MGASA-2015-0097

    Dashboard / Vulnerabilities / MGASA-2015-0097

    MGASA-2015-0097

    Published: 6 Mar 2015Last Modified: 16 Apr 2026
    Upstream:
    CVE-2013-7262

    Summary: Updated mapserver packages fix CVE-2013-7262 and packaging issues

    Details: Updated mapserver packages fix security vulnerability: SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter (CVE-2013-7262). The mapserver package has been updated to version 6.2.2, which fixes this issue and several other bugs, including some packaging issues which prevented it from working anyway.

    References: https://advisories.mageia.org/MGASA-2015-0097.html, https://bugs.mageia.org/show_bug.cgi?id=15363, http://www.mapserver.org/development/changelog/changelog-6-2-2.html, https://bugzilla.redhat.com/show_bug.cgi?id=1048688

    Affected packages

    Package

    Name: mapserver

    Purl: pkg:rpm/mageia/mapserver?arch=source&distro=mageia-4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -6.2.2-1.2.mga4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2015-0097 | CVE-DB