[SECURITY] [DSA 1389-1] New zoph packages fix SQL injection

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

• -------------------------------------------------------------------------- Debian Security Advisory DSA 1389-1 security@debian.org http://www.debian.org/security/ Thijs Kinkhorst October 18th, 2007 http://www.debian.org/security/faq
• --------------------------------------------------------------------------

Package        : zoph
Vulnerability  : missing input sanitising
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2007-3905
Debian Bug     : 435711

It was discovered that zoph, a web based photo management system, performs insufficient input sanitising, which allows SQL injection.

For the oldstable distribution (sarge) this problem has been fixed in version 0.3.3-12sarge2.

For the stable distribution (etch) this problem has been fixed in version 0.6-2.1etch1.

For the unstable distribution (sid) this problem has been fixed in version 0.7.0.2-1.

We recommend that you upgrade your zoph package.

Upgrade Instructions

- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.debian.org Links debian-announce debian-apache debian-arm-changes debian-beowulf debian-boot debian-cd debian-cd-vendors debian-changes debian-changes-digest debian-isp debian-kde debian-laptop debian-mirrors-announce debian-news debian-security debian-security-announce debian-testing debian-user debian-user-digest Request more information about Pantek

apt-get update

        will update the internal database apt-get upgrade

        will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

- --------------------------------

  Source archives:

    
http://security.debian.org/pool/updates/main/z/zoph/zoph_0.3.3-12sarge1.dsc
      Size/MD5 checksum:      570 ce9957fa5af8115a5aec530aabe6847f
    
http://security.debian.org/pool/updates/main/z/zoph/zoph_0.3.3-12sarge1.diff.gz
      Size/MD5 checksum:    53959 7c37d28798981a054c634cca92122199
    
http://security.debian.org/pool/updates/main/z/zoph/zoph_0.3.3.orig.tar.gz
      Size/MD5 checksum:   153902 5ff9d8e182e16d53e0511b6d51da8521

  Architecture independent components:

    http://security.debian.org/pool/updates/main/z/zoph/zoph_0.3.3-12sarge1_all.deb       Size/MD5 checksum: 172190 a185b3cba99ea4bc0f46c73b68bb5a46

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.debian.org Links debian-announce debian-apache debian-arm-changes debian-beowulf debian-boot debian-cd debian-cd-vendors debian-changes debian-changes-digest debian-isp debian-kde debian-laptop debian-mirrors-announce debian-news debian-security debian-security-announce debian-testing debian-user debian-user-digest Request more information about Pantek

Debian GNU/Linux 4.0 alias etch

- -------------------------------

  Source archives:

    
http://security.debian.org/pool/updates/main/z/zoph/zoph_0.6-2.1etch1.dsc
      Size/MD5 checksum:      850 a7bf5364534ae9fb38ba70dcc371e8c6
    
http://security.debian.org/pool/updates/main/z/zoph/zoph_0.6-2.1etch1.diff.gz
      Size/MD5 checksum:    25826 c716e920cb6c9b19941af6359ecc697d
    
http://security.debian.org/pool/updates/main/z/zoph/zoph_0.6.orig.tar.gz
      Size/MD5 checksum:   382577 7e139b32bd477cccf43454cb4c07c16d

  Architecture independent components:

    http://security.debian.org/pool/updates/main/z/zoph/zoph_0.6-2.1etch1_all.deb       Size/MD5 checksum: 394268 147f75305b9b891fb2ab502a94be3e9e

  These files will probably be moved into the stable distribution on   its next update.

• --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
  -----BEGIN PGP SIGNATURE-----
  Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHF8RmXm3vHE4uyloRAg2WAKDcWvMUaZf1ahtha4yGGnBLN2bSFwCcCKcw Z8I79ybTvjkGwBp2wveTmlA=
=Cikh
-----END PGP SIGNATURE-----

-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org