Описание
Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
- CVE-2017-12065: Possible code execution via avgnan, outlier-start, or outlier-end parameter (bsc#1051633)
- CVE-2017-11691: XSS in auth_profile.php allows remote attackers to inject arbitrary JS via specially crafted HTTP Referer headers (bsc#1050950)
- CVE-2017-10970: XSS Issue in link.php bsc#1047512
- CVE-2017-11163: XSS Issue in lib/html_form.php bsc#1048102
In addition, cacti and cacti-spine were updated to the current stable release 1.1.16, containing all upstream improvements and bugfixes.
Список пакетов
openSUSE Leap 42.2
openSUSE Leap 42.3
Ссылки
- E-Mail link for openSUSE-SU-2017:2087-1
- SUSE Security Ratings
Описание
Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.
Затронутые продукты
Ссылки
- CVE-2017-10970
- SUSE Bug 1047512
Описание
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.
Затронутые продукты
Ссылки
- CVE-2017-11163
- SUSE Bug 1048102
- SUSE Bug 1051633
Описание
Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
Затронутые продукты
Ссылки
- CVE-2017-11691
- SUSE Bug 1050950
Описание
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.
Затронутые продукты
Ссылки
- CVE-2017-12065
- SUSE Bug 1051633