ID de Prueba:	1.3.6.1.4.1.25623.1.0.71513
Categoría:	FreeBSD Local Security Checks
Título:	FreeBSD Ports: py26-django, py27-django
Resumen:	The remote host is missing an update to the system; as announced in the referenced advisory.
Descripción:	Summary: The remote host is missing an update to the system as announced in the referenced advisory. Vulnerability Insight: The following packages are affected: py26-django py27-django py26-django-devel py27-django-devel CVE-2012-3442 The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL. CVE-2012-3443 The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file. CVE-2012-3444 The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image. Solution: Update your system with the appropriate patches or software upgrades. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-3442 DSA-2529 http://www.debian.org/security/2012/dsa-2529 MDVSA-2012:143 http://www.mandriva.com/security/advisories?name=MDVSA-2012:143 USN-1560-1 http://www.ubuntu.com/usn/USN-1560-1 [oss-security] 20120730 CVE Request: Django 1.3.1 and 1.4.0 security issues http://www.openwall.com/lists/oss-security/2012/07/31/1 [oss-security] 20120730 Re: CVE Request: Django 1.3.1 and 1.4.0 security issues http://www.openwall.com/lists/oss-security/2012/07/31/2 https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ Common Vulnerability Exposure (CVE) ID: CVE-2012-3443 Common Vulnerability Exposure (CVE) ID: CVE-2012-3444
Copyright	Copyright (C) 2012 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.