Gallery 1.4.4-pl4 Security Release
Jay Rossiter / Signe <[email protected]> Wed, 03 Nov 2004 12:00:38 -0800
| Newsgroups | gmane.comp.web.gallery.announce |
|---|---|
| Message-ID | <[email protected]> |
--=====================_6485455==.ALT Content-Type: text/plain; charset="us-ascii"; format=flowed EDIT: This release is a replacement for 1.4.4-pl3 which had an issue discovered shortly after release. Jim Paris discovered a few security problems in Gallery which have been addressed in 1.4.4-pl4. The primary problem is a cross site scripting vulnerability which allows code to be inserted into a Gallery by using specially formed URLs. This code then appears to be part of the Gallery. No risk is posed to the webserver-itself or any non-Gallery data, but a Gallery install could be compromised using appropriate code. All Gallery users are very strongly urged to upgrade to 1.4.4-pl4 immediately, which fixes this serious problem and will secure your system. Gallery 1.4.4-pl3 can be downloaded from the <http://sourceforge.net/project/showfiles.php?group_id=7130>Gallery Download Page. --- Lead Developer, Gallery v1.x http://gallery.menalto.com http://www.sourceforge.net/projects/gallery --=====================_6485455==.ALT Content-Type: text/html; charset="us-ascii" <html> <body> <b>EDIT: This release is a replacement for 1.4.4-pl3 which had an issue discovered shortly after release.<br><br> </b>Jim Paris discovered a few security problems in Gallery which have been addressed in <b>1.4.4-pl4</b>. The primary problem is a cross site scripting vulnerability which allows code to be inserted into a Gallery by using specially formed URLs. This code then appears to be part of the Gallery.<br><br> No risk is posed to the webserver-itself or any non-Gallery data, but a Gallery install could be compromised using appropriate code.<br><br> All Gallery users are <i>very strongly urged</i> to upgrade to 1.4.4-pl4 immediately, which fixes this serious problem and will secure your system.<br><br> Gallery 1.4.4-pl3 can be downloaded from the <a href="http://sourceforge.net/project/showfiles.php?group_id=7130"> Gallery Download Page</a>. <br><br> <x-sigsep><p></x-sigsep> ---<br> Lead Developer, Gallery v1.x<br> <a href="http://gallery.menalto.com/" eudora="autourl"> http://gallery.menalto.com<br> </a> <a href="http://www.sourceforge.net/projects/gallery" eudora="autourl"> http://www.sourceforge.net/projects/gallery<br> </a></body> </html> --=====================_6485455==.ALT-- ------------------------------------------------------- This SF.Net email is sponsored by: Sybase ASE Linux Express Edition - download now for FREE LinuxWorld Reader's Choice Award Winner for best database on Linux. http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click __[ g a l l e r y - a n n o u n c e ]_________________________ [ list info/archive --> http://gallery.sf.net/lists.php ] [ gallery info/FAQ/download --> http://gallery.sf.net ]