Otkrivena je ranjivost u paketu rtfm (Request Tracker FAQ Manager) koja omogućuje izvođenje XSS napada, odnosno umetanje proizvoljnog HTML i skriptnog koda.
Paket:
Operacijski sustavi:
Debian Linux 6.0 (squeeze), Debian Linux wheezy (testing)
Problem:
XSS
Iskorištavanje:
udaljeno
Posljedica:
umetanje HTML i skriptnog koda
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2012-2768
Izvorni ID preporuke:
DSA-2535-1
Izvor:
Debian
Problem:
Ranjivosti su uzrokovane nepravilnostima u stranicama za administraciju tema.
Posljedica:
Zlonamjerni korisnici bi mogli izvesti proizvoljan HTML i skriptni kod.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2535-1 Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
http://www.debian.org/security/ Florian Weimer
August 29, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : rtfm
Vulnerability : cross-site scripting
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-2768
It was discovered that rtfm, the Request Tracker FAQ Manager, contains
multiple cross-site scripting vulnerabilities in the topic
administration page.
For the stable distribution (squeeze), this problem has been fixed in
version 2.4.2-4+squeeze1.
For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 4.0.6-4 of the
request-tracker4 package.
We recommend that you upgrade your rtfm packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJQPmzyAAoJEL97/wQC1SS+BgUH/2a5z3ovr7fzOvguEDCrvz8w
W9RA8UqBYQJhjny27nZkOtRBjQMpDZ1RrLPvdk5/T0fh8BNZLeEDlpqJcAxtrZH3
HDgT83EqwuKYoMmgiUmzLY6jLN9+0dvI2b4PDJx88tvcYIv7FIpWg07RsfQjU175
+FiwKTxG9b64DcskuRUzihcLa7oHMz6Q/ojz4Z3kV0DSf8pmGKqGjnOT/qxj/ZYd
QpjkfM3LqtvLivEd3Z6CTFEjF9vK8jv/DaJlKvmvbDIP/9TkI9rV1+lVMxS5X6/O
jEnDcsOHIYBi+JvM702KM1ozGAj/6cJDbA8MDX26/68Lm3igmEi7+R6fjqGsw2U=
=Zvxd
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
with a subject of "unsubscribe". Trouble? Contact Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
Archive: http://lists.debian.org/Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
Posljednje sigurnosne preporuke