UbuntuUpdates.org

Package "spip"

Name: spip

Description:

website engine for publishing
Latest version: 3.2.7-1ubuntu0.1
Release: focal (20.04)
Level: security
Repository: universe
Homepage: https://www.spip.net/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "spip"

All arch deb package
APT INSTALL

Other versions of "spip" in Focal

Repository Area Version
base universe 3.2.7-1
updates universe 3.2.7-1ubuntu0.1

Changelog

Version: 3.2.7-1ubuntu0.1 2023-03-02 13:07:08 UTC

  spip (3.2.7-1ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: Cross Site Scripting (XSS)
    - debian/patches/CVE-2021-44118-1.patch: validate URLs
      before making a copy of a remote document.
    - debian/patches/CVE-2021-44118-2.patch: improve and
      add several checks over the domain.
    - debian/patches/CVE-2021-44120-1.patch: fix escaping
      SQL function query_echappe_textes.
    - debian/patches/CVE-2021-44120-2.patch: simply and fix
      regex in query_echappe_textes.
    - debian/patches/CVE-2021-44120-3.patch: only escape
      text on the first call of _mysql_traite_query.
    - debian/patches/CVE-2021-44120-4.patch: protect nom_site
      and bio from being modified by using safehtml.
    - CVE-2021-44120
    - CVE-2021-44118
  * SECURITY UPDATE: Cross Site Request Forgery (CSRF)
    - debian/patches/CVE-2021-44122-1.patch: refactor and
      add signature to form fields.
    - debian/patches/CVE-2021-44122-2.patch: replace function
      when handling signatures.
    - debian/patches/CVE-2021-44122-3.patch: increment
      spip_version_code, needed to regenerate forms.
    - debian/patches/CVE-2021-44122-4.patch: fix comment,
      reenable deprecated function.
    - CVE-2021-44122
  * SECURITY UPDATE: Remote code execution
    - debian/patches/CVE-2021-44123.patch: handle multiple
      file extensions and remove the ones that are not allowed.
    - CVE-2021-44123

 -- David Fernandez Gonzalez <email address hidden> Wed, 01 Mar 2023 12:07:07 +0100
CVE-2021-44118 SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. Th
CVE-2021-44120 SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable
CVE-2021-44122 SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/
CVE-2021-44123 SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a d


About   -   Send Feedback to @ubuntu_updates