Bug#696670: unblock: mahara/1.5.1-3.1
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
Please unblock package mahara
It provides a fix, cherry-picked from upstream repository, for a XSS
vulnerability as described in bug #695789
unblock mahara/1.5.1-3.1
-- System Information:
Debian Release: 7.0
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-4-amd64 (SMP w/8 CPU cores)
diff -Nru mahara-1.5.1/debian/changelog mahara-1.5.1/debian/changelog
--- mahara-1.5.1/debian/changelog 2012-11-16 09:33:12.000000000 +0100
+++ mahara-1.5.1/debian/changelog 2012-12-23 15:02:25.000000000 +0100
@@ -1,3 +1,14 @@
+mahara (1.5.1-3.1) unstable; urgency=high
+
+ * Non-maintainer upload.
+ * SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
+ which allowed remote attackers to inject arbitrary web script or
+ HTML via the query parameter.
+ - debian/patches/CVE-2012-2253.patch
+ - Closes: #695789
+
+ -- Luca Falavigna <dktrkranz@debian.org> Sun, 23 Dec 2012 14:53:41 +0100
+
mahara (1.5.1-3) unstable; urgency=high
* SECURITY UPDATE: Disable XML entity parsing to prevent XEE
diff -Nru mahara-1.5.1/debian/patches/CVE-2012-2253.patch mahara-1.5.1/debian/patches/CVE-2012-2253.patch
--- mahara-1.5.1/debian/patches/CVE-2012-2253.patch 1970-01-01 01:00:00.000000000 +0100
+++ mahara-1.5.1/debian/patches/CVE-2012-2253.patch 2012-12-23 15:02:25.000000000 +0100
@@ -0,0 +1,24 @@
+Author: Hugh Davenport <hugh@catalyst.net.nz>
+Subject: Cross-site scripting (XSS) vulnerability
+Origin: upstream
+Bug: https://bugs.launchpad.net/mahara/+bug/1079498
+
+ CVE-2012-2253
+
+ Cross-site scripting (XSS) vulnerability which allowed remote
+ attackers to inject arbitrary web script or HTML via the query
+ parameter.
+
+Index: mahara/htdocs/lib/web.php
+===================================================================
+--- mahara.orig/htdocs/lib/web.php 2012-12-23 14:44:57.009756577 +0100
++++ mahara/htdocs/lib/web.php 2012-12-23 14:47:02.405760418 +0100
+@@ -3273,7 +3273,7 @@
+ }
+ else {
+ $return .= '">'
+- . '<a href="' . $url . '" title="' . $title
++ . '<a href="' . hsc($url) . '" title="' . $title
+ . '">' . $text . '</a></span>';
+ }
+
diff -Nru mahara-1.5.1/debian/patches/series mahara-1.5.1/debian/patches/series
--- mahara-1.5.1/debian/patches/series 2012-11-16 09:32:59.000000000 +0100
+++ mahara-1.5.1/debian/patches/series 2012-12-23 15:02:25.000000000 +0100
@@ -10,3 +10,4 @@
CVE-2012-2244-0003.patch
CVE-2012-2246.patch
CVE-2012-2247.patch
+CVE-2012-2253.patch
Reply to: