copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2016.0774 - [Win][UNIX/Linux][Virtual][Debian] redmine: Multiple vulnerabilities

Date: 24 March 2016

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0774
                          redmine security update
                               24 March 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           redmine
Publisher:         Debian
Operating System:  Debian GNU/Linux 8
                   Windows
                   UNIX variants (UNIX, Linux, OSX)
                   Virtualisation
Impact/Access:     Provide Misleading Information -- Remote with User Interaction
                   Access Confidential Data       -- Unknown/Unspecified         
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-8537 CVE-2015-8474 CVE-2015-8473
                   CVE-2015-8346  

Original Bulletin: 
   http://www.debian.org/security/2016/dsa-3529

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running redmine check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3529-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
March 23, 2016                        https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : redmine
CVE ID         : CVE-2015-8474 CVE-2015-8346 CVE-2015-8473 CVE-2015-8537

Multiple vulnerabilities have been found in Redmine, a project management
web application, which may result in information disclosure.

For the stable distribution (jessie), these problems have been fixed in
version 3.0~20140825-8~deb8u2.

For the testing distribution (stretch), these problems have been fixed
in version 3.2.0-1.

For the unstable distribution (sid), these problems have been fixed in
version 3.2.0-1.

We recommend that you upgrade your redmine packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW8uVgAAoJEBDCk7bDfE42nt4P/0EUWgr0adBws5M87SeRiklg
P9EOlzLaEv/pQdV44WF3EZBhsgYIQ6LxQetrkA9r94YUmIYzSI7J8F70w65rb3gG
HPA17IG00Q+jbnKl33NqSGwuIFTne7HkMJlruHvzUIyQGNC/aG3CefSU/QKYi27D
hrdSHgErolbvsSxRoU8SUeysrPwvIv9DwEDErwnYw3fWEnJgveLP8QxlpV8pz70E
sI8o5DXQPp2zOdWEY7l3IEj6kW9jI4zHs9aLULUQP4ezfvmoY8ZS04iXvyfV3FHy
+SxNl1ZRPaAVntafYPyPzS6KEOy0JXfIxWjCmLlj3IfDxrAiNH3vri0sWfPQsWTS
9gKepKGsjPrphrw333ypkjEu0LTmO0mgggr25ZIUfYFgvLMe8tg+fIMOHTdZY9S5
BGs+HjZ0c0cPYqGZwF/zPm5Fm/vmj7ZpJez5PxT1977CAhU683pMGdcSObmDqyzf
thUEE6BwA1jtIObQEHmWovPfbZuLQRLujWAnx92bMJnJducnX3weyGMYcQDqkCJE
Dhq9XuSYxoKFGZ6UR4PyhKGht0RWnq6yWI2HBbJPx/kIgeV3Y5wqLRQWOqIOsJsI
nZKEKndzJvUOK65E1Wt9uN3QmDIlj58i7htXWX1dTI6w7QKeH0vLsyoyLTVnQDjw
V16uyghxWkvJ+Aj1482h
=uCSc
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVvMxGX6ZAP0PgtI9AQKjbQ//Woo52jAvkXHuQvyr2yFBTGG3yLnsi99D
EnfwysSQvgYvDXPygm/Osk/FTc0fq+9+vmpHwPX/ZJi636Ab4ugh/RZFph5oVHUP
6cSZEhY2cZlJ/ZJJJK3wWBI0PGH+vBN8s9L8ID3K2Ys6WzaHBxKHmrDD/At5EEGB
1wnakU1NsU89OJgIa9bRdwVCb0XAS5vkwJeoJEw7uoKXG6uNhKYgYO9CUzf0LAMs
PhP4DQx4SYaJRGOzT7sw8GfanMklzkViYaSF0kocwbtVa/nKHrrxDlkfZ6BZIhgN
1IE5JSbUW0fSh8KTYlcjAOg1jqJ5cD2co6ixYTRKrN7GGLBGFQ6maEXmvfXrvR0H
2aLI22iDbozrLtiyFu68ynNcOQTQNM6XPDwz/KyCAhJOuyVaDEdHtZ0EsGKZnO0m
iZGSI6I/JR2nSx5pQFUDBFqA0WaZkoehT0ow3W9Z+JpnW6dO0LLWxgEiZlu1h1od
nXtv5XbxaZCsTOSFFGs69BGZnP94xpcvm9LUcFne/61iTi2s+iyoo1gYohzM0axY
VLXKWe42u+fKDj810myXxyBY65lsYzsQY9q64LmZ/Lhy2R9WXY5VnQyIbGNDvLUA
oK6bWnyT5YCVaB7DCpuL21mfTPwwvsNBz52CA4/zqYZyxgAsXv1IxWDljfMOd3cK
UW6bfaDuhGg=
=5N9A
-----END PGP SIGNATURE-----