Back Linuxsecurity Ubuntu 16.04 LTS SPIP Critical XSS SQL PHP Flaws USN-8150
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in SPIP. Software Description: - spip: website engine for publishing Details: It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform cross site scripting. (CVE-2022-28959) It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform PHP injection attacks. (CVE-2022-28960) It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform SQL injection attacks. (CVE-2022-28961)
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in SPIP. Software Description: - spip: website engine for publishing Details: It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform cross site scripting. (CVE-2022-28959) It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform PHP injection attacks. (CVE-2022-28960) It was discovered that SPIP did not properly sanitize certain inputs. A remote attacker could possibly use this issue to perform SQL injection attacks. (CVE-2022-28961)
The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS spip 3.0.21-1ubuntu1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS spip 3.0.21-1ubuntu1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
