Security Information / 2012 / Security Information -- DSA-2537-1 typo3-src

Debian Security Advisory

DSA-2537-1 typo3-src -- several vulnerabilities

Date Reported:

30 Aug 2012

Affected Packages:

typo3-src

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2012-3527, CVE-2012-3528, CVE-2012-3529, CVE-2012-3530, CVE-2012-3531.

More information:

Several vulnerabilities were discovered in TYPO3, a content management system.

• CVE-2012-3527

  An insecure call to unserialize in the help system enables arbitrary code execution by authenticated users.

• CVE-2012-3528

  The TYPO3 backend contains several cross-site scripting vulnerabilities.

• CVE-2012-3529

  Authenticated users who can access the configuration module can obtain the encryption key, allowing them to escalate their privileges.

• CVE-2012-3530

  The RemoveXSS HTML sanitizer did not remove several HTML5 JavaScript, thus failing to mitigate the impact of cross-site scripting vulnerabilities.

For the stable distribution (squeeze), these problems have been fixed in version 4.3.9+dfsg1-1+squeeze5.

For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 4.5.19+dfsg1-1.

We recommend that you upgrade your typo3-src packages.