Your message dated Sat, 11 Mar 2017 20:48:43 +0000
with message-id <[email protected]>
and subject line Bug#848641: fixed in spip 3.1.4-1
has caused the Debian Bug report #848641,
regarding spip: CVE-2016-9997 CVE-2016-9998
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
848641: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848641
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: spip
Version: 3.1.3-1
Severity: important
Tags: security upstream patch
Hi,
the following vulnerabilities were published for spip.
CVE-2016-9997[0]:
'id' parameter in '/ecrire/exec/puce_statut.php' XSS
CVE-2016-9998[1]:
'plugin' parameter in '/ecrire/exec/info_plugin.php' XSS
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2016-9997
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9997
[1] https://security-tracker.debian.org/tracker/CVE-2016-9998
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9998
Please adjust the affected versions in the BTS as needed. Only sid's
version has been doublechecked so far.
Regards,
Salvatore
-- System Information:
Debian Release: stretch/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 3.16.0-4-amd64 (SMP w/8 CPU cores)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
--- End Message ---
--- Begin Message ---
Source: spip
Source-Version: 3.1.4-1
We believe that the bug you reported is fixed in the latest version of
spip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
David Prévot <[email protected]> (supplier of updated spip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sat, 11 Mar 2017 08:24:16 -1000
Source: spip
Binary: spip
Architecture: source
Version: 3.1.4-1
Distribution: unstable
Urgency: high
Maintainer: SPIP packaging team <[email protected]>
Changed-By: David Prévot <[email protected]>
Description:
spip - website engine for publishing
Closes: 829339 847156 848641
Changes:
spip (3.1.4-1) unstable; urgency=high
.
[ Adriano Rafael Gomes ]
* Add Brazilian Portuguese debconf templates translation (Closes: #829339)
.
[ David Prévot ]
* New upstream version 3.1.4, with security fixes:
- Arbitrary PHP execution code
- Reflected Cross Site Scripting (XSS) Vulnerabilities
[CVE-2016-9997] [CVE-2016-9998] (Closes: #848641)
- Cross-site scripting (XSS) vulnerability
[CVE-2016-9152] (Closes: #847156)
* Update mutualisation to 1.3.5
* Update copyright
Checksums-Sha1:
341a39cea255844fd58861c73870ac3dfcd55953 1576 spip_3.1.4-1.dsc
5c11a4ba509364298fda7e5e6838c7caead8d091 5848656 spip_3.1.4.orig.tar.xz
5a698a3ed5e780085d2e0a44f05f09e807f3dd8d 78996 spip_3.1.4-1.debian.tar.xz
Checksums-Sha256:
9d112364039b9d90f1b49ab31f2a5cb155949d4634333c16b6dd8a761310ee36 1576
spip_3.1.4-1.dsc
884778eca338242da714641727b9acaa8ec10a5aefeefc1dbe1d38ad379d8318 5848656
spip_3.1.4.orig.tar.xz
9264bf0befda7f806efa4bffa7db789890910445cd20b1e66a6a9af85359adb1 78996
spip_3.1.4-1.debian.tar.xz
Files:
4927e5d910f7c1fd0f8d34216b7fcdeb 1576 web extra spip_3.1.4-1.dsc
773ba92d20896200e8301361cbc814f6 5848656 web extra spip_3.1.4.orig.tar.xz
385b52c4a3a628e4d032a8ca85af1e8f 78996 web extra spip_3.1.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAljEVwUACgkQBYwc+UT2
vTwO0wf/f3psiw/lNmWCv10k+4jb7SoIvDiHmVNJj0x43gb3oS/duLRyFdEQBWxJ
0bXmTWQa2ZbIjnEYXfltEC53nG2FZgW+znLJRtD6AQv/Dh2jn1MmYrfQEu3RGpE6
+Aw//d4+Lu1o48pOI/kpDP+NCFd17whV8HCVE8JRUBhGGHIx1eOBCoIn/boYRx9K
/6WSwjmOivt5F/vM2cEAsAQtL+fW2Eqvj/c7heqSXd2l5tz3I75yVjHEoS5pRkhO
w+FAYGZzZY8El3TzUIlHY3fPLMuMRoN/sf9APwNh1PAbshhPJtdtcsbcad3r4+KM
r125qSzeJNuxUAVqc+xPCGCgC1ecvA==
=TnLj
-----END PGP SIGNATURE-----
--- End Message ---
