UbuntuUpdates.org


AllMaverickLucidKarmicJauntyIntrepidHardyAll PPAs
Recent Search QueriesSearch Statistics

Package moin

Name: moin

Description:

This package is just an umbrella for a group of other packages, it has no description. Please select a package in "Packages in group" for more information.
Latest version: 1.7.1-1ubuntu1.5
Ubuntu release: intrepid (8.10)
Level: security
Repository: main

All versions of moin in Intrepid

security (this page) base updates
1.7.1-1ubuntu1.5 1.7.1-1ubuntu1 1.7.1-1ubuntu1.5

See all versions of moin in all Ubuntu releases and repositories.

Links

Packages in group

python-moinmoin

Change Log

Version: 1.7.1-1ubuntu1.5 2010-04-08 17:02:00 UTC 
moin (1.7.1-1ubuntu1.5) intrepid-security; urgency=low

  * SECURITY UPDATE: fix XSS in Despam action
    - debian/patches/30006_CVE-2010-0828.patch: use wikiutil.escape()
      in revert_pages()
    - CVE-2010-0828
  * SECURITY UPDATE: fix bypass of textcha protection
    - debian/patches/30007_CVE-2010-1238.patch: make sure the question and
      answer form fields are filled in
    - CVE-2010-1238

 -- Jamie Strandboge   Tue, 30 Mar 2010 13:53:34 -0500
Source diff to previous version
CVE-2010-0828 Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote authenticated users
CVE-2010-1238 MoinMoin 1.7.1 allows remote attackers to bypass the textcha protection mechanism by modifying the textcha-question and textcha-answer fields to have

Version: 1.7.1-1ubuntu1.3 2010-03-12 01:01:39 UTC 
moin (1.7.1-1ubuntu1.3) intrepid-security; urgency=low

  * SECURITY UPDATE: fix multiple CSRF vulnerabilities
    - debian/patches/30004_CVE-2010-0668+0717.patch: add tickets to prevent
      CSRF attacks in several components. Also required backporting fix for
      "Mail account data" does not send mails.
    - CVE-2010-0668
  * SECURITY UPDATE: properly sanitize user profiles
    - debian/patches/30005_CVE-2010-0669.patch: adjust userprefs/prefs.py,
      user.py and wikiutil.py to sanitize input
    - CVE-2010-0669

 -- Jamie Strandboge   Tue, 02 Mar 2010 10:10:42 -0600
CVE-2010-0668 Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related t
CVE-2010-0669 MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.


About   -   Changelog   -   Send Feedback