-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2794-1 security@debian.org http://www.debian.org/security/ Salvatore Bonaccorso November 10, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : spip Vulnerability : several Problem type : remote Debian-specific: no Debian Bug : 729172 Several vulnerabilities have been found in SPIP, a website engine for publishing, resulting in cross-site request forgery on logout, cross-site scripting on author page, and PHP injection. For the oldstable distribution (squeeze), these problems have been fixed in version 2.1.1-3squeeze7. For the stable distribution (wheezy), these problems have been fixed in version 2.1.17-1+deb7u2. For the testing distribution (jessie), these problems will be fixed soon. For the unstable distribution (sid), these problems have been fixed in version 2.1.24-1. For the experimental distribution, these problems have been fixed in version 3.0.12-1. We recommend that you upgrade your spip packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iQIcBAEBCgAGBQJSf81MAAoJEAVMuPMTQ89E/vYQAIlFrnkS8B29u6ub8qVnm79W CXCwAbm+J2SmBSgTBoF9ne54Ea0CTdUr7cTQsp72dpcZ9z/n6zWiiayVwrn98TEH yGUs1PJMsRq2uO/9gOywqgl8euMuT7qjfU851tJlZiJY5U5d+J2s6wK8ZbPNuZ8H pcJUhz/+cuTMSxM4h/gpqoHBbsyEFAioYdAcew/FmeKaNb3x13tuMIy/WlCsyM8l O8r831dK8lShncxieHFLIJAi4k0S8oHfHOjUTNelNmK6gokAGqHwDcQAteqOMi/I XGIfyThXhPPLI/USTinR64TRezFKtE9YQs9JGwUgt3qOkuxTg2f0zk5rSujXYSh8 SHRV3YQAVvJY/jKiHHOByxU6JjNk+OdZ2UgtgkiG/Axeld4JDf8BRee1xb1Z9X7L ikSQIOD6uvpnc7k0GDM9XQIasWt9zniV5U0OwRNhCmw6Kbq4ZNIpAxklo6GGUrOA 9+nl42Z9nFriwDoJaSoxVhg54wKaG55D9hoZhGK8IHT9vRVazK+DArVkdzl/XQoL bPsPpkmv+sbiuY8Wdp7XQAK1Yn0l2Yo0rZHGb4DYISuk+W+Y7kOF9P/yz9W3L1J0 VlHA0IE1bI0bW0oUfznXdmzA7aAw8K62huJLntB8ew94AQzRWibcAdVQRgcYWpqk MpAcnoCn4uoICsGSrtQ4 =RQB4 -----END PGP SIGNATURE-----