—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

– ————————————————————————-
Debian Security Advisory DSA-3715-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
November 15, 2016 https://www.debian.org/security/faq
– ————————————————————————-

Package : moin
CVE ID : CVE-2016-7146 CVE-2016-7148 CVE-2016-9119
Debian Bug : 844338 844340 844341

Several cross-site scripting vulnerabilities were discovered in moin, a
Python clone of WikiWiki. A remote attacker can conduct cross-site
scripting attacks via the GUI editor’s attachment dialogue
(CVE-2016-7146), the AttachFile view (CVE-2016-7148) and the GUI
editor’s link dialogue (CVE-2016-9119).

For the stable distribution (jessie), these problems have been fixed in
version 1.9.8-1+deb8u1.

We recommend that you upgrade your moin packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
—–BEGIN PGP SIGNATURE—–

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlgrajdfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SuuQ/+Jd3pOMWp2iU2LFS9yxvEp0g6aHTZKNUByrv6j7ISfKVQShBj2XSpFsW+
GCwvjdRmmPf7+xjstO/7jr9YBDPoVU16AzJICmArkymcWa9VPMXEQHU2Sjo3Gnbf
D7GE9O8AjCD3LjlBPbb++Od2HXjdWpw3REJjifLCJh5Obab3MaSMwzbgzA7zhxnw
9KRtZEy6wKfGbIz9ognppFJdgbXOdt56WWREYJcL2k6QITubXR4dXUkEX5Mk+Bul
ACJz4z5Exj358FY9E8mi85/2PAZsc5uKm25uW06sjN9OFuDfU3aeGpugXwq93qGO
HDroRAdanBihUmaLoGjtO4GmyofDS5O4Ymex94KqOoFt0XxDX6YfljIKEJejdiR5
ByNC49YfxuCT0gjTA2PGZLahWF+KgeIhwUKCf/T+WlhY1/QzJRvf2JaeB+bsJGHx
fliuFrlRbVdoSEUyN7Ia1cLZoJrSfcwKMzqRkwRmT4rPeACabN1/P60zB/7NIHhc
eMFvz8OlCZXd0xIjN7CWQp6xL27zt+NaZi2fxC+BT2d+4GKIumyz1AIt3ipQnFXF
KXQVJhDuoTQ50xm0sst0t+uArRV+3hmfuLBewducvSsp7IYH5zaEo6WQNy4A4+da
sSncTop5cNWhwRlNuzHPRi0pJJiNtH2vgR0+Axum2oeOyKH87c8=
=p6am
—–END PGP SIGNATURE—–