diff --git a/debian/changelog b/debian/changelog index 29e3f10..82081bb 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,6 @@ -cacti (0.8.8b+dfsg-5ubuntu0.1) trusty-security; urgency=medium +cacti (0.8.8b+dfsg-8+deb8u1) jessie-security; urgency=high - * Security update (LP: #1210822): + * Security update - CVE-2015-2665 Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. @@ -11,17 +11,41 @@ cacti (0.8.8b+dfsg-5ubuntu0.1) trusty-security; urgency=medium 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. - Unassigned CVE SQL injection VN:JVN#78187936 / TN:JPCERT#98968540 - - CVE-2014-5261 Unsufficient input sanitation leads to shell command - injection possibilities - - CVE-2014-5262 Incomplete and incorrect input parsing leads to SQL - injection attack scenarios + + -- Paul Gevers Mon, 22 Jun 2015 20:55:59 +0200 + +cacti (0.8.8b+dfsg-8) unstable; urgency=high + + * CVE-2014-5261 + Unsufficient input sanitation leads to shell command injection + possibilities + * CVE-2014-5262 + Incomplete and incorrect input parsing leads to SQL injection attack + scenarios + * Fix for CVE-2014-5043 was incomplete, improve patch + * Change CVE-2014-4002 patch to include upstream updated commits + + -- Paul Gevers Mon, 18 Aug 2014 19:57:43 +0200 + +cacti (0.8.8b+dfsg-7) unstable; urgency=medium + + * Fix regression caused by fixing CVE-2014-4002 at least plugin autom8 + was unusable (Closes: #755032) + * Security update - CVE-2014-5025 Cross Site Scripting Vulnerability - CVE-2014-5026 Cross Site Scripting Vulnerability - CVE-2014-5043 Cross Site Scripting Vulnerability + + -- Paul Gevers Thu, 24 Jul 2014 21:56:48 +0200 + +cacti (0.8.8b+dfsg-6) unstable; urgency=high + + * Add alternative php5-mysql | php5-mysqlnd (Closes: #744067) + * Security update (Closes: #742768, #752573) - CVE-2014-2327 Cross Site Request Forgery Vulnerability - CVE-2014-4002 Cross-Site Scripting Vulnerability - -- Paul Gevers Sat, 27 Jun 2015 14:25:12 +0200 + -- Paul Gevers Wed, 25 Jun 2014 22:33:53 +0200 cacti (0.8.8b+dfsg-5) unstable; urgency=high diff --git a/debian/control b/debian/control index a1e1ee4..f21da74 100644 --- a/debian/control +++ b/debian/control @@ -18,7 +18,7 @@ Depends: dbconfig-common (>= 1.8.8), libapache2-mod-php5 | php5, libphp-adodb (>= 4.50-1), php5-cli, - php5-mysql, + php5-mysql | php5-mysqlnd, php5-snmp, rrdtool, snmp,