Gentoo: 'gallery' cross-site scripting vulnerability
Cross-site scripting (XSS) vulnerability in search.php of Gallery 1.1through 1.3.4 allows remote attackers to insert arbitrary web script viathe searchstring parameter.
Summary
- - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200309-06 - - ---------------------------------------------------------------------
- - ---------------------------------------------------------------------
quote from cve:
"Cross-site scripting (XSS) vulnerability in search.php of Gallery 1.1 through 1.3.4 allows remote attackers to insert arbitrary web script via the searchstring parameter."
SOLUTION
It is recommended that all Gentoo Linux users who are running app-misc/gallery upgrade to gallery-1.3.4_p1 as follows:
emerge sync emerge gallery emerge clean
- - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at - - ---------------------------------------------------------------------
Resolution
References
Availability
Concerns
Severity
PACKAGE : gallery
SUMMARY : cross site scripting
DATE : 2003-09-02 11:11 UTC
EXPLOIT : remote
VERSIONS AFFECTED : =gallery-1.3.4_p1
CVE : CAN-2003-0614
Background
