Zwei Probleme in Ampache
ID: | USN-4693-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 16.04 LTS |
Datum: | Fr, 15. Januar 2021, 19:52 |
Referenzen: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12385
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12386 |
Applikationen: | Ampache |
Originalnachricht |
|
--===============6974904579576262164== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="jbkgyd3ob3epuqcf" Content-Disposition: inline --jbkgyd3ob3epuqcf Content-Type: text/plain; charset=us-ascii Content-Disposition: inline ========================================================================== Ubuntu Security Notice USN-4693-1 January 14, 2021 ampache vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Ampache. Software Description: - ampache: web-based audio file management system Details: It was discovered that an SQL injection vulnerability exists in the Ampache search engine. Any user able to perform searches could dump any data contained in the database. An attacker could use this to disclose sensitive information. (CVE-2019-12385) It was discovered that an XSS vulnerability in Ampache. An attacker could use this vulnerability to force an admin to create a new privileged user. (CVE-2019-12386) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: ampache 3.6-rzb2779+dfsg-0ubuntu9.2 ampache-common 3.6-rzb2779+dfsg-0ubuntu9.2 After a standard system update you need to restart ampache to make all the necessary changes. References: https://usn.ubuntu.com/4693-1 CVE-2019-12385, CVE-2019-12386 Package Information: https://launchpad.net/ubuntu/+source/ampache/3.6-rzb2779+dfsg-0ubuntu9.2 --jbkgyd3ob3epuqcf Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAmABlYoACgkQbUp5kL3i zGZPURAAiuwFivHJctQrgL7Oe+eOQXn0zGPgekuhGG0NUcn7k1wQP9xWQjWS72JQ wHN2szjGKf/YBOfqSUm7LaUbZ1W2nz1RaeSRLW2Bl8QwnKxqM5hPlnS7y/xVsQpH SErFlVzxHdP3yUmhIahyiG3urH5uIRqGxFqdUK9AMytN5pdSeoi0KQZ/j8mjTY2b 1UH2qfOBoWWlucMsbeSZVdzZd1gs0njCjCXYz7mmBLl6/bivJE7QE8qJLF2b7QvU 1NWTn4EdxPjxCAM3wMK8tXQq5NmUmebiYMIw5JmM63XPTFZgB0JYhV3vk64r+Uz5 L+9/vnGngBMG9v6b5PH7a2XQl296qCN1UuJPWDB3jki69rlpYsHDp0aGd2ma+Agd u3ekGLEgVb8MTlQbbRhadUkzN+AdiPuHtpM8H/VlSN9bnfb9UMep2ecEJXU6VqZ0 HjZdzS9KsHXgkVUeKTWg7Lj0OuGE0ez3+wZhQwSuSMoG8NxunSug17mHtYnas+zD nUI6EAyqcFIgzyUuPtISvKS3zTpDAtDkl0zbILSjOy5za9DVUdYnN/eF1S5Zw6X9 0hejgpsmp61yEajCby+3kkPpqaqD4bprDI5t+TYbGa9keBuxZnaioxH8o/Zvw6ip hGPWiQfNGkF+M/9SC+0ydXWP2gdlx0zijBXlnCl6xFAz3KlGF4k= =pZTB -----END PGP SIGNATURE----- --jbkgyd3ob3epuqcf-- --===============6974904579576262164== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce |