User: Password:
|
|
Subscribe / Log in / New account

Debian alert DSA-2387-1 (simplesamlphp)

From:  Thijs Kinkhorst <thijs@debian.org>
To:  debian-security-announce@lists.debian.org
Subject:  [SECURITY] [DSA 2387-1] simplesamlphp security update
Date:  Wed, 11 Jan 2012 19:48:14 +0100 (CET)
Message-ID:  <20120111184814.9D49859981@kinkhorst.com>
Archive-link:  Article, Thread

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2387-1 security@debian.org http://www.debian.org/security/ Thijs Kinkhorst January 11, 2012 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : simplesamlphp Vulnerability : insufficient input sanitation Problem type : remote Debian-specific: no timtai1 discovered that simpleSAMLphp, an authentication and federation platform, is vulnerable to a cross site scripting attack, allowing a remote attacker to access sensitive client data. The oldstable distribution (lenny) does not contain a simplesamlphp package. For the stable distribution (squeeze), this problem has been fixed in version 1.6.3-3. For the unstable distribution (sid), this problem has been fixed in version 1.8.2-1. We recommend that you upgrade your simplesamlphp packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJPDdkuAAoJEOxfUAG2iX57HB0H/jMz8Q0ihRk45qfXlJoOYZK9 QlpCWWB0U3bYTMHI0xAMXYa46+iSoD1he+xnsiXjuqBWox0XuRjDWItIjz71W7nQ oMG5j288dwo8euyo+wnaAEPSUcJBAEMH3b7ZGYLh/AF1Bp2thZ0I4o29irmynZY/ eKIx7Hukwsony1m+czw0ouUv47ZfRchFtQUyDNBqMOIWhDdpf5JNPP22QBPWL+hQ UWQEUDygvNx8dsUMyv5XsWg8//ErC55a7wjzPgCM/ekC5960QLxPFTZgmXWkNO0e S5MfXkiFY78cV184gbulDmeZ3cSgJCX9f0hehP4JNvuslJXRBWrY6NgFx1wEVaA= =JllB -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org Archive: http://lists.debian.org/20120111184814.9D49859981@kinkhor...


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds