[tikiwiki] Multiple vulnerabilities possibly resulting in the remote execution of arbitrary code

Adding:
http://www.gentoo.org/security/en/glsa/glsa-200710-21.xml

"ShAnKaR reported that input passed to the "f" array parameter in tiki-graph_formula.php is not properly verified before being used to execute PHP functions.
[...]
An attacker could execute arbitrary code with the rights of the user running the web server by passing a specially crafted parameter string to the tiki-graph_formula.php file."

As a reminder:

CVE-2006-6457 CVE-2007-4554

CVE-2006-6457 is not for us.

Thanks for preparing this! I've uploaded it to the security queue; it should be published shortly.

tikiwiki (1.9.7+dfsg-2ubuntu1.1) gutsy-security; urgency=low

  * SECURITY UPDATE: (LP: #163833)
    + CVE-2007-4554: Cross-site scripting (XSS) vulnerability in
      tiki-remind_password.php in Tikiwiki (aka Tiki CMS/Groupware) 1.9.7 allows
      remote attackers to inject arbitrary web script or HTML via the username
      parameter. NOTE: this issue might be related to CVE-2006-2635.7.
    + CVE-2007-5423: Eval injection vulnerability in tiki-graph_formula.php in
      TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP
      sequences in the f array parameter.
    + CVE-2007-5682: Unspecified vulnerability in tiki-graph_formula.php in
      TikiWiki before 1.9.8.2 has unknown impact and attack vectors, a different
      vulnerability than CVE-2007-5423.
  * debian/patches/90_CVE-2007-4554.dpatch:
    - Applied patch by upstream
  * debian/patches/90_CVE-2007-5423_CVE-2007-5682.dpatch:
    - Applied patch by upstream
  * References:
    CVE-2007-4554
    CVE-2007-5423
    CVE-2007-5682

 -- Stephan Hermann <email address hidden> Mon, 26 Nov 2007 15:22:52 +0100

tikiwiki (1.9.7+dfsg-1ubuntu1.1) feisty-security; urgency=low

  * SECURITY UPDATE: (LP: #163833)
    + CVE-2007-4554: Cross-site scripting (XSS) vulnerability in
      tiki-remind_password.php in Tikiwiki (aka Tiki CMS/Groupware) 1.9.7 allows
      remote attackers to inject arbitrary web script or HTML via the username
      parameter. NOTE: this issue might be related to CVE-2006-2635.7.
    + CVE-2007-5423: Eval injection vulnerability in tiki-graph_formula.php in
      TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP
      sequences in the f array parameter.
    + CVE-2007-5682: Unspecified vulnerability in tiki-graph_formula.php in
      TikiWiki before 1.9.8.2 has unknown impact and attack vectors, a different
      vulnerability than CVE-2007-5423.
  * debian/patches/90_CVE-2007-4554.dpatch:
    - Applied patch by upstream
  * debian/patches/90_CVE-2007-5423_CVE-2007-5682.dpatch:
    - Applied patch by upstream
  * References:
    CVE-2007-4554
    CVE-2007-5423
    CVE-2007-5682

 -- Stephan Hermann <email address hidden> Mon, 26 Nov 2007 15:34:47 +0100