bugtraq - [SECURITY] [DSA 3120-1] mantis security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 6 Jan 2015 21:35:26 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3120-1] mantis security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3120-1                   security@...ian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
January 06, 2015                       http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : mantis
CVE ID         : CVE-2014-6316 CVE-2014-7146 CVE-2014-8553 CVE-2014-8554 
                 CVE-2014-8598 CVE-2014-8986 CVE-2014-8988 CVE-2014-9089
                 CVE-2014-9117 CVE-2014-9269 CVE-2014-9270 CVE-2014-9271
                 CVE-2014-9272 CVE-2014-9280 CVE-2014-9281 CVE-2014-9388

Multiple security issues have been found in the Mantis bug tracking 
system, which may result in phishing, information disclosure, CAPTCHA 
bypass, SQL injection, cross-site scripting or the execution of arbitrary
PHP code.

For the stable distribution (wheezy), these problems have been fixed in
version 1.2.18-1.

We recommend that you upgrade your mantis packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUrEbbAAoJEBDCk7bDfE42Xr8P/iajPz2wMs3H497dirI3AaMD
mfszzE/nZAieBsO3AU+sh9nM6pq658sHSfsG3vUwuI2w/eJJKrNxzkxmN3fgxX1E
7B0/IPFMd2bEdXNk9eiA1BcV10NyjeP+GluBU1j9JvUU8sVMwnT8XPBEHFPZNZDO
oksn5zP3lJtRTooILRIvxFftLBNHPSqY93IR+ke/5iWRl09vO8oNmSnNovCkg8Q0
RWi+0VFZky16H7Hzx24OdaY74cCvw5OuKU0AM2Phs5tvl27/txuafWov/2ecWSn/
fkDUWkxRBjFzneeVXesUrU/jNhjkrd6daOJZVOpr7XNaoYAuiWF7p2lKplcrs+mK
0cUuitRQLhsTA1VMRShLKAhbgrSzSO8ytGoGrpnb6LI4M3BtuAY3aaZwccR5HOFS
SXpXhn+5P7beTwQ2YtC7qZENaXGwEcFHHDngYtqvRONcpItL2N3PrpyxlMNiXrGt
Z6+/BefdhN4f+K5gKdBoifMiUYnRfcdWqp2nmEj6Bwt8sxtovdnjVkiH0GvPj13Z
JNP4LkgwJf8Y5S+zfEdKelrnf61tS9+enJdAPjXCxEDwlpXIfSmLB3JzFHiXF364
jvADdhxblvERg085zfwfY8S+akkmssqHAGfhqgejcxTtm0qAzdhdUsAwvLCO52z6
d/YMyKiTxrKzkT/FjOZg
=2i5H
-----END PGP SIGNATURE-----