Django Multiple Remote Vulnerabilities

Bugtraq ID:	46296
Class:	Unknown
CVE:	CVE-2011-0696 CVE-2011-0697 CVE-2011-0698
Remote:	Yes
Local:	No
Published:	Feb 09 2011 12:00AM
Updated:	May 07 2015 05:04PM
Credit:	Reported by the vendor
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Pardus Linux 2009 0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Django Django 1.1.1 Django Django 1.2.4 Django Django 1.2.2 Django Django 1.2 Django Django 1.1.3 Django Django 1.1 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Django Django 1.2.5 Django Django 1.1.4

Django Multiple Remote Vulnerabilities

Django is prone to multiple remote vulnerabilities, including:

1. An HTML-injection vulnerability
2. A cross-site request forgery vulnerability
3. A directory-traversal vulnerability

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to execute arbitrary local files within the context of the server, and to perform unauthorized actions on the affected application.

Django Multiple Remote Vulnerabilities

An attacker can use a browser to exploit these issues.

Django Multiple Remote Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu python-django-doc_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-1ubuntu1.2_all.deb


• Ubuntu python-django_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-1ubuntu1.2_all.deb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu python-django-doc_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-1ubuntu1.2_all.deb


• Ubuntu python-django_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-1ubuntu1.2_all.deb

Ubuntu Ubuntu Linux 10.10 ARM

• Ubuntu python-django-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb


• Ubuntu python-django_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.2.3-1ubuntu0.2.10.10.2_all.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu python-django-doc_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-1ubuntu1.2_all.deb


• Ubuntu python-django_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-1ubuntu1.2_all.deb

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva python-django-1.1.4-0.1mdv2010.2.noarch.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.0

• Mandriva python-django-1.1.4-0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.10 amd64

• Ubuntu python-django-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb


• Ubuntu python-django_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.2.3-1ubuntu0.2.10.10.2_all.deb

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva python-django-1.1.4-0.1mdv2010.0.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu python-django-doc_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-2ubuntu1.3_all.deb


• Ubuntu python-django_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-2ubuntu1.3_all.deb

Mandriva Linux Mandrake 2010.1

• Mandriva python-django-1.1.4-0.1mdv2010.2.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu python-django-doc_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-1ubuntu1.2_all.deb


• Ubuntu python-django_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-1ubuntu1.2_all.deb

Ubuntu Ubuntu Linux 10.10 powerpc

• Ubuntu python-django-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb


• Ubuntu python-django_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.2.3-1ubuntu0.2.10.10.2_all.deb

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu python-django-doc_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-2ubuntu1.3_all.deb


• Ubuntu python-django_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-2ubuntu1.3_all.deb

Ubuntu Ubuntu Linux 9.10 ARM

• Ubuntu python-django-doc_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-1ubuntu1.2_all.deb


• Ubuntu python-django_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-1ubuntu1.2_all.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu python-django-doc_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-1ubuntu1.2_all.deb


• Ubuntu python-django_1.1.1-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-1ubuntu1.2_all.deb

Ubuntu Ubuntu Linux 10.04 ARM

• Ubuntu python-django-doc_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-2ubuntu1.3_all.deb


• Ubuntu python-django_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-2ubuntu1.3_all.deb

Ubuntu Ubuntu Linux 10.10 i386

• Ubuntu python-django-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb


• Ubuntu python-django_1.2.3-1ubuntu0.2.10.10.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.2.3-1ubuntu0.2.10.10.2_all.deb

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu python-django-doc_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-2ubuntu1.3_all.deb


• Ubuntu python-django_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-2ubuntu1.3_all.deb

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu python-django-doc_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo-doc_1.1.1-2ubuntu1.3_all.deb


• Ubuntu python-django_1.1.1-2ubuntu1.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-dja ngo_1.1.1-2ubuntu1.3_all.deb

Django Multiple Remote Vulnerabilities

References:

• Django Homepage (Django)
  
• Security releases issued (Django)