Report forwarded to debian-bugs-dist@lists.debian.org, Christian Welzel <gawain@camlann.de>: Bug#457446; Package typo3-src.
(full text, mbox, link).
Acknowledgement sent to Nico Golde <nion@debian.org>:
New Bug report received and forwarded. Copy sent to Christian Welzel <gawain@camlann.de>.
(full text, mbox, link).
Package: typo3-src
Version: 4.0.2+debian-3
Severity: grave
Tags: security
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for typo3-src.
CVE-2007-6381[0]:
| SQL injection vulnerability in the indexed_search system extension in
| TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote
| authenticated users to execute arbitrary SQL commands via unspecified
| vectors.
If you fix this vulnerability please also include the CVE id
in your changelog entry.
For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6381
Kind regards
Nico
--
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
Bug marked as found in version 4.1.2+debian-1.
Request was from Holger Levsen <holger@layer-acht.org>
to control@bugs.debian.org.
(Sat, 22 Dec 2007 14:33:07 GMT) (full text, mbox, link).
Bug no longer marked as found in version 4.1.5-1.
Request was from Holger Levsen <holger@layer-acht.org>
to control@bugs.debian.org.
(Sat, 22 Dec 2007 14:33:08 GMT) (full text, mbox, link).
Bug no longer marked as found in version 4.2.0~svn20070904-1.
Request was from Holger Levsen <holger@layer-acht.org>
to control@bugs.debian.org.
(Sat, 22 Dec 2007 14:33:09 GMT) (full text, mbox, link).
Information forwarded to debian-bugs-dist@lists.debian.org, Christian Welzel <gawain@camlann.de>: Bug#457446; Package typo3-src.
(full text, mbox, link).
Acknowledgement sent to Thijs Kinkhorst <thijs@debian.org>:
Extra info received and forwarded to list. Copy sent to Christian Welzel <gawain@camlann.de>.
(full text, mbox, link).
Tags added: patch
Request was from Thijs Kinkhorst <thijs@debian.org>
to control@bugs.debian.org.
(Wed, 26 Dec 2007 09:18:03 GMT) (full text, mbox, link).
Bug marked as fixed in version 4.1.4-1.
Request was from Nico Golde <nion@debian.org>
to control@bugs.debian.org.
(Wed, 26 Dec 2007 15:33:13 GMT) (full text, mbox, link).
Reply sent to Christian Welzel <gawain@camlann.de>:
You have taken responsibility.
(full text, mbox, link).
Notification sent to Nico Golde <nion@debian.org>:
Bug acknowledged by developer.
(full text, mbox, link).
Subject: Bug#457446: fixed in typo3-src 4.0.2+debian-4
Date: Fri, 28 Dec 2007 19:52:17 +0000
Source: typo3-src
Source-Version: 4.0.2+debian-4
We believe that the bug you reported is fixed in the latest version of
typo3-src, which is due to be installed in the Debian FTP archive:
typo3-src-4.0_4.0.2+debian-4_all.deb
to pool/main/t/typo3-src/typo3-src-4.0_4.0.2+debian-4_all.deb
typo3-src_4.0.2+debian-4.diff.gz
to pool/main/t/typo3-src/typo3-src_4.0.2+debian-4.diff.gz
typo3-src_4.0.2+debian-4.dsc
to pool/main/t/typo3-src/typo3-src_4.0.2+debian-4.dsc
typo3_4.0.2+debian-4_all.deb
to pool/main/t/typo3-src/typo3_4.0.2+debian-4_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 457446@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christian Welzel <gawain@camlann.de> (supplier of updated typo3-src package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sat, 22 Dec 2007 22:30:00 +0100
Source: typo3-src
Binary: typo3 typo3-src-4.0
Architecture: source all
Version: 4.0.2+debian-4
Distribution: stable-security
Urgency: high
Maintainer: Christian Welzel <gawain@camlann.de>
Changed-By: Christian Welzel <gawain@camlann.de>
Description:
typo3 - Powerful content management framework (Meta package)
typo3-src-4.0 - Powerful content management framework (Core)
Closes: 457446
Changes:
typo3-src (4.0.2+debian-4) stable-security; urgency=high
.
* Fixed security problem "SQL Injection in system extension indexed_search"
(CVE-2007-6381) with patch taken from 4.0.8. (Closes: 457446)
Files:
faf88b5c6ae931fb4ce919a9e8c501c4 902 web optional typo3-src_4.0.2+debian-4.dsc
be509391b0e4d24278c14100c09dc673 7683527 web optional typo3-src_4.0.2+debian.orig.tar.gz
c88de483225fb01726b21b1c5c6754da 13795 web optional typo3-src_4.0.2+debian-4.diff.gz
2004e720cca629d8e29c0689ad4ca5b8 76268 web optional typo3_4.0.2+debian-4_all.deb
c7da1b1f0f98ce3e3ed98cf46fe71ba4 7686574 web optional typo3-src-4.0_4.0.2+debian-4_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBR3T6qGz0hbPcukPfAQKSGAgApfNpe9WVLo3FKZksozIoTtic/b5ry7vp
nlETP8kYoTcqkM2HL5nQaPzG9JafnEicmoBO1GUoH4Iu1r0feAIr6/ZQ06jkDPEW
aIq1Z2U9oHGc7CKQ0vaPnrqlPNuvuSxSqO5jIyVpKfzk3gJ0+fb0wpfBZsYX4rZS
NokI8ZvU2nB8bIO2mvYKfnH8XEKtC6qBdOxy45Eyfz0PGo3lrqzbr+6R4Fanptbi
Ji6ez1LW2CQn842MJh8gA2hEhzYOraK1NjeGB9t44xoBe0Jg9xgwzpIQyPSAvUaL
t7aynAxy4/PRVEWEK42kneg/bZxdEbshQW0UbKYbUG0EDlzZh9i/qw==
=V+Mf
-----END PGP SIGNATURE-----
Reply sent to Christian Welzel <gawain@camlann.de>:
You have taken responsibility.
(full text, mbox, link).
Notification sent to Nico Golde <nion@debian.org>:
Bug acknowledged by developer.
(full text, mbox, link).
Subject: Bug#457446: fixed in typo3-src 4.0.2+debian-4
Date: Sat, 16 Feb 2008 12:17:31 +0000
Source: typo3-src
Source-Version: 4.0.2+debian-4
We believe that the bug you reported is fixed in the latest version of
typo3-src, which is due to be installed in the Debian FTP archive:
typo3-src-4.0_4.0.2+debian-4_all.deb
to pool/main/t/typo3-src/typo3-src-4.0_4.0.2+debian-4_all.deb
typo3-src_4.0.2+debian-4.diff.gz
to pool/main/t/typo3-src/typo3-src_4.0.2+debian-4.diff.gz
typo3-src_4.0.2+debian-4.dsc
to pool/main/t/typo3-src/typo3-src_4.0.2+debian-4.dsc
typo3_4.0.2+debian-4_all.deb
to pool/main/t/typo3-src/typo3_4.0.2+debian-4_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 457446@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christian Welzel <gawain@camlann.de> (supplier of updated typo3-src package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sat, 22 Dec 2007 22:30:00 +0100
Source: typo3-src
Binary: typo3 typo3-src-4.0
Architecture: source all
Version: 4.0.2+debian-4
Distribution: stable-security
Urgency: high
Maintainer: Christian Welzel <gawain@camlann.de>
Changed-By: Christian Welzel <gawain@camlann.de>
Description:
typo3 - Powerful content management framework (Meta package)
typo3-src-4.0 - Powerful content management framework (Core)
Closes: 457446
Changes:
typo3-src (4.0.2+debian-4) stable-security; urgency=high
.
* Fixed security problem "SQL Injection in system extension indexed_search"
(CVE-2007-6381) with patch taken from 4.0.8. (Closes: 457446)
Files:
faf88b5c6ae931fb4ce919a9e8c501c4 902 web optional typo3-src_4.0.2+debian-4.dsc
be509391b0e4d24278c14100c09dc673 7683527 web optional typo3-src_4.0.2+debian.orig.tar.gz
c88de483225fb01726b21b1c5c6754da 13795 web optional typo3-src_4.0.2+debian-4.diff.gz
2004e720cca629d8e29c0689ad4ca5b8 76268 web optional typo3_4.0.2+debian-4_all.deb
c7da1b1f0f98ce3e3ed98cf46fe71ba4 7686574 web optional typo3-src-4.0_4.0.2+debian-4_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBR3T6qGz0hbPcukPfAQKSGAgApfNpe9WVLo3FKZksozIoTtic/b5ry7vp
nlETP8kYoTcqkM2HL5nQaPzG9JafnEicmoBO1GUoH4Iu1r0feAIr6/ZQ06jkDPEW
aIq1Z2U9oHGc7CKQ0vaPnrqlPNuvuSxSqO5jIyVpKfzk3gJ0+fb0wpfBZsYX4rZS
NokI8ZvU2nB8bIO2mvYKfnH8XEKtC6qBdOxy45Eyfz0PGo3lrqzbr+6R4Fanptbi
Ji6ez1LW2CQn842MJh8gA2hEhzYOraK1NjeGB9t44xoBe0Jg9xgwzpIQyPSAvUaL
t7aynAxy4/PRVEWEK42kneg/bZxdEbshQW0UbKYbUG0EDlzZh9i/qw==
=V+Mf
-----END PGP SIGNATURE-----
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Sun, 16 Mar 2008 07:30:43 GMT) (full text, mbox, link).
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.