dokuwiki: CVE-2006-2878: remote arbitrary code execution

Debian Bug report logs - #370369
dokuwiki: CVE-2006-2878: remote arbitrary code execution

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Hilko Bengen <bengen@hilluzination.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dokuwiki: Security flaw in dokuwiki

Date: Sun, 04 Jun 2006 22:35:35 +0200

Package: dokuwiki
Severity: critical

I just got this notice via freshmeat. Arbitrary code execution,
remotely exploitable. No assigned CVE number, yet.

Cheers,
-Hilko

-------------------- Start of forwarded message --------------------
From: <noreply@freshmeat.net>
To: <noreply@freshmeat.net>
Subject: [fmII] Serious security flaw in DokuWiki
Message-Id: <20060604183538.2D03648197@mail.freshmeat.net>
Date: Sun,  4 Jun 2006 11:35:38 -0700 (PDT)

This is an email sent to you by the owners of the freshmeat.net project
record for DokuWiki. All URLs and other useful information can be found
at

    http://freshmeat.net/projects/dokuwiki/

________________________| Subscriber message |_________________________

Sent by: Andreas Gohr 
         http://freshmeat.net/~agohr/

Hello everybody!

Bad news: Stefan Esser from the Hardened-PHP project found a security
problem in DokuWiki's spellchecking backend which allows insertion of
arbitrary PHP code. This is a serious flaw and you should fix this
immediatly.

Users who don't use the spellchecking feature can fix the bug by simply
deleting the lib/exe/spellcheck.php file.

Detailed infos on how to fix the problem properly are available at
http://bugs.splitbrain.org/?do=details&id=823

The package available for download at
http://www.splitbrain.org/go/dokuwiki was fixed for this bug and another
minor XSS bug described at http://bugs.splitbrain.org/?do=details&id=820

Regards,
Andi 
__________________________| End of message |___________________________

[...]

-------------------- End of forwarded message --------------------

Message #12 received at 370369@bugs.debian.org (full text, mbox, reply):

From: Matti Pöllä <mpo@iki.fi>

To: 370369@bugs.debian.org, 370785@bugs.debian.org

Subject: Fixes for 370369 and 370785 available

Date: Sun, 11 Jun 2006 01:08:31 +0300

[Message part 1 (text/plain, inline)]

Both of the recent security bugs have now been fixed in
dokuwiki_0.0.20060309-4 which will be uploaded (by a sponsor) soon. In
the meantime, the packages are available at

http://users.tkk.fi/~mpolla/debian/

cheers,

-Matti

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 370369-done@bugs.debian.org (full text, mbox, reply):

From: Matti Pöllä <mpo@iki.fi>

To: 370369-done@bugs.debian.org

Subject: done

Date: Fri, 16 Jun 2006 12:30:00 +0300

Version: 0.0.20060309-4

Send a report that this bug log contains spam.