PT-2006-7523 · Zope · Zope

Published 2006-07-07 · Updated 2006-07-07

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Zope versions 2.7.0 through 2.7.8 Zope versions 2.8.0 through 2.8.7 Zope versions 2.9.0 through 2.9.3

Description: The issue allows local users to read arbitrary files due to the failure to disable the raw command when providing untrusted users with restructured text functionality from docutils.

Recommendations: For Zope versions 2.7.0 through 2.7.8, disable the raw command to prevent exploitation. For Zope versions 2.8.0 through 2.8.7, disable the raw command to prevent exploitation. For Zope versions 2.9.0 through 2.9.3, disable the raw command to prevent exploitation.

Related Identifiers

PYSEC-2006-7

Affected Products

Zope

References · 13

• https://osv.dev/vulnerability/PYSEC-2006-7 · Vendor Advisory
• http://securityfocus.com/bid/18856 · Note
• http://debian.org/security/2006/dsa-1113 · Note
• http://mail.zope.org/pipermail/zope-announce/2006-July/001984.html · Note
• http://vupen.com/english/advisories/2006/2681 · Note
• http://zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt · Note
• http://secunia.com/advisories/21459 · Note
• http://secunia.com/advisories/20988 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27636 · Note
• http://secunia.com/advisories/21130 · Note
• http://secunia.com/advisories/21025 · Note
• http://novell.com/linux/security/advisories/2006_19_sr.html · Note
• https://usn.ubuntu.com/317-1 · Note