Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2610
dojo security update
4 September 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: dojo
Publisher: Debian
Operating System: Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-15494
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2018/09/msg00002.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running dojo check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : dojo
Version : 1.10.2+dfsg-1+deb8u1
CVE ID : CVE-2018-15494
Debian Bug : #906540
It was discovered that there was a string injection vulnerability in
the "dojo" Javascript library.
For Debian 8 "Jessie", this issue has been fixed in dojo version
1.10.2+dfsg-1+deb8u1 by Abhijith PA.
We recommend that you upgrade your dojo packages.
Regards,
- - --
,''`.
: :' : Chris Lamb
`. `'` lamby@debian.org / chris-lamb.co.uk
`-
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAluM55MACgkQHpU+J9Qx
HljW0g//Rb9amaKVT0tNpkzhkIHWzzGvDq4qOu7C0063LJoNUlMzjN2NVKE1Gand
Bw5W/ro1OqaHvbdas12IVnw1K/XtTKn8fD0LogLuOSrdEzyTBJdnqm1f29c1JClx
8TtO32SCtk8BiDC/TzSCqojVWbPhUdvTHGG1rCH6/l0jGvU3WnXfAaEQHAk62DLR
fLgXHIPETK8crZb9EgCYbK/+PnJXHM5SKuhU3obUSvsNQByWdIPb7itJRRF/+1Ov
n9gCwG4cQNi2Y8+76FfQQdELNDziZDPrpVb0CioI7Rdk5/pmaFwqohYtu4cPSfTa
63GnnRQHnbKfE7C0Y1uIHFJD9cvgNbbNouFLsKPwQJEkUuCTVI1uScZfrsqRva1z
v2T/Gzk1jKWV5gUGHJNzQ0bslCWcKrPr/5eNJ8pOuRA0y3uesb9Xs2REUdq2Nuk2
NPuJ/AWZyAQMVbi7ifYLVpUJktF5OcurjkYZ3YAvn72dM6YjNABjsC19b+FbH3rw
JyB374xclswNGC+HBfQNihYRtVEd6ucaTd218HMxtNMs5pD3l2R4vjIHNTRg9Ta/
2IkRWFJ6uRkb97FaEZQLkou0CgPVOc5Y1NGYf82uAu1t2O3GSv6VciXhQonBp40+
7xDluCZEbTDDQHaRq2gLiAhNIAo82Ka25X4YCayNN89qFu/ChMg=
=9d0p
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW43U0maOgq3Tt24GAQjrPxAAid3X3UxfjSW5p0MsUKNG1XWMNyQwmqr+
2qvozQGn4qMSAaJnWhJOTujZMPHK9b3CqPnN5zitHz2EoS7FlBorr1kwQkW7ow0B
UIWxjf5WHbmWF5YhJsQdza45uQeH2kWj0BAhROAfOjVFZt4WQeNgPLacec9Z3QuD
t8K9t31fjncDX3Yj73nzCb3oVoXpyl1IiEkdBvsacA0exdW4xAzJf9+bJfFQp9+Z
CgQeyzkt4GcNfSbjKw+3QMo0MCQWYKmcoAwkTyjD4IVEhz+pG89LKDqCHDLB6Fh3
cJFIMEk5TKBcYL1LHcUUYIor4unUT44YKXsxKDACzUdu0OFICc+MFoEZGrI3wlWA
giXwtB0kSrihxF5rTal8IcvJyJ5M3sZGHL561pOWwc/xHkfARfrIFN6FXd9xpfxQ
5CyD+beWj0mm6RH/U4IDhU6XZn3BUc5lW+9+TnX+45ELwlnGM7QFPlyJbcTZDC7s
G1t1xAeeAb1KbcOajomGw33gvTHA8aQw9uJ40XKESwDjlkFyaDNVYFXEZqU4MsZm
3n+KBKHz7ef8F2SBP6pfhfpdVQdBixXxB67R7Rt50XuGziXPqAcQ9s1kPHn4D+Fr
1N0Vf3AigWzCmBLCs7TTmyWc57GT97VOnsPuRg1MrEKiKkav/o7fQ+ix32fJSlYf
Ovd5C3v67BA=
=E9bF
-----END PGP SIGNATURE-----