Summary: | www-apps/gallery <1.5.9 <2.2.6 Multiple vulnerabilities (CVE-2008-{3662,4129,4130}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Robert Buchholz (RETIRED) <rbu> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | Jan.Schubert, sgtphou |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://gallery.menalto.com/gallery_2.2.6_released | ||
Whiteboard: | B3 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Robert Buchholz (RETIRED)
![]() CVE-2008-4129 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4129): Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive upload (aka zip upload) functionality. CVE-2008-4130 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4130): Cross-site scripting (XSS) vulnerability in Gallery 2.x before 2.2.6 allows remote attackers to inject arbitrary web script or HTML via a crafted Flash animation, related to the ability of the animation to "interact with the embedding page." *** Bug 238773 has been marked as a duplicate of this bug. *** Bumped in the tree. Arch teams, please, stabilize. Target keywords: gallery-2.2.6: alpha amd64 hppa ppc ppc64 sparc x86 gallery-1.5.9: alpha amd64 hppa ppc sparc x86 alpha/sparc/x86 stable Thx, seem to work fine on my amd64 (intel) platform. Both stable for HPPA. ppc64 stable ppc stable amd64 stable, all arches done. time for GLSA decision, I vote yes. Removed vulnerable versions. webapps done. YES too, request filed. GLSA 200811-02, thanks everyone, sorry about the delay. |