Security update for cacti, cacti-spine
This update for cacti, cacti-spine fixes the following issues:
- CVE-2017-12065: Possible code execution via avgnan, outlier-start, or outlier-end parameter (bsc#1051633)
- CVE-2017-11691: XSS in auth_profile.php allows remote attackers to inject arbitrary JS via specially
crafted HTTP Referer headers (bsc#1050950)
- CVE-2017-10970: XSS Issue in link.php bsc#1047512
- CVE-2017-11163: XSS Issue in lib/html_form.php bsc#1048102
In addition, cacti and cacti-spine were updated to the current stable release 1.1.16,
containing all upstream improvements and bugfixes.
-
Submitted by
Andreas Stieger (AndreasStieger)
Fixed bugs
bnc#1050950
VUL-0: CVE-2017-11691: cacti: XSS in auth_profile.php allows remote attackers to inject arbitrary JS via specially crafted HTTP Referer headers
bnc#1051633
VUL-0: CVE-2017-12065: cacti: Possible code execution via avgnan, outlier-start, or outlier-end parameter
bnc#1048102
VUL-0: CVE-2017-11163: cacti: Cross-site scripting (XSS) vulnerability in aggregate_graphs.php allows remote authenticated users to inject arbitrary web script or HTML
bnc#1047512
VUL-0: CVE-2017-10970: cacti: Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12allows remote anonymous users to inject arbitrary web script or HTMLvia the id parameter, related to the die_html_input_error function inlib/html_
