryupdatecriticalDebian Sarge DSA 879-1 Critical: Remote Gallery Access Problem
Updated profile.. - --------------------------------------------------------------------------Debian Security Advisory DSA 879-1
Nov 02, 2005
•Critical
Debian
87
security advisorydebiancross site scriptingDebian 3.0: DSA-642-1 Severe: Gallery Cross Site Scripting Threat
Several vulnerabilities have been discovered in gallery, a web-based photo album written in PHP4.. - --------------------------------------------------------------------------Debian Security Advisory DSA 642-1
Jan 17, 2005
•Critical
Debian
91
security advisorygentooarbitrary command executionGentoo: GLSA-200409-05 Normal: Gallery Command Execution Issue
The Gallery image upload code contains a temporary file handling vulnerability which could lead to execution of arbitrary commands.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Gallery: Arbitrary command execution Date: September 02, 2004 Bugs: #60742 ID: 200409-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The Gallery image upload code contains a temporary file handling vulnerability which could lead to execution of arbitrary commands. Background ========= Gallery is a PHP script for maintaining online photo albums. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/gallery < 1.4.4_p2 > = 1.4.4_p2 Description ========== The upload handling code in Gallery places uploaded files in a temporary directory. After 30 seconds, these files are deleted if they are not valid images. However, since the file exists for 30 seconds, a carefully crafted script could be initiated by the remote attacker during this 30 second timeout. Note that the temporary directory has to be located inside the webroot and an attacker needs to have upload rights either as an authenticated user or via "EVERYBODY". Impact ===== An attacker could run arbitrary code as the user running PHP. Workaround ========= There are several workarounds to this vulnerability: * Make sure that your temporary directory is not contained in the webroot; bydefault it is located outside the webroot. * Disable upload rights to all albums for "EVERYBODY"; upload is disabled by default. * Disable debug and dev mode; these settings are disabled by default. * Disable allow_url_fopen in php.ini. Resolution ========= All Gallery users should upgrade to the latest version: # emerge sync # emerge -pv "> =www-apps/gallery-1.4.4_p2" # emerge "> =www-apps/gallery-1.4.4_p2" References ========= [ 1 ] Full Disclosure Announcement [ 2 ] Gallery Announcement ;name=News&file=article&sid=134&mode=threadℴ=0&thold=0 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200409-05 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 02, 2004
Gentoo
91
security advisorygentoosoftware updateGentoo GLSA 200406-10: Gallery Normal Severity Privilege Escalation
There is a vulnerability in the Gallery photo album software which may allow an attacker to gain administrator privileges within Gallery.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200406-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Gallery: Privilege escalation vulnerability Date: June 15, 2004 Bugs: #52798 ID: 200406-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= There is a vulnerability in the Gallery photo album software which may allow an attacker to gain administrator privileges within Gallery. Background ========= Gallery is a web application written in PHP which is used to organize and publish photo albums. It allows multiple users to build and maintain their own albums. It also supports the mirroring of images on other servers. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-misc/gallery = 1.4.3_p2 Description ========== There is a vulnerability in the Gallery photo album software which may allow an attacker to gain administrator privileges within Gallery. A Gallery administrator has full access to all albums and photos on the server, thus attackers may add or delete photos at will. Impact ===== Attackers may gain full access to all Gallery albums. There is no risk to the webserver itself, or the server on which it runs. Workaround ========= There is no known workaround at this time. All users are encouraged to upgrade to the latest availableversion. Resolution ========= All users should upgrade to the latest available version of Gallery. # emerge sync # emerge -pv "> =app-misc/gallery-1.4.3_p2" # emerge "> =app-misc/gallery-1.4.3_p2" References ========= [ 1 ] Gallery Announcement ;name=News&file=article&sid=123&mode=threadℴ=0&thold=0 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200406-10 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jun 15, 2004
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!