Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0774
redmine security update
24 March 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: redmine
Publisher: Debian
Operating System: Debian GNU/Linux 8
Windows
UNIX variants (UNIX, Linux, OSX)
Virtualisation
Impact/Access: Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Unknown/Unspecified
Resolution: Patch/Upgrade
CVE Names: CVE-2015-8537 CVE-2015-8474 CVE-2015-8473
CVE-2015-8346
Original Bulletin:
http://www.debian.org/security/2016/dsa-3529
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running redmine check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3529-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
March 23, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : redmine
CVE ID : CVE-2015-8474 CVE-2015-8346 CVE-2015-8473 CVE-2015-8537
Multiple vulnerabilities have been found in Redmine, a project management
web application, which may result in information disclosure.
For the stable distribution (jessie), these problems have been fixed in
version 3.0~20140825-8~deb8u2.
For the testing distribution (stretch), these problems have been fixed
in version 3.2.0-1.
For the unstable distribution (sid), these problems have been fixed in
version 3.2.0-1.
We recommend that you upgrade your redmine packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJW8uVgAAoJEBDCk7bDfE42nt4P/0EUWgr0adBws5M87SeRiklg
P9EOlzLaEv/pQdV44WF3EZBhsgYIQ6LxQetrkA9r94YUmIYzSI7J8F70w65rb3gG
HPA17IG00Q+jbnKl33NqSGwuIFTne7HkMJlruHvzUIyQGNC/aG3CefSU/QKYi27D
hrdSHgErolbvsSxRoU8SUeysrPwvIv9DwEDErwnYw3fWEnJgveLP8QxlpV8pz70E
sI8o5DXQPp2zOdWEY7l3IEj6kW9jI4zHs9aLULUQP4ezfvmoY8ZS04iXvyfV3FHy
+SxNl1ZRPaAVntafYPyPzS6KEOy0JXfIxWjCmLlj3IfDxrAiNH3vri0sWfPQsWTS
9gKepKGsjPrphrw333ypkjEu0LTmO0mgggr25ZIUfYFgvLMe8tg+fIMOHTdZY9S5
BGs+HjZ0c0cPYqGZwF/zPm5Fm/vmj7ZpJez5PxT1977CAhU683pMGdcSObmDqyzf
thUEE6BwA1jtIObQEHmWovPfbZuLQRLujWAnx92bMJnJducnX3weyGMYcQDqkCJE
Dhq9XuSYxoKFGZ6UR4PyhKGht0RWnq6yWI2HBbJPx/kIgeV3Y5wqLRQWOqIOsJsI
nZKEKndzJvUOK65E1Wt9uN3QmDIlj58i7htXWX1dTI6w7QKeH0vLsyoyLTVnQDjw
V16uyghxWkvJ+Aj1482h
=uCSc
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVvMxGX6ZAP0PgtI9AQKjbQ//Woo52jAvkXHuQvyr2yFBTGG3yLnsi99D
EnfwysSQvgYvDXPygm/Osk/FTc0fq+9+vmpHwPX/ZJi636Ab4ugh/RZFph5oVHUP
6cSZEhY2cZlJ/ZJJJK3wWBI0PGH+vBN8s9L8ID3K2Ys6WzaHBxKHmrDD/At5EEGB
1wnakU1NsU89OJgIa9bRdwVCb0XAS5vkwJeoJEw7uoKXG6uNhKYgYO9CUzf0LAMs
PhP4DQx4SYaJRGOzT7sw8GfanMklzkViYaSF0kocwbtVa/nKHrrxDlkfZ6BZIhgN
1IE5JSbUW0fSh8KTYlcjAOg1jqJ5cD2co6ixYTRKrN7GGLBGFQ6maEXmvfXrvR0H
2aLI22iDbozrLtiyFu68ynNcOQTQNM6XPDwz/KyCAhJOuyVaDEdHtZ0EsGKZnO0m
iZGSI6I/JR2nSx5pQFUDBFqA0WaZkoehT0ow3W9Z+JpnW6dO0LLWxgEiZlu1h1od
nXtv5XbxaZCsTOSFFGs69BGZnP94xpcvm9LUcFne/61iTi2s+iyoo1gYohzM0axY
VLXKWe42u+fKDj810myXxyBY65lsYzsQY9q64LmZ/Lhy2R9WXY5VnQyIbGNDvLUA
oK6bWnyT5YCVaB7DCpuL21mfTPwwvsNBz52CA4/zqYZyxgAsXv1IxWDljfMOd3cK
UW6bfaDuhGg=
=5N9A
-----END PGP SIGNATURE-----