Bug 472282 – <www-apps/gallery-3.0.9: Two Cross-Site Scripting Vulnerabilities (CVE-2013-2087)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-06-04 13:32:34 UTC]

From ${URL} :

Description
Two vulnerabilities have been reported in Gallery, which can be exploited by malicious people to conduct cross-site scripting attacks.

Certain input related to Uploadify and flowplayer is not properly sanitised before being returned to the user. This can be exploited to execute 
arbitrary HTML and script code in a user's browser session in the context of an affected site.

The vulnerabilities are reported in versions prior to 3.0.8.


Solution
Update to version 3.0.8.

Provided and/or discovered by
The vendor credits Mala and Dhaval Chauhan.

Original Advisory
Gallery:
http://galleryproject.org/gallery_3_0_8


@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.

[Comment 1 Chris Reffett (RETIRED) 2013-09-11 15:04:02 UTC]

maintainers: ping, okay to stable?

[Comment 2 Mikle Kolyada (RETIRED) 2013-10-17 06:58:54 UTC]

no response from maintainers over a month, go stabilize it.

Arches, please test and mark stable:

=www-apps/gallery-3.0.9

target KEYWORDS="amd64 hppa ppc ppc64 x86"

[Comment 3 Jeroen Roovers (RETIRED) 2013-10-17 15:07:03 UTC]

Stable for HPPA.

[Comment 4 Agostino Sarubbo 2013-10-20 08:02:49 UTC]

amd64 and x86 stable

[Comment 5 Agostino Sarubbo 2013-10-22 08:58:21 UTC]

ppc stable

[Comment 6 Agostino Sarubbo 2013-10-24 09:22:22 UTC]

ppc64 stable

[Comment 7 Sergey Popov 2013-10-28 10:54:46 UTC]

Thanks for your work.

GLSA vote: no

[Comment 8 Mikle Kolyada (RETIRED) 2014-01-27 13:36:04 UTC]

GLSA vote: no.

Closing as [noglsa]