Bug 52798 – app-misc/gallery: security flaw in Gallery >=1.2 <1.4.3-pl2

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Matthias Geerdsen (RETIRED) 2004-06-02 11:13:00 UTC]

From the Gallery website:
"Notice: The affects all versions of Gallery from 1.2 to this release:
We have discovered a well-hidden but potentially serious security flaw in these versions of Gallery which can allow a hacker to log in to your Gallery as an administrator and perform any actions on your albums. No risk is posed to the webserver-itself or any non-Gallery data. All Gallery users are very strongly urged to upgrade to 1.4.3-pl2 immediately, which fixes this serious problem and will secure your system."

Reproducible: Always
Steps to Reproduce:

[Comment 1 Kurt Lieber (RETIRED) 2004-06-02 11:44:07 UTC]

web-app folks: can you review/patch/bump as appropriate?

[Comment 2 Joshua J. Berry (CondorDes) (RETIRED) 2004-06-03 13:40:23 UTC]

I will start drafting a GLSA for this.

[Comment 3 Joshua J. Berry (CondorDes) (RETIRED) 2004-06-03 14:34:24 UTC]

Preliminary GLSA draft is in; just waiting for the ebuild and stabilization.

I don't use Gallery myself, so I unfortunately can't help with bumping it.

[Comment 4 Thierry Carrez (RETIRED) 2004-06-07 13:38:09 UTC]

gallery-1.4.3_p2 is in portage...
x86 ppc sparc alpha hppa : please mark stable

[Comment 5 Bryan Østergaard (RETIRED) 2004-06-08 15:59:45 UTC]

Stable on alpha.

[Comment 6 Joshua J. Berry (CondorDes) (RETIRED) 2004-06-08 16:54:33 UTC]

Updating status whiteboard.

[Comment 7 Jason Wever (RETIRED) 2004-06-08 19:30:49 UTC]

Stable on sparc.

[Comment 8 Guy Martin (RETIRED) 2004-06-09 11:05:08 UTC]

Stable on hppa.

[Comment 9 Thierry Carrez (RETIRED) 2004-06-14 09:30:07 UTC]

x86, ppc : please mark app-misc/gallery-1.4.3_p2 stable.

[Comment 10 Olivier Crete (RETIRED) 2004-06-14 10:24:12 UTC]

stable on x86

[Comment 11 Luca Barbato 2004-06-14 10:57:12 UTC]

Marked ppc

[Comment 12 Thierry Carrez (RETIRED) 2004-06-14 13:38:54 UTC]

Thanks everyone, this is ready for GLSA.

[Comment 13 Thierry Carrez (RETIRED) 2004-06-15 12:16:14 UTC]

GLSA 200406-10