Your message dated Fri, 28 Dec 2007 19:52:17 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#457446: fixed in typo3-src 4.0.2+debian-4
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: typo3-src
Version: 4.0.2+debian-3
Severity: grave
Tags: security
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for typo3-src.
CVE-2007-6381[0]:
| SQL injection vulnerability in the indexed_search system extension in
| TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote
| authenticated users to execute arbitrary SQL commands via unspecified
| vectors.
If you fix this vulnerability please also include the CVE id
in your changelog entry.
For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6381
Kind regards
Nico
--
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
pgp24ku0bbYLV.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: typo3-src
Source-Version: 4.0.2+debian-4
We believe that the bug you reported is fixed in the latest version of
typo3-src, which is due to be installed in the Debian FTP archive:
typo3-src-4.0_4.0.2+debian-4_all.deb
to pool/main/t/typo3-src/typo3-src-4.0_4.0.2+debian-4_all.deb
typo3-src_4.0.2+debian-4.diff.gz
to pool/main/t/typo3-src/typo3-src_4.0.2+debian-4.diff.gz
typo3-src_4.0.2+debian-4.dsc
to pool/main/t/typo3-src/typo3-src_4.0.2+debian-4.dsc
typo3_4.0.2+debian-4_all.deb
to pool/main/t/typo3-src/typo3_4.0.2+debian-4_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christian Welzel <[EMAIL PROTECTED]> (supplier of updated typo3-src package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sat, 22 Dec 2007 22:30:00 +0100
Source: typo3-src
Binary: typo3 typo3-src-4.0
Architecture: source all
Version: 4.0.2+debian-4
Distribution: stable-security
Urgency: high
Maintainer: Christian Welzel <[EMAIL PROTECTED]>
Changed-By: Christian Welzel <[EMAIL PROTECTED]>
Description:
typo3 - Powerful content management framework (Meta package)
typo3-src-4.0 - Powerful content management framework (Core)
Closes: 457446
Changes:
typo3-src (4.0.2+debian-4) stable-security; urgency=high
.
* Fixed security problem "SQL Injection in system extension indexed_search"
(CVE-2007-6381) with patch taken from 4.0.8. (Closes: 457446)
Files:
faf88b5c6ae931fb4ce919a9e8c501c4 902 web optional typo3-src_4.0.2+debian-4.dsc
be509391b0e4d24278c14100c09dc673 7683527 web optional
typo3-src_4.0.2+debian.orig.tar.gz
c88de483225fb01726b21b1c5c6754da 13795 web optional
typo3-src_4.0.2+debian-4.diff.gz
2004e720cca629d8e29c0689ad4ca5b8 76268 web optional
typo3_4.0.2+debian-4_all.deb
c7da1b1f0f98ce3e3ed98cf46fe71ba4 7686574 web optional
typo3-src-4.0_4.0.2+debian-4_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBR3T6qGz0hbPcukPfAQKSGAgApfNpe9WVLo3FKZksozIoTtic/b5ry7vp
nlETP8kYoTcqkM2HL5nQaPzG9JafnEicmoBO1GUoH4Iu1r0feAIr6/ZQ06jkDPEW
aIq1Z2U9oHGc7CKQ0vaPnrqlPNuvuSxSqO5jIyVpKfzk3gJ0+fb0wpfBZsYX4rZS
NokI8ZvU2nB8bIO2mvYKfnH8XEKtC6qBdOxy45Eyfz0PGo3lrqzbr+6R4Fanptbi
Ji6ez1LW2CQn842MJh8gA2hEhzYOraK1NjeGB9t44xoBe0Jg9xgwzpIQyPSAvUaL
t7aynAxy4/PRVEWEK42kneg/bZxdEbshQW0UbKYbUG0EDlzZh9i/qw==
=V+Mf
-----END PGP SIGNATURE-----
--- End Message ---
