Debian Security Advisory
DSA-910-1 zope.2.7 -- design error
- Date Reported:
- 24 Nov 2005
- Affected Packages:
- zope2.7
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 334055.
In Mitre's CVE dictionary: CVE-2005-3323. - More information:
-
A vulnerability has been discovered in zope 2.7, an Open Source web application server, that allows remote attackers to insert arbitrary files via include directives in reStructuredText functionality.
The old stable distribution (woody) does not contain zope2.7 packages.
For the stable distribution (sarge) this problem has been fixed in version 2.7.5-2sarge1.
For the unstable distribution (sid) this problem has been fixed in version 2.7.8-1.
We recommend that you upgrade your zope2.7 package.
- Fixed in:
-
Debian GNU/Linux 3.1 (sarge)
- Source:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1.dsc
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1.diff.gz
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5.orig.tar.gz
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1.diff.gz
- Alpha:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/z/zope2.7/zope2.7_2.7.5-2sarge1_sparc.deb
MD5 checksums of the listed files are available in the original advisory.