Home / vulnerabilities

PDF

Mandriva Linux Security Advisory 2013-134

Posted on 12 April 2013
Source : packetstormsecurity.org Link

 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:134
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : viewvc
Date : April 10, 2013
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated viewvc packages fix security vulnerabilities:

complete authz support for remote SVN views (CVE-2012-3356).

log msg leak in SVN revision view with unreadable copy source
(CVE-2012-3357).

function name lines returned by diff are not properly escaped,
allowing attackers with commit access to perform cross site scripting
(CVE-2012-4533).

Several other bugs were fixed as well.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4533
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4533
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3356
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3357
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0175
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0313
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
d900d58ae8a5e685e8f27e9128fb729c mbs1/x86_64/viewvc-1.1.15-1.mbs1.noarch.rpm
b698ff35163bcbf10395e045745cfa8d mbs1/SRPMS/viewvc-1.1.15-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFRZV9CmqjQ0CJFipgRAvPNAKDL0FC3Os70ufcLz/Nc/g+eqpwpewCg11YC
aVLLi26g3LhesXY/86iTVJY=
=1pQl
-----END PGP SIGNATURE-----

 

TOP