spip - security update

Multiple vulnerabilities have been discovered in SPIP, a website
engine for publishing written in PHP.

• CVE-2016-7980
  Nicolas Chatelain of Sysdream Labs discovered a cross-site request
  forgery (CSRF) vulnerability in the valider_xml action of SPIP. This
  allows remote attackers to make use of potential additional
  vulnerabilities such as the one described in CVE-2016-7998.
• CVE-2016-7981
  Nicolas Chatelain of Sysdream Labs discovered a reflected cross-site
  scripting attack (XSS) vulnerability in the validater_xml action of
  SPIP. An attacker could take advantage of this vulnerability to
  inject arbitrary code by tricking an administrator to open a
  malicious link.
• CVE-2016-7982
  Nicolas Chatelain of Sysdream Labs discovered a file enumeration /
  path traversal attack in the validator_xml action of SPIP. An
  attacker could use this to enumerate files in an arbitrary directory
  on the file system.
• CVE-2016-7998
  Nicolas Chatelain of Sysdream Labs discovered a possible PHP code
  execution vulnerability in the template compiler/composer function
  of SPIP. In combination with the XSS and CSRF vulnerabilities
  described in this advisory, a remote attacker could take advantage
  of this to execute arbitrary PHP code on the server.
• CVE-2016-7999
  Nicolas Chatelain of Sysdream Labs discovered a server side request
  forgery in the valider_xml action of SPIP. Attackers could take
  advantage of this vulnerability to send HTTP or FTP requests to
  remote servers that they don’t have direct access to, possibly
  bypassing access controls such as a firewall.

For Debian 7 Wheezy, these problems have been fixed in version
2.1.17-1+deb7u6.

We recommend that you upgrade your spip packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: <https://wiki.debian.org/LTS&gt;