[SECURITY] [DSA 1633-1] New slash packages fix multiple vulnerabilities

2008-09-01T18:45:18
ID DEBIAN:DSA-1633-1:FF57A
Type debian
Reporter Debian
Modified 2008-09-01T18:45:18

Description


Debian Security Advisory DSA-1633-1 security@debian.org http://www.debian.org/security/ Florian Weimer September 01, 2008 http://www.debian.org/security/faq


Package : slash Vulnerability : SQL Injection, Cross-Site Scripting Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-2231, CVE-2008-2553 Debian Bug : 484499

It has been discovered that Slash, the Slashdot Like Automated Storytelling Homepage suffers from two vulnerabilities related to insufficient input sanitation, leading to execution of SQL commands (CVE-2008-2231) and cross-site scripting (CVE-2008-2553).

For the stable distribution (etch), these problems have been fixed in version 2.2.6-8etch1.

In the unstable distribution (sid), the slash package is currently uninstallable and will be removed soon.

We recommend that you upgrade your slash package.

Upgrade instructions


wget url will fetch the file for you dpkg -i file.deb will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update will update the internal database apt-get upgrade will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch


Source archives:

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.dsc Size/MD5 checksum: 954 70b86d7e0c6f4d70e6ecc1e027739be5 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6.orig.tar.gz Size/MD5 checksum: 584128 a9886e1e08e47e0db4f3ba3e750102ff http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.diff.gz Size/MD5 checksum: 21622 2b23a32433e9b168b09ad43e0fd1d160

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_alpha.deb Size/MD5 checksum: 591940 9e38837b0a8f3cc1d3459dacc58c23c6

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_amd64.deb Size/MD5 checksum: 588970 e81e95ed88e082dc56cd10b3770c4360

arm architecture (ARM)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_arm.deb Size/MD5 checksum: 589446 925a97d085854e35f4e9bd678b99454e

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_hppa.deb Size/MD5 checksum: 594236 702a6635658253ad1c5c69169174dcfc

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_i386.deb Size/MD5 checksum: 587830 005ed926fe7595e45d2780c37bd6d09f

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_ia64.deb Size/MD5 checksum: 589356 a75d5d65a4499f1d9278df08849959ce

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mips.deb Size/MD5 checksum: 586112 a2b1336b77de1682ae764c3e05a5950e

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mipsel.deb Size/MD5 checksum: 587726 25c8ea639b4aa9c924e26ab33e5d59d6

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_powerpc.deb Size/MD5 checksum: 590880 71de67c5a29a3c3122f74570ea090435

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_s390.deb Size/MD5 checksum: 587744 c4809262d63d3449c41e8816b2a8cea1

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_sparc.deb Size/MD5 checksum: 588014 8ef8f770f5f22f9473133f382fd7bb18

These files will probably be moved into the stable distribution on its next update.


For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>