Bugtraq mailing list archives
[SECURITY] [DSA 2359-1] mojarra security update
From: Florian Weimer <fw () deneb enyo de>
Date: Tue, 06 Dec 2011 20:59:12 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2359-1 security () debian org http://www.debian.org/security/ Florian Weimer December 06, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : mojarra Vulnerability : EL injection Problem type : remote Debian-specific: no CVE ID : CVE-2011-4358 It was discovered that Mojarra, an implementation of JavaServer Faces, evaluates untrusted values as EL expressions if includeViewParameters is set to true. For the stable distribution (squeeze), this problem has been fixed in version 2.0.3-1+squeeze1. For the testing distribution (wheezy) and the unstable distribution (sid), this problem has been fixed in version 2.0.3-2. We recommend that you upgrade your mojarra packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce () lists debian org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iQEcBAEBAgAGBQJO3nfRAAoJEL97/wQC1SS+yh0H/3xr1x659eOAxJNQuFqqp6k/ ffDYvowL4FCietuFtVWJW9mYaI/KR3MveQiWrWfSd8WOp881qVuPHa327YTDjjQr 6c+IafCKvlySZ+Jq8oWXdLvIVjKQTLZ60itDLzI7afDhRl0wTm/JOV409D+uFY91 4Ng/289txmbLFEO6+FYvBX16cymmhoupnnk112aUpNNXzAfiDzUzeejOEKwUEa6+ zBIJtDKY4Il05x6VSWARjqKGBfRdVhReStnkj44v37mJCUZxg48MO4clB9JdG/0C s6vbz6eql/Jez2ywC7N/5JeDD6nNlvraCQ6Df7bFzcC3QEqGIknV/95rVYCxRdg= =SviP -----END PGP SIGNATURE-----
Current thread:
- [SECURITY] [DSA 2359-1] mojarra security update Florian Weimer (Dec 06)