[SECURITY] [DLA 1898-1] xymon security update

2019-08-2613:47:46

lists.debian.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.005

Percentile

75.7%

JSON

Package : xymon
Version : 4.3.17-6+deb8u2
CVE ID : CVE-2019-13273 CVE-2019-13274 CVE-2019-13451 CVE-2019-13452
CVE-2019-13455 CVE-2019-13484 CVE-2019-13485 CVE-2019-13486

Multiple vulnerabilities have been found in xymon, the network monitoring
application. Remote attackers might leverage these vulnerabilities in the CGI
parsing code (including buffer overflows and XSS) to cause denial of service,
or any other unspecified impact.

For Debian 8 "Jessie", these problems have been fixed in version
4.3.17-6+deb8u2.

We recommend that you upgrade your xymon packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9arm64xymon-client< 4.3.28-2+deb9u1xymon-client_4.3.28-2+deb9u1_arm64.deb
Debian9armelxymon-client< 4.3.28-2+deb9u1xymon-client_4.3.28-2+deb9u1_armel.deb
Debian9s390xxymon-dbgsym< 4.3.28-2+deb9u1xymon-dbgsym_4.3.28-2+deb9u1_s390x.deb
Debian10mipsxymon-dbgsym< 4.3.28-5+deb10u1xymon-dbgsym_4.3.28-5+deb10u1_mips.deb
Debian9i386xymon-dbgsym< 4.3.28-2+deb9u1xymon-dbgsym_4.3.28-2+deb9u1_i386.deb
Debian9ppc64elxymon< 4.3.28-2+deb9u1xymon_4.3.28-2+deb9u1_ppc64el.deb
Debian10ppc64elxymon-dbgsym< 4.3.28-5+deb10u1xymon-dbgsym_4.3.28-5+deb10u1_ppc64el.deb
Debian9arm64xymon< 4.3.28-2+deb9u1xymon_4.3.28-2+deb9u1_arm64.deb
Debian10i386xymon-dbgsym< 4.3.28-5+deb10u1xymon-dbgsym_4.3.28-5+deb10u1_i386.deb
Debian10amd64xymon-client-dbgsym< 4.3.28-5+deb10u1xymon-client-dbgsym_4.3.28-5+deb10u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	arm64	xymon-client	< 4.3.28-2+deb9u1	xymon-client_4.3.28-2+deb9u1_arm64.deb
Debian	9	armel	xymon-client	< 4.3.28-2+deb9u1	xymon-client_4.3.28-2+deb9u1_armel.deb
Debian	9	s390x	xymon-dbgsym	< 4.3.28-2+deb9u1	xymon-dbgsym_4.3.28-2+deb9u1_s390x.deb
Debian	10	mips	xymon-dbgsym	< 4.3.28-5+deb10u1	xymon-dbgsym_4.3.28-5+deb10u1_mips.deb
Debian	9	i386	xymon-dbgsym	< 4.3.28-2+deb9u1	xymon-dbgsym_4.3.28-2+deb9u1_i386.deb
Debian	9	ppc64el	xymon	< 4.3.28-2+deb9u1	xymon_4.3.28-2+deb9u1_ppc64el.deb
Debian	10	ppc64el	xymon-dbgsym	< 4.3.28-5+deb10u1	xymon-dbgsym_4.3.28-5+deb10u1_ppc64el.deb
Debian	9	arm64	xymon	< 4.3.28-2+deb9u1	xymon_4.3.28-2+deb9u1_arm64.deb
Debian	10	i386	xymon-dbgsym	< 4.3.28-5+deb10u1	xymon-dbgsym_4.3.28-5+deb10u1_i386.deb
Debian	10	amd64	xymon-client-dbgsym	< 4.3.28-5+deb10u1	xymon-client-dbgsym_4.3.28-5+deb10u1_amd64.deb