CVE-2012-2129: Cross-site scripting

Debian Bug report logs - #670917
CVE-2012-2129: Cross-site scripting

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <muehlenhoff@univention.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2012-2129: Cross-site scripting

Date: Mon, 30 Apr 2012 14:30:03 +0200

Package: dokuwiki
Severity: important
Tags: security

Please see http://secunia.com/advisories/48848/ for more details.

Cheers,
        Moritz

Message #10 received at 670917-close@bugs.debian.org (full text, mbox, reply):

From: Tanguy Ortolo <tanguy+debian@ortolo.eu>

To: 670917-close@bugs.debian.org

Subject: Bug#670917: fixed in dokuwiki 0.0.20120125a-1

Date: Sat, 05 May 2012 12:47:28 +0000

Source: dokuwiki
Source-Version: 0.0.20120125a-1

We believe that the bug you reported is fixed in the latest version of
dokuwiki, which is due to be installed in the Debian FTP archive:

dokuwiki_0.0.20120125a-1.debian.tar.gz
  to main/d/dokuwiki/dokuwiki_0.0.20120125a-1.debian.tar.gz
dokuwiki_0.0.20120125a-1.dsc
  to main/d/dokuwiki/dokuwiki_0.0.20120125a-1.dsc
dokuwiki_0.0.20120125a-1_all.deb
  to main/d/dokuwiki/dokuwiki_0.0.20120125a-1_all.deb
dokuwiki_0.0.20120125a.orig.tar.gz
  to main/d/dokuwiki/dokuwiki_0.0.20120125a.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 670917@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tanguy Ortolo <tanguy+debian@ortolo.eu> (supplier of updated dokuwiki package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 05 May 2012 14:27:37 +0200
Source: dokuwiki
Binary: dokuwiki
Architecture: source all
Version: 0.0.20120125a-1
Distribution: unstable
Urgency: high
Maintainer: Tanguy Ortolo <tanguy+debian@ortolo.eu>
Changed-By: Tanguy Ortolo <tanguy+debian@ortolo.eu>
Description: 
 dokuwiki   - standards compliant simple to use wiki
Closes: 670917
Changes: 
 dokuwiki (0.0.20120125a-1) unstable; urgency=high
 .
   * New upstream bugfix release: properly escape an error messages that could
     be used to inject arbitrary JavaScript, leading to an XSS vulnerability.
     (CVE-2012-2129) (Closes: 670917)
Checksums-Sha1: 
 a2371cd17a33087e058f10bf7f12573470405882 1990 dokuwiki_0.0.20120125a-1.dsc
 4287b947e5d59528ef0d6685fee4ebefd99c1a24 2539659 dokuwiki_0.0.20120125a.orig.tar.gz
 f42b61f6152f93d2f5fe0c7efd8ce814dbb49fd1 89246 dokuwiki_0.0.20120125a-1.debian.tar.gz
 566583d8c322ddb2b87a98b2ec53a0fd3f8e1910 1773232 dokuwiki_0.0.20120125a-1_all.deb
Checksums-Sha256: 
 9dc8899305a636f4c0a106a46b80db42c2552e2f406ad2ac9cc473d92c6e3958 1990 dokuwiki_0.0.20120125a-1.dsc
 7a7f23ae6847db02bfc123d4292d7938662cc0c443a8e33402c63acb280ff664 2539659 dokuwiki_0.0.20120125a.orig.tar.gz
 2f0004981b67224cdec005c2ad9ed304afc53f1407d4a1e1f44ebd7c15fb9aba 89246 dokuwiki_0.0.20120125a-1.debian.tar.gz
 0671eda094a603d6290aea9e0f16cf75b44c58d2116a22892bed373d8c89b75b 1773232 dokuwiki_0.0.20120125a-1_all.deb
Files: 
 9ad46d538d789c376f2476531954f349 1990 web optional dokuwiki_0.0.20120125a-1.dsc
 aea520bd7bb61f7ecd3322e479cd8047 2539659 web optional dokuwiki_0.0.20120125a.orig.tar.gz
 c562df6c47683d9e72057cd029b2e1a0 89246 web optional dokuwiki_0.0.20120125a-1.debian.tar.gz
 d7c0dcdbbca75437e9f96919689a66a5 1773232 web optional dokuwiki_0.0.20120125a-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCgAGBQJPpR1YAAoJEOryzVHFAGgZ5hEQAMbo6Sy8VY2QT5sViEzsanDz
5UxCVll9g4P/mEFjbwOtUAt3Gfas/69fsYrIyNJt0SPG4Kw+vToIzBFhGOv7TIj3
WUWm7jKTt3+MUUL3SmZzmL+S+7K9mgS2PWRcd2cpgBZ6KxnmBZtK9LKWOiLZAjNa
UHauF45LJOejIGKEC1D5uWoVfGepMWfksACYNqKdsvw0GOHP6aJNt4kDnz5xrlY+
cco4uug1ArEePz9sBODxHfpNpiOCdRq0vn1Ldyv9WHK4RSrabO38IMUDjzqTkbFx
9jbpzy6lv/vW1eBeAAN/ITPh4KjWht8xgtFHtHiZJKuQd7DF0zQyWNeJrqdalO97
UNOQ9/l90P3ti1vn5fA8tMAQx5Cu7DqDXnnaKBBM/8diFSc22vS4UGoN3Efzb4DS
OVine4UTM5KiTryJoieQB2UZj0GH61yshi4CK553w08EYn4IqWmMpRVLXH44whdW
lsDg/njuIB060sKLJGTPmqrvPoxamfA7pdWsr7FB8Cc6QNBAf1xKw0eNX3e2ZLin
ZhBw/R8LlMZwqGCyA3hgTsprbp8sxt/rXTntyywBIoKvtF9EH24Dva5wTL7TO0V7
8VLiSQhJC7k7VRB7bCg9lHbjZluO3z+rY5d8YF+ZPVCe9mt5s1ebl9yAyCombnpX
LzfZ3NRhKomXUTtA+hT/
=kztj
-----END PGP SIGNATURE-----

Message #19 received at 670917@bugs.debian.org (full text, mbox, reply):

From: Jonathan Wiltshire <jmw@debian.org>

To: 670917@bugs.debian.org

Subject: Re: CVE-2012-2129: Cross-site scripting

Date: Sun, 08 Jul 2012 17:38:24 -0000

Dear maintainer,

Recently you fixed one or more security problems and as a result you closed
this bug. These problems were not serious enough for a Debian Security
Advisory, so they are now on my radar for fixing in the following suites
through point releases:

squeeze (6.0.6) - use target "stable"

Please prepare a minimal-changes upload targetting each of these suites,
and submit a debdiff to the Release Team [0] for consideration. They will
offer additional guidance or instruct you to upload your package.

I will happily assist you at any stage if the patch is straightforward and
you need help. Please keep me in CC at all times so I can
track [1] the progress of this request.

For details of this process and the rationale, please see the original
announcement [2] and my blog post [3].

0: debian-release@lists.debian.org
1: http://prsc.debian.net/tracker/670917/
2: <201101232332.11736.thijs@debian.org>
3: http://deb.li/prsc

Thanks,

with his security hat on:
--
Jonathan Wiltshire                                      jmw@debian.org
Debian Developer                         http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51

Message #24 received at 670917@bugs.debian.org (full text, mbox, reply):

From: Tanguy Ortolo <tanguy+debian@ortolo.eu>

To: Jonathan Wiltshire <jmw@debian.org>, 670917@bugs.debian.org

Subject: Re: Bug#670917: CVE-2012-2129: Cross-site scripting

Date: Tue, 10 Jul 2012 15:07:56 +0200

[Message part 1 (text/plain, inline)]

Jonathan Wiltshire, 2012-07-08 17:38-0000:
>this bug. These problems were not serious enough for a Debian Security
>Advisory, so they are now on my radar for fixing in the following suites
>through point releases:
>
>squeeze (6.0.6) - use target "stable"

In fact this is not needed, because this security problem only affected 
the version from testing/unstable. So a fix is not needed for stable 
because it is not affected.

Librement,

-- 
 ,--.
: /` )   Tanguy Ortolo      <xmpp:tanguy@ortolo.eu>
| `-'    Debian Developer   <irc://irc.oftc.net/Tanguy>
 \_

[signature.asc (application/pgp-signature, inline)]

Message #29 received at 670917@bugs.debian.org (full text, mbox, reply):

From: Jonathan Wiltshire <jmw@debian.org>

To: Tanguy Ortolo <tanguy+debian@ortolo.eu>

Cc: 670917@bugs.debian.org

Subject: Re: Bug#670917: CVE-2012-2129: Cross-site scripting

Date: Sat, 14 Jul 2012 22:06:49 +0100

[Message part 1 (text/plain, inline)]

On Tue, Jul 10, 2012 at 03:07:56PM +0200, Tanguy Ortolo wrote:
> Jonathan Wiltshire, 2012-07-08 17:38-0000:
> >this bug. These problems were not serious enough for a Debian Security
> >Advisory, so they are now on my radar for fixing in the following suites
> >through point releases:
> >
> >squeeze (6.0.6) - use target "stable"
> 
> In fact this is not needed, because this security problem only
> affected the version from testing/unstable. So a fix is not needed
> for stable because it is not affected.

Thanks, trackers updated.

-- 
Jonathan Wiltshire                                      jmw@debian.org
Debian Developer                         http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51

<directhex> i have six years of solaris sysadmin experience, from
            8->10. i am well qualified to say it is made from bonghits
			layered on top of bonghits

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.