Multiple vulnerabilities have been found in Namazu, worst of which allows remote attackers to cause a Denial of Service condition.

Announced

2013-11-28

Revised

2013-11-28

Access

remote

Bugs

#391259

Advisory

https://security.gentoo.org/glsa/201311-22

Affected packages

Package	Arch	Vulnerable	Unaffected
app-text/namazu	*	< 2.0.21	>= 2.0.21

Background

Namazu is a full-text search engine intended for easy use.

Description

Multiple vulnerabilities have been discovered in Namazu. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could execute arbitrary code or cause a Denial of Service condition. Furthermore, a remote attacker may be able to inject arbitrary web script or HTML via a cookie.

Workaround

There is no known workaround at this time.

Resolution

All Namazu users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/namazu-2.0.21"

References

• CVE-2009-5028
• CVE-2011-4345
• CVE-2011-4711