[SECURITY] [DLA 717-1] moin security update

2016-11-2214:58:23

lists.debian.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.5%

JSON

Package : moin
Version : 1.9.4-8+deb7u3
CVE ID : CVE-2016-7146 CVE-2016-9119
Debian Bug : 844338 844340

Several cross-site scripting vulnerabilities were discovered in moin, a
Python clone of WikiWiki. A remote attacker can conduct cross-site
scripting attacks via the GUI editor's attachment dialogue
(CVE-2016-7146) and the GUI editor's link dialogue (CVE-2016-9119).

For Debian 7 "Wheezy", these problems have been fixed in version
1.9.4-8+deb7u3.

We recommend that you upgrade your moin packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8allmoin< 1.9.8-1+deb8u1moin_1.9.8-1+deb8u1_all.deb
Debian7allpython-moinmoin< 1.9.4-8+deb7u3python-moinmoin_1.9.4-8+deb7u3_all.deb
Debian8allpython-moinmoin< 1.9.8-1+deb8u1python-moinmoin_1.9.8-1+deb8u1_all.deb
Debian7allmoin< 1.9.4-8+deb7u3moin_1.9.4-8+deb7u3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	all	moin	< 1.9.8-1+deb8u1	moin_1.9.8-1+deb8u1_all.deb
Debian	7	all	python-moinmoin	< 1.9.4-8+deb7u3	python-moinmoin_1.9.4-8+deb7u3_all.deb
Debian	8	all	python-moinmoin	< 1.9.8-1+deb8u1	python-moinmoin_1.9.8-1+deb8u1_all.deb
Debian	7	all	moin	< 1.9.4-8+deb7u3	moin_1.9.4-8+deb7u3_all.deb