Vulnerability   
Search   
    Search 191973 CVE descriptions
and 86218 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.702529
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 2529-1 (python-django - several vulnerabilities)
Summary:Jeroen Dekkers and others reported several vulnerabilities in Django,;a Python Web framework. The Common Vulnerabilities and Exposures;project defines the following issues:;;CVE-2012-3442Two functions do not validate the scheme of a redirect target,;which might allow remote attackers to conduct cross-site scripting;(XSS) attacks via a data: URL.;;CVE-2012-3443The ImageField class completely decompresses image data during image;validation, which allows remote attackers to cause a denial of service;(memory consumption) by uploading an image file.;;CVE-2012-3444The get_image_dimensions function in the image-handling functionality;uses a constant chunk size in all attempts to determine dimensions,;which allows remote attackers to cause a denial of service (process;or thread consumption) via a large TIFF image.
Description:Summary:
Jeroen Dekkers and others reported several vulnerabilities in Django,
a Python Web framework. The Common Vulnerabilities and Exposures
project defines the following issues:

CVE-2012-3442Two functions do not validate the scheme of a redirect target,
which might allow remote attackers to conduct cross-site scripting
(XSS) attacks via a data: URL.

CVE-2012-3443The ImageField class completely decompresses image data during image
validation, which allows remote attackers to cause a denial of service
(memory consumption) by uploading an image file.

CVE-2012-3444The get_image_dimensions function in the image-handling functionality
uses a constant chunk size in all attempts to determine dimensions,
which allows remote attackers to cause a denial of service (process
or thread consumption) via a large TIFF image.

Affected Software/OS:
python-django on Debian Linux

Solution:
For the stable distribution (squeeze), this problem has been fixed in
version 1.2.3-3+squeeze3.

For the unstable distribution (sid), this problem has been fixed in
version 1.4.1-1.

We recommend that you upgrade your python-django packages.

CVSS Score:
5.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2012-3444
Debian Security Information: DSA-2529 (Google Search)
http://www.debian.org/security/2012/dsa-2529
http://www.mandriva.com/security/advisories?name=MDVSA-2012:143
http://www.openwall.com/lists/oss-security/2012/07/31/1
http://www.openwall.com/lists/oss-security/2012/07/31/2
http://www.ubuntu.com/usn/USN-1560-1
Common Vulnerability Exposure (CVE) ID: CVE-2012-3442
Common Vulnerability Exposure (CVE) ID: CVE-2012-3443
CopyrightCopyright (C) 2013 Greenbone Networks GmbH http://greenbone.net

This is only one of 86218 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2020 E-Soft Inc. All rights reserved.