Articles / Debian: New slash packages …

Debian: New slash packages fix multiple vulnerabilities

It has been discovered that Slash, the Slashdot Like Automated Storytelling Homepage suffers from two vulnerabilities related to insufficient input sanitation, leading to execution of SQL commands and cross-site scripting. Updated packages are available from security.debian.org.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1633-1                  security@debian.org
http://www.debian.org/security/                           Florian Weimer
September 01, 2008                    http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : slash
Vulnerability  : SQL Injection, Cross-Site Scripting
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2008-2231, CVE-2008-2553
Debian Bug     : 484499

It has been discovered that Slash, the Slashdot Like Automated
Storytelling Homepage suffers from two vulnerabilities related to
insufficient input sanitation, leading to execution of SQL commands 
(CVE-2008-2231) and cross-site scripting (CVE-2008-2553).

For the stable distribution (etch), these problems have been fixed in
version 2.2.6-8etch1.

In the unstable distribution (sid), the slash package is currently
uninstallable and will be removed soon.

We recommend that you upgrade your slash package.

Upgrade instructions
- --------------------

wget url
       will fetch the file for you
dpkg -i file.deb
       will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
       will update the internal database
apt-get upgrade
       will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.dsc
   Size/MD5 checksum:      954 70b86d7e0c6f4d70e6ecc1e027739be5
 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6.orig.tar.gz
   Size/MD5 checksum:   584128 a9886e1e08e47e0db4f3ba3e750102ff
 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1.diff.gz
   Size/MD5 checksum:    21622 2b23a32433e9b168b09ad43e0fd1d160

alpha architecture (DEC Alpha)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_alpha.deb
   Size/MD5 checksum:   591940 9e38837b0a8f3cc1d3459dacc58c23c6

amd64 architecture (AMD x86_64 (AMD64))

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_amd64.deb
   Size/MD5 checksum:   588970 e81e95ed88e082dc56cd10b3770c4360

arm architecture (ARM)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_arm.deb
   Size/MD5 checksum:   589446 925a97d085854e35f4e9bd678b99454e

hppa architecture (HP PA RISC)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_hppa.deb
   Size/MD5 checksum:   594236 702a6635658253ad1c5c69169174dcfc

i386 architecture (Intel ia32)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_i386.deb
   Size/MD5 checksum:   587830 005ed926fe7595e45d2780c37bd6d09f

ia64 architecture (Intel ia64)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_ia64.deb
   Size/MD5 checksum:   589356 a75d5d65a4499f1d9278df08849959ce

mips architecture (MIPS (Big Endian))

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mips.deb
   Size/MD5 checksum:   586112 a2b1336b77de1682ae764c3e05a5950e

mipsel architecture (MIPS (Little Endian))

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_mipsel.deb
   Size/MD5 checksum:   587726 25c8ea639b4aa9c924e26ab33e5d59d6

powerpc architecture (PowerPC)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_powerpc.deb
   Size/MD5 checksum:   590880 71de67c5a29a3c3122f74570ea090435

s390 architecture (IBM S/390)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_s390.deb
   Size/MD5 checksum:   587744 c4809262d63d3449c41e8816b2a8cea1

sparc architecture (Sun SPARC/UltraSPARC)

 http://security.debian.org/pool/updates/main/s/slash/slash_2.2.6-8etch1_sparc.deb
   Size/MD5 checksum:   588014 8ef8f770f5f22f9473133f382fd7bb18


 These files will probably be moved into the stable distribution on
 its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJIvDgqAAoJEL97/wQC1SS+zx4H+wURQWes0P5UxmnaggJbnM4C
4bIcxFIphdumrQChejR9eOBvVkDd5dBLmOOFMJpAuMP7QQPWJFIY1cnhprIw27Kj
76VDV6lC19X+wb0c8/vkVbYRaJ7eUB1zooZ0wHgpFgYYmMO/jGysYntmPRq5dWO0
H/buUll72HNWH0OPwp4KS5yP4jnUHqddrJNrqIOyqF5lZJXc5GVTCI1Eun8maLxw
fol5MTP5CaJ4mZzaKhDd9ZcnbWyHiE1bNCFdVAnt73aWjG66yQjNfmIJ8d3bYBvX
NiudvGKuV3kAQ3pa9QiMTxgcpozkUJt/g0+Y8YvJElPqzSEhBD2ghRMxSIjvLxg=
=xUYM
-----END PGP SIGNATURE-----
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.