Secure testing team - Jul 2009 - Bug#537935: CVE-2009-2492: Cross-site scripting (XSS) vulnerability in mt-wizard.cgi

Package: movabletype-opensource
Version: 4.2.3-1
Severity: serious lenny
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for movabletype-opensource.

CVE-2009-2492[0]:
| Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart
| Movable Type before 4.261 allows remote attackers to inject arbitrary
| web script or HTML via unspecified vectors, a different vulnerability
| than CVE-2009-2480.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

This bug is already fixed in testing and unstable.
Please coordinate with the security team (team at security.debian.org) to
prepare packages for the stable releases.


For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2492
    http://security-tracker.debian.net/tracker/CVE-2009-2492

Cheers,
Giuseppe

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkpmHwwACgkQNxpp46476arVvwCbB0AzXDaq1y+XpL0dTZ8lrqZd
Vv0AoJJwt7NHLYdW7XmtMxoU2LkaTO7s
=HxiA
-----END PGP SIGNATURE-----