CVE-2007-5741

Advisory

Plone-app-linkintegrity 1.0.2 includes a fix for CVE-2007-5741: Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.
https://github.com/plone/plone.app.linkintegrity/commit/4be49548c4f1046a8204030f26a603c29f38d9dd

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

- Fixed parser error when handling malformed HTML
[witsch]

- Fixed security issue due to using pickles (see CVE-2007-5741)
[witsch]

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5741
• http://plone.org/about/security/advisories/cve-2007-5741
• http://www.securityfocus.com/bid/26354
• http://secunia.com/advisories/27530
• http://www.debian.org/security/2007/dsa-1405
• http://secunia.com/advisories/27559
• http://osvdb.org/42072
• http://osvdb.org/42071
• http://www.vupen.com/english/advisories/2007/3754
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38288
• http://www.securityfocus.com/archive/1/483343/100/0/threaded