Debian: New webcalendar packages fix arbitrary code execution
Summary
- --------------------------------------------------------------------------Debian Security Advisory DSA 1096-1 security@debian.org http://www.debian.org/security/ Martin Schulze June 13th, 2006 http://www.debian.org/security/faq - --------------------------------------------------------------------------Package : webcalendar Vulnerability : uninitialised variable Problem type : remote Debian-specific: no CVE ID : CVE-2006-2762 A vulnerability has been discovered in webcalendar, a PHP-based multi-user calendar, that allows a remote attacker to execute arbitrary PHP code when register_globals is turned on. The old stable distribution (woody) does not contain a webcalendar package. For the stable distribution (sarge) this problem has been fixed in version 0.9.45-4sarge5. For the unstable distribution (sid) this problem has been fixed in version 1.0.4-1 We recommend that you upgrade your webcalendar package. Upgrade Instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given at the end of this advisory: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: Size/MD5 checksum: 608 216c1f9f764169fa877f1717f37dd73a Size/MD5 checksum: 12569 3a996902a10791fe764548728885d812 Size/MD5 checksum: 612360 a6a66dc54cd293429b604fe6da7633a6 Architecture independent components: Size/MD5 checksum: 629442 f918fe96d26d5cbfa99efe2b2e938d2f These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org
Sign up to get the latest security news affecting Linux and
open source delivered straight to your inbox
Powered By
Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.