Published:
02 April 2020
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1179
doxygen security and bug fix update
2 April 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: doxygen
Publisher: Red Hat
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2016-10245
Reference: ESB-2019.2199
ESB-2019.1989
ESB-2019.1960
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:1034
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Low: doxygen security and bug fix update
Advisory ID: RHSA-2020:1034-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1034
Issue date: 2020-03-31
CVE Names: CVE-2016-10245
=====================================================================
1. Summary:
An update for doxygen is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
3. Description:
Doxygen can generate an online class browser (in HTML) and/or a reference
manual (in LaTeX) from a set of documented source files. The documentation
is extracted directly from the sources. Doxygen can also be configured to
extract the code structure from undocumented source files.
Security Fix(es):
* doxygen: cross-site scripting in templates/html/search_opensearch.php
(CVE-2016-10245)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.8 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1483569 - Incorrect processing of code blocks in doxygen
1714190 - CVE-2016-10245 doxygen: cross-site scripting in templates/html/search_opensearch.php
6. Package List:
Red Hat Enterprise Linux Client Optional (v. 7):
Source:
doxygen-1.8.5-4.el7.src.rpm
x86_64:
doxygen-1.8.5-4.el7.x86_64.rpm
doxygen-debuginfo-1.8.5-4.el7.x86_64.rpm
doxygen-doxywizard-1.8.5-4.el7.x86_64.rpm
doxygen-latex-1.8.5-4.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
Source:
doxygen-1.8.5-4.el7.src.rpm
x86_64:
doxygen-1.8.5-4.el7.x86_64.rpm
doxygen-debuginfo-1.8.5-4.el7.x86_64.rpm
doxygen-doxywizard-1.8.5-4.el7.x86_64.rpm
doxygen-latex-1.8.5-4.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
doxygen-1.8.5-4.el7.src.rpm
ppc64:
doxygen-1.8.5-4.el7.ppc64.rpm
doxygen-debuginfo-1.8.5-4.el7.ppc64.rpm
ppc64le:
doxygen-1.8.5-4.el7.ppc64le.rpm
doxygen-debuginfo-1.8.5-4.el7.ppc64le.rpm
s390x:
doxygen-1.8.5-4.el7.s390x.rpm
doxygen-debuginfo-1.8.5-4.el7.s390x.rpm
x86_64:
doxygen-1.8.5-4.el7.x86_64.rpm
doxygen-debuginfo-1.8.5-4.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
doxygen-debuginfo-1.8.5-4.el7.ppc64.rpm
doxygen-doxywizard-1.8.5-4.el7.ppc64.rpm
doxygen-latex-1.8.5-4.el7.ppc64.rpm
ppc64le:
doxygen-debuginfo-1.8.5-4.el7.ppc64le.rpm
doxygen-doxywizard-1.8.5-4.el7.ppc64le.rpm
doxygen-latex-1.8.5-4.el7.ppc64le.rpm
s390x:
doxygen-debuginfo-1.8.5-4.el7.s390x.rpm
doxygen-doxywizard-1.8.5-4.el7.s390x.rpm
doxygen-latex-1.8.5-4.el7.s390x.rpm
x86_64:
doxygen-debuginfo-1.8.5-4.el7.x86_64.rpm
doxygen-doxywizard-1.8.5-4.el7.x86_64.rpm
doxygen-latex-1.8.5-4.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
doxygen-1.8.5-4.el7.src.rpm
x86_64:
doxygen-1.8.5-4.el7.x86_64.rpm
doxygen-debuginfo-1.8.5-4.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
doxygen-debuginfo-1.8.5-4.el7.x86_64.rpm
doxygen-doxywizard-1.8.5-4.el7.x86_64.rpm
doxygen-latex-1.8.5-4.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-10245
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXoObhtzjgjWX9erEAQj2vg//a85uxdSTjY92R5p4Nhzz5tFoXLaDsEp8
ePvZUlQpvAtkGLZMAqo25+GF1Dv0YP5tJhWHSLD+otl66VDybv/RmXjsOmS3+9/p
9CADSyx1ntkwzMBOsF8TTZAT5XMS1WSm6HnSwkk1lhSMay9ZoW07ZsPBRCzPBH68
K4DfZEcA4TsD2EIIC+Pj5xNH/WMIx46paU1mbryQnOl6U7LPcOjRn4JigXDO5m5a
cwSfYhIT50Ety1HLH9VG+3UflLvzfJNbvlr+rW9kazgxaLl7CxwsaGh6Xj7kB89B
l+Xnnri965ejEG4cEhq8bhutIgUgK3vpGMXmKKFe+NL/h3G0jySOShPOCIOY3gFT
VfJSD77dFDvbiT4yE87c2q+YMSqP03eNcTMi5vgYef+7TesU9ZN6d0briOuZ9I8u
6ptnh8A35zKwX+KA0wa/5e9GdlNuzTlxodogjZiPqaxiD9gj/JwP0YhY7vv2Cdtl
WWFCJhB0INT/PjOXMqAJf7xa+AaATByvhzK4y3dOR35KY1BXVHwzGgH0FfNdS76a
Mlqt4KjzIMxWxiV8oW5oMIn/+7/DcrjQf7mBlh7RzvyIksRjNHF/VBwClr4nBPDc
kCPIMvHxdrDQs9FmzAxjRoAQiiDTSUybAjthwnfJYEITkTa66Q7VzRP4+WxFBpwE
JOslzO4ehSs=
=AJVc
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXoV7tmaOgq3Tt24GAQiGxQ/9GB8ZKSNZkuShUB1CTRSJ70j3FnRUF74F
bZp/ezvy4U+9uLF5cAsVhtJZRTxCZ2ZVJ1p8adTysFnfCUMzORxJFY+4YdRzfc1W
fzfSdNfyQMu9MQdy6DHx4ErwZBKcCRmM9/sa41SGlrP8if8ojLtW1qrLLLXBBNA8
FYLJ/eJ5YR/sFoPQhVSQcYl1ns6SQb2sndf/xMEQ7qwmcp+WrTJsI1chiJn4+41C
KbmRt6IlV+o7bqslB7SZz+37iGJfYplMkp6+BsIILcLMn+eK37TqozH07aloP3mS
BRhMF4tJLdbG/ycMR8dgebwuLYjNXnGNiLqlQdgZJzvHKX/5v2VWyzUrTuj9CvCB
VSvnoPLpZJa7g1x9IP1zxihWm88ZuU/Uad5neCm+4UE2tUVWip9oztHm8xpWcSPB
yOAWDXpLsCVSFr8d2jz05SDoILDnLrqqrcCDqMwHVkttkK0S7zIQob0Gz2YmeemA
NNLk97OUrA7ff2tfYqSIuOHEkF9m1tttRcbL9VZquW+NxeJRTFka+DggVKbaPOSd
uket1WFpcbVu1c4KcDGRbXCuaN4XnYm7aigT9EzjLhFzKqsTWNa3qwc1zZfjX02S
SV6wKOoJd8uNgHRYFxPnkGj86WLcksaK6meoal5mkEaP9nvYf89KFXqme7NhSAVV
Nf2KSQ/7N8g=
=Jdg6
-----END PGP SIGNATURE-----