Your message dated Wed, 1 Jul 2009 19:43:20 +0200 with message-id <20090701174320.ga4...@ngolde.de> and subject line closing has caused the Debian Bug report #523027, regarding mapserver: multiple vulnerabilities to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 523027: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=523027 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: mapserver Severity: important Tags: security Hi, the following CVE (Common Vulnerabilities & Exposures) ids were published for mapserver. CVE-2009-0839[0]: | Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x | before 4.10.4 and 5.x before 5.2.2, when the server has a map with a | long IMAGEPATH or NAME attribute, allows remote attackers to execute | arbitrary code via a crafted id parameter in a query action. CVE-2009-0840[1]: | Heap-based buffer underflow in the readPostBody function in cgiutil.c | in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows | remote attackers to have an unknown impact via a negative value in the | Content-Length HTTP header. CVE-2009-0841[2]: | Directory traversal vulnerability in mapserv.c in mapserv in MapServer | 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with | Cygwin, allows remote attackers to create arbitrary files via a .. | (dot dot) in the id parameter. CVE-2009-0842[3]: | mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows | remote attackers to read arbitrary invalid .map files via a full | pathname in the map parameter, which triggers the display of partial | file contents within an error message, as demonstrated by a | /tmp/sekrut.map symlink. CVE-2009-0843[4]: | The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and | 5.x before 5.2.2 allows remote attackers to determine the existence of | arbitrary files via a full pathname in the queryfile parameter, which | triggers different error messages depending on whether this pathname | exists. CVE-2009-1176[5]: | mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before | 5.2.2 does not ensure that the string holding the id parameter ends in | a '\0' character, which allows remote attackers to conduct | buffer-overflow attacks or have unspecified other impact via a long id | parameter in a query action. CVE-2009-1177[6]: | Multiple stack-based buffer overflows in maptemplate.c in mapserv in | MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact | and remote attack vectors. Please coordinate with the security team to prepare packages for the stable releases. If you fix the vulnerabilities please also make sure to include the CVE ids in your changelog entry. For further information see: [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0839 http://security-tracker.debian.net/tracker/CVE-2009-0839 [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0840 http://security-tracker.debian.net/tracker/CVE-2009-0840 [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0841 http://security-tracker.debian.net/tracker/CVE-2009-0841 [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0842 http://security-tracker.debian.net/tracker/CVE-2009-0842 [4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0843 http://security-tracker.debian.net/tracker/CVE-2009-0843 [5] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1176 http://security-tracker.debian.net/tracker/CVE-2009-1176 [6] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1177 http://security-tracker.debian.net/tracker/CVE-2009-1177
--- End Message ---
--- Begin Message ---Version: 5.2.2-1 -- Nico Golde - http://www.ngolde.de - n...@jabber.ccc.de - GPG: 0xA0A0AAAA For security reasons, all text in this mail is double-rot13 encrypted.pgplJRPtRsNDN.pgp
Description: PGP signature
--- End Message ---
_______________________________________________ Pkg-grass-devel mailing list Pkg-grass-devel@lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/pkg-grass-devel