[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#453278: marked as done (CVE-2007-6110: XSS in htsearch)

Your message dated Sun, 02 Dec 2007 10:02:03 +0000
with message-id <E1IyleF-0005o3-Mt@ries.debian.org>
and subject line Bug#453278: fixed in htdig 1:3.2.0b6-4
has caused the attached Bug report to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere.  Please contact me immediately.)

Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message --- 
Package: htdig
Version: 1:3.2.0b6-3.1
Severity: important
Tags: security

Hi

The following CVE[0] has been issued against htdig.

CVE-2007-6110:

Cross-site scripting (XSS) vulnerability in htsearch in htdig 3.2.0b6
allows remote attackers to inject arbitrary web script or HTML via the
sort parameter.

Please mention the CVE id number in your changelog, when you fix the
problem.

Cheers
Steffen

[0]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6110

--- End Message ---
--- Begin Message --- 
Source: htdig
Source-Version: 1:3.2.0b6-4

We believe that the bug you reported is fixed in the latest version of
htdig, which is due to be installed in the Debian FTP archive:

htdig-doc_3.2.0b6-4_all.deb
  to pool/main/h/htdig/htdig-doc_3.2.0b6-4_all.deb
htdig_3.2.0b6-4.diff.gz
  to pool/main/h/htdig/htdig_3.2.0b6-4.diff.gz
htdig_3.2.0b6-4.dsc
  to pool/main/h/htdig/htdig_3.2.0b6-4.dsc
htdig_3.2.0b6-4_i386.deb
  to pool/main/h/htdig/htdig_3.2.0b6-4_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 453278@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steffen Joeris <white@debian.org> (supplier of updated htdig package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 02 Dec 2007 08:21:04 +0000
Source: htdig
Binary: htdig htdig-doc
Architecture: source i386 all
Version: 1:3.2.0b6-4
Distribution: unstable
Urgency: high
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Steffen Joeris <white@debian.org>
Description: 
 htdig      - WWW search system for an intranet or small internet
 htdig-doc  - Documentation for the htdig package
Closes: 453278
Changes: 
 htdig (1:3.2.0b6-4) unstable; urgency=high
 .
   * QA upload by the testing-security team
   * Fix XSS in htsearch by not displaying the sort type in
     htsearch/Display.cc and libhtdig/ResultFetch.cc anymore, if it is
     unrecognised (Closes: #453278) Thanks to William Grant
     Fixes: CVE-2007-6110
Files: 
 51203989aa308590710757d0d8c6a998 602 web optional htdig_3.2.0b6-4.dsc
 9a4df1dc1ebf2207a133ac945429bdc6 86277 web optional htdig_3.2.0b6-4.diff.gz
 dd6480852932d671cbc6cdd7c553267e 528280 doc optional htdig-doc_3.2.0b6-4_all.deb
 702ffd38a3ca1964f8a3e3e4db1a5e00 1874888 web optional htdig_3.2.0b6-4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHUn/Z62zWxYk/rQcRArf0AKC2W55omBZrgteLAY4dH6pehHoN9ACfeL8k
pXutxnJUQbcnV5AiwAVdHLo=
=Dmoy
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: