[DLA 40-1] cacti security update

2014-08-2217:44:45

lists.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

71.3%

JSON

Package : cacti
Version : 0.8.7g-1+squeeze5
CVE ID : CVE-2014-5025 CVE-2014-5026 CVE-2014-5261 CVE-2014-5262
Debian Bug : 755032

Multiple security issues (cross-site scripting, missing input sanitizing
and SQL injection) have been discovered in Cacti, a web interface for
graphing of monitoring systems.

Furthermore, the fix for CVE-2014-4002 in the previous security update
has been brought in-line with the upstream fix as it caused a
regression for people using the plug-in system.

OSVersionArchitecturePackageVersionFilename
Debian7allcacti< 0.8.8a+dfsg-5+deb7u4cacti_0.8.8a+dfsg-5+deb7u4_all.deb
Debian6allcacti< 0.8.7g-1+squeeze5cacti_0.8.7g-1+squeeze5_all.deb